Analysis

  • max time kernel
    134s
  • max time network
    99s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2023, 12:52

General

  • Target

    Polyphone_v2.3.1_win64.exe

  • Size

    17.6MB

  • MD5

    45ba06389d72c259101a2b15dd9ebb53

  • SHA1

    f874d23b4e2508c4fe72ddf38cabf239fd382988

  • SHA256

    74e3122d5909ca76a95a4c331f79044fbc830b6724454073cdd7cf1cd052cd2d

  • SHA512

    97b80d1db1c0d12beda6e9152345d6b7760445d32e72df264b49df5314e4e12351611e3ea7c3d82c6c1463870225a26fa71aecf055f4bdc1edba471540a66ac3

  • SSDEEP

    393216:lLXNfwTK1sgwZp/qSRA4l4uieHA/5bDOHWdQVbKJooVNLFWJpjj0yu:lXNfwTK1wZpiSnXHAlOHoQVb/oHFCjjg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 35 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 16 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Polyphone_v2.3.1_win64.exe
    "C:\Users\Admin\AppData\Local\Temp\Polyphone_v2.3.1_win64.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Users\Admin\AppData\Local\Temp\is-CP6TL.tmp\Polyphone_v2.3.1_win64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CP6TL.tmp\Polyphone_v2.3.1_win64.tmp" /SL5="$70126,17555721,875520,C:\Users\Admin\AppData\Local\Temp\Polyphone_v2.3.1_win64.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Program Files\Polyphone\polyphone.exe
        "C:\Program Files\Polyphone\polyphone.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1316
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x518
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1688

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Polyphone\Qt5Core.dll

    Filesize

    7.8MB

    MD5

    f38f9d503157c6b2401801f9572fd048

    SHA1

    52f999e93532349d0fca73f49e7a4e987b4a5e1f

    SHA256

    858abb9ddcb3cd4fa15c01d3cd64ff4371a79516b02bc3df20590a82161fba55

    SHA512

    c31966139cb1d5df66ea5cfde65b09449d5f25d5c4fc146cd44f0e0124e8106eef124fc40e2522aaee571e4685e605ebbcab8305a23d00ab9d7828c70a7f1be3

  • C:\Program Files\Polyphone\Qt5Gui.dll

    Filesize

    9.2MB

    MD5

    fc7d92feb89f055f7f19169e7a1f3621

    SHA1

    5a0f1b5fa82f419020fb38010340032971495dcd

    SHA256

    8bcf807aaf2419843a778994187fa4a2fe9e2d926435ed8add3e670935b3f9aa

    SHA512

    e97dbc3afc7875dd753c10804aa1c98abc6462f4a295ef88f9f96292a620d607f8d67fb3172a4eca72664f7c0e928e2709dfff42586f516c4ba3567fa4a334e0

  • C:\Program Files\Polyphone\Qt5Network.dll

    Filesize

    2.6MB

    MD5

    94da65cb700658388a9cc3478abee446

    SHA1

    d6eb041d57a730ca203a00c925281bc112a99fda

    SHA256

    7660849b5647d0cd1c893fd0f977474df7b968bfae17cec79dbc77359f4e01f3

    SHA512

    d71046b4a48ee6b085d10131a4bdd77045258685d6d10cff8626e7c5ed1a02218e095dc5e3a63b57868d84ab71b41e1265b7f8cf87fe462c90e8d7ec1248e699

  • C:\Program Files\Polyphone\Qt5PrintSupport.dll

    Filesize

    636KB

    MD5

    1aa44dda604dcfaf8d91a49b0387319f

    SHA1

    4934f7a5166735b46f0265d5e934782cf1fa202b

    SHA256

    22032127d45f92d6a456fc8f1a1e19c81dd3d4007068a3811e031c865a3c64ee

    SHA512

    31588b09d0739d7b9053d056309b1f6e3fe89f0fac18ead2736d18a174d3e0771d2bc621afbd74cff0fff3b4159da42a002c25df4261b44e12290966eb2a69c0

  • C:\Program Files\Polyphone\Qt5Svg.dll

    Filesize

    566KB

    MD5

    7b80103c5e287dc427a6e9435ab05f35

    SHA1

    272f90165ff6d440e2d4ce21f69eeb44ac8a5c9b

    SHA256

    25ad9cf13bbef3b7f7f99c8effc25aedd20dcf8b2455e4b685ebb27d510f9ecc

    SHA512

    522037c7aa50cbf122d1e11e1b0284afe7b7f77dc6f1fafd89d803816e8ab92a98b8f9a14c2cca45bcc475405f4b6c89ba9da3973572982a903d38fd6bfff2cd

  • C:\Program Files\Polyphone\Qt5Widgets.dll

    Filesize

    8.3MB

    MD5

    f4cf06dedf04a732be32acd1291cf032

    SHA1

    8b9f8b822722537cf3043bc0e3a0069c33c1c66b

    SHA256

    f1cdc4e0717d054a654373c52d98b8730d4dfd48eac0e5d9f518d9cede45fcdd

    SHA512

    e0dd90285afafeef96776c268672283604c61502f7ca7d165b054654e6ca960f0e9087f56693fad48d4d18c78b44fe7e5f05988739e789a1712440c3a742dc3a

  • C:\Program Files\Polyphone\libFLAC-8.dll

    Filesize

    276KB

    MD5

    edc1192cab434e4318a2ed824d00d000

    SHA1

    6fc7638e6b009be85f862b0cbd67e03b62ec498b

    SHA256

    5b2273b1576004b1830d814f90b630197402c21e52ac70d8a6a87f76b3a7df11

    SHA512

    1bd3e2216b133cbc8470c09ba0e3589ad8abf73f896363cc1927d4c38f5ca4611d835dfee12e3e38231c38beffa00f18b9e1de4ec787bfcfbfba9f004db7ce06

  • C:\Program Files\Polyphone\libcrypto-1_1-x64.dll

    Filesize

    2.7MB

    MD5

    337c64c63885fcba37203f28ab818d2b

    SHA1

    fbb082bd35c9c7737437eb3713b3bd75f3af286b

    SHA256

    c26f0a66c31b74628365936a31134f62df253441d88a888d4bb0fba9d0412893

    SHA512

    dc33e20bc083818bf11398c5f6fbdf53d4cd295fa6dd148a27f6ea422a129ecba9f62085c3d439f161a5d3aa39c337eb3998f17c2d70eb6df264525434b4a20b

  • C:\Program Files\Polyphone\libgcc_s_seh-1.dll

    Filesize

    74KB

    MD5

    534b365361004828059600f05b34006d

    SHA1

    d8ff411b0939a021f47c845c6a90f1240bab5268

    SHA256

    438ae82ffd621a2413199155574cc85681f8986f05420b1485aa4be936c3bc0b

    SHA512

    1ccb3732a82f2fedca85c27afdd48e65dde70d5b1620e436d457624a2cb796887c5e7dc2983a0794ebbbcade3e5b9f9fc9320b390894471993c7b1e85268592d

  • C:\Program Files\Polyphone\libogg-0.dll

    Filesize

    40KB

    MD5

    a2041cccfb5d46896e0f0e7bb8cf7346

    SHA1

    fdfa8fa410e11e533bde8abe6df7500e725d333d

    SHA256

    98abbc0beec191b1bff354422668533faabd1c5e5744b34282128e61c0d0de0a

    SHA512

    5395d4dd0dcb5267f07353eea2fa50c352df979b5ba8c1a48ebde80f448750165d5694778df36d45029f31a33b66308774998535525be04c21e1823001190fb5

  • C:\Program Files\Polyphone\libportaudio.dll

    Filesize

    341KB

    MD5

    c6fa91e19fcff596e4cbc61c7471ac47

    SHA1

    a835d0c7989a346bf479274e2752a5e06bc493b1

    SHA256

    2ef9d21b27b69c4b29007b1136bae9a56ea83118b27ed62018d7cc757f8fc0dd

    SHA512

    d28b8f158a70e77ecd65ef0b62c654e3a435511485ffe6d5960cfa5783af957b0771c15fcfd9dc48655ff6efc3430f8440c89da7d4fc925bae0b863611bb9b6f

  • C:\Program Files\Polyphone\libssl-1_1-x64.dll

    Filesize

    567KB

    MD5

    5dbc158952378d9b7a6a09aa8725c30a

    SHA1

    557c9d9001b7a8d8f1820c1d4c16c723515dfea8

    SHA256

    7e8131b5876d9e6e63556d4c84410b1e884f035499a6bfda9a018ddda85779f6

    SHA512

    73c1eb5702004877e872f03758bf3723a7fe8f381a3b2c6c1de99178f3e67297ded8deacecfb6aea7c462b35d63684bab54656e190627422a38f775323096afb

  • C:\Program Files\Polyphone\libssp-0.dll

    Filesize

    21KB

    MD5

    926d4d9a58925bdc4ed6abd1168a80cd

    SHA1

    9e06b46cb131ab0bf2672a3c8c8e38c5d85444dc

    SHA256

    4c233a98bd8afe06580b1a5931010ec857f97b35f4a49e01bf868654ed64d55d

    SHA512

    ff12a5d631399edb892b2dd1e1cffc288f58e80ef379db4c55bb1089cdf257d0d022728bde23f2e739c76d0d3ebf6ffff339dba7f5e1f1384a6487be50c04ce6

  • C:\Program Files\Polyphone\libstdc++-6.dll

    Filesize

    1.4MB

    MD5

    58f1c3e85a3714b9f5441c9b513e08bb

    SHA1

    4e30e2bd5917754cf2d4f8bd30b28f7ef9505a23

    SHA256

    72ce15df7c50e8d0ca57701b0b37394942e5348654505fcb993873b515dfd1d0

    SHA512

    7b52fcd6b0b76ef192c107a7a2e0a2144eda045988b46939c5a7eff87477b4cdc5c38557a0f467b6e27fc9fb55b2b679bd00c4fc36dfa015cf471cc7f0232836

  • C:\Program Files\Polyphone\libvorbis-0.dll

    Filesize

    176KB

    MD5

    cc8d416f847fbdbb317a09e6592d0d5b

    SHA1

    a9a35c7ecbc3882b39bb5ec8b28473309f32dc0a

    SHA256

    3d91c201ec3e902b4ccf47568ae294b044e4a8fa00a9f385d5113865a0df3d9e

    SHA512

    eec05d72f4390734515713e0bf8ff29daaf9c0f3695b13a01414397d0aa7e6f6e7933078396446c3be05b051877a638c926630ded310f8ac868dcd482b242180

  • C:\Program Files\Polyphone\libvorbisenc-2.dll

    Filesize

    564KB

    MD5

    7dc183a321914e42725d312586d7baf6

    SHA1

    9adb2424770a3db565941f9dbedf245b51534961

    SHA256

    f9b04ef131e273d8a692759a123660bf33fc4a619e36cc5363ee74323e0e9fe0

    SHA512

    238c6cebec252825b4bc9e5e38e101e241b6cfdb15644d7f100ce7c80b6bfe93a6cf260ff1db1c0b8f731a1d0a00e14bf0ee488917c8bd981f0f25d00a4c63dc

  • C:\Program Files\Polyphone\libvorbisfile-3.dll

    Filesize

    37KB

    MD5

    85c5af40b9b9160a55519122e9a21fef

    SHA1

    ff699e277cc3fefc4fad5c2df81588b0ce078fa0

    SHA256

    e1f199bb28367dec91d895cfd8aec1b52d2c0188cd6c2c402b39e49f83667588

    SHA512

    ce9f46b6476b99ef160ec37454d8318391a5fbb52b41909034a736cba8bd8666197893585c4abdc9d677bb1385c33bc1a7a666a7474d30f41379f15851ad6a16

  • C:\Program Files\Polyphone\libwinpthread-1.dll

    Filesize

    51KB

    MD5

    db18b7ec5f93127e6099744ea9568c1b

    SHA1

    e9143c76e308a816837e2f1a19dd0c5e2306ed08

    SHA256

    5bbef249a0d00e2d32c699d0bbe89f714ebeb872b3990a5cbeccb1d89f63e5e8

    SHA512

    ee1e645bed0bc3ad9e959d6342153e608ad21a7f5aef60b4cd8cc96fde7aeec4bbbb7474b59cab8ced8f28dc9f66cab32f4825333c891524901dcc40e70a1580

  • C:\Program Files\Polyphone\platforms\qwindows.dll

    Filesize

    2.8MB

    MD5

    7c0f42ae64400b354ce7ea9bcaba32c5

    SHA1

    d7615621225849c3d6f7e37c10e492ca8820f27a

    SHA256

    5420275c89725866b70bd24b7b556222ff7ea47fd1effdecef0d0a1c20405c43

    SHA512

    c29d84e2685128e746808243d090497b6326196c32bd4385fabeee66e971989a1ecd57e87a01d5e222aba6edd0c27165212fb5aeee9029fb32e758cbb3726ea4

  • C:\Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • C:\Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • C:\Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • C:\Program Files\Polyphone\styles\qwindowsvistastyle.dll

    Filesize

    307KB

    MD5

    feb4726f427184278dc3f5cf001429df

    SHA1

    d0a94a60a0c2b0c9db468aa491930b207a62f5b8

    SHA256

    1622ebfa4b5430ced830fd447b20e1618059507b642babb4aa55f02550eafae2

    SHA512

    11f56bb75830ec1fc2dad42103a25aebe29dc61fdc137e17e6e81147b2feb7556278fa1146ffa987ece669261576dc1a78bec26edb9202172168cfbccccc50e2

  • C:\Program Files\Polyphone\zlib1.dll

    Filesize

    113KB

    MD5

    75365924730b0b2c1a6ee9028ef07685

    SHA1

    a10687c37deb2ce5422140b541a64ac15534250f

    SHA256

    945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

    SHA512

    c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

  • C:\Users\Admin\AppData\Local\Temp\is-CP6TL.tmp\Polyphone_v2.3.1_win64.tmp

    Filesize

    3.1MB

    MD5

    3ce0dad2255fee7b5af0846081573469

    SHA1

    56d70e57410d6a1138151ac52380e645fd1e7f99

    SHA256

    059f07f874cb45348122afe61948fd3d447b7bdeb23551437eea0b994090c6e2

    SHA512

    f9c3b358dbc1f41fe247f8dd16377740c3c1d274a250fdfc74f62bcf44e8b8a27d5481939bb3ffc89017feaae1f16d02304f5839a4e814c61df2dfa06b9254c8

  • C:\Users\Admin\AppData\Local\Temp\is-CP6TL.tmp\Polyphone_v2.3.1_win64.tmp

    Filesize

    3.1MB

    MD5

    3ce0dad2255fee7b5af0846081573469

    SHA1

    56d70e57410d6a1138151ac52380e645fd1e7f99

    SHA256

    059f07f874cb45348122afe61948fd3d447b7bdeb23551437eea0b994090c6e2

    SHA512

    f9c3b358dbc1f41fe247f8dd16377740c3c1d274a250fdfc74f62bcf44e8b8a27d5481939bb3ffc89017feaae1f16d02304f5839a4e814c61df2dfa06b9254c8

  • \Program Files\Polyphone\Qt5Core.dll

    Filesize

    7.8MB

    MD5

    f38f9d503157c6b2401801f9572fd048

    SHA1

    52f999e93532349d0fca73f49e7a4e987b4a5e1f

    SHA256

    858abb9ddcb3cd4fa15c01d3cd64ff4371a79516b02bc3df20590a82161fba55

    SHA512

    c31966139cb1d5df66ea5cfde65b09449d5f25d5c4fc146cd44f0e0124e8106eef124fc40e2522aaee571e4685e605ebbcab8305a23d00ab9d7828c70a7f1be3

  • \Program Files\Polyphone\Qt5Gui.dll

    Filesize

    9.2MB

    MD5

    fc7d92feb89f055f7f19169e7a1f3621

    SHA1

    5a0f1b5fa82f419020fb38010340032971495dcd

    SHA256

    8bcf807aaf2419843a778994187fa4a2fe9e2d926435ed8add3e670935b3f9aa

    SHA512

    e97dbc3afc7875dd753c10804aa1c98abc6462f4a295ef88f9f96292a620d607f8d67fb3172a4eca72664f7c0e928e2709dfff42586f516c4ba3567fa4a334e0

  • \Program Files\Polyphone\Qt5Network.dll

    Filesize

    2.6MB

    MD5

    94da65cb700658388a9cc3478abee446

    SHA1

    d6eb041d57a730ca203a00c925281bc112a99fda

    SHA256

    7660849b5647d0cd1c893fd0f977474df7b968bfae17cec79dbc77359f4e01f3

    SHA512

    d71046b4a48ee6b085d10131a4bdd77045258685d6d10cff8626e7c5ed1a02218e095dc5e3a63b57868d84ab71b41e1265b7f8cf87fe462c90e8d7ec1248e699

  • \Program Files\Polyphone\Qt5PrintSupport.dll

    Filesize

    636KB

    MD5

    1aa44dda604dcfaf8d91a49b0387319f

    SHA1

    4934f7a5166735b46f0265d5e934782cf1fa202b

    SHA256

    22032127d45f92d6a456fc8f1a1e19c81dd3d4007068a3811e031c865a3c64ee

    SHA512

    31588b09d0739d7b9053d056309b1f6e3fe89f0fac18ead2736d18a174d3e0771d2bc621afbd74cff0fff3b4159da42a002c25df4261b44e12290966eb2a69c0

  • \Program Files\Polyphone\Qt5Svg.dll

    Filesize

    566KB

    MD5

    7b80103c5e287dc427a6e9435ab05f35

    SHA1

    272f90165ff6d440e2d4ce21f69eeb44ac8a5c9b

    SHA256

    25ad9cf13bbef3b7f7f99c8effc25aedd20dcf8b2455e4b685ebb27d510f9ecc

    SHA512

    522037c7aa50cbf122d1e11e1b0284afe7b7f77dc6f1fafd89d803816e8ab92a98b8f9a14c2cca45bcc475405f4b6c89ba9da3973572982a903d38fd6bfff2cd

  • \Program Files\Polyphone\Qt5Widgets.dll

    Filesize

    8.3MB

    MD5

    f4cf06dedf04a732be32acd1291cf032

    SHA1

    8b9f8b822722537cf3043bc0e3a0069c33c1c66b

    SHA256

    f1cdc4e0717d054a654373c52d98b8730d4dfd48eac0e5d9f518d9cede45fcdd

    SHA512

    e0dd90285afafeef96776c268672283604c61502f7ca7d165b054654e6ca960f0e9087f56693fad48d4d18c78b44fe7e5f05988739e789a1712440c3a742dc3a

  • \Program Files\Polyphone\libFLAC-8.dll

    Filesize

    276KB

    MD5

    edc1192cab434e4318a2ed824d00d000

    SHA1

    6fc7638e6b009be85f862b0cbd67e03b62ec498b

    SHA256

    5b2273b1576004b1830d814f90b630197402c21e52ac70d8a6a87f76b3a7df11

    SHA512

    1bd3e2216b133cbc8470c09ba0e3589ad8abf73f896363cc1927d4c38f5ca4611d835dfee12e3e38231c38beffa00f18b9e1de4ec787bfcfbfba9f004db7ce06

  • \Program Files\Polyphone\libcrypto-1_1-x64.dll

    Filesize

    2.7MB

    MD5

    337c64c63885fcba37203f28ab818d2b

    SHA1

    fbb082bd35c9c7737437eb3713b3bd75f3af286b

    SHA256

    c26f0a66c31b74628365936a31134f62df253441d88a888d4bb0fba9d0412893

    SHA512

    dc33e20bc083818bf11398c5f6fbdf53d4cd295fa6dd148a27f6ea422a129ecba9f62085c3d439f161a5d3aa39c337eb3998f17c2d70eb6df264525434b4a20b

  • \Program Files\Polyphone\libcrypto-1_1-x64.dll

    Filesize

    2.7MB

    MD5

    337c64c63885fcba37203f28ab818d2b

    SHA1

    fbb082bd35c9c7737437eb3713b3bd75f3af286b

    SHA256

    c26f0a66c31b74628365936a31134f62df253441d88a888d4bb0fba9d0412893

    SHA512

    dc33e20bc083818bf11398c5f6fbdf53d4cd295fa6dd148a27f6ea422a129ecba9f62085c3d439f161a5d3aa39c337eb3998f17c2d70eb6df264525434b4a20b

  • \Program Files\Polyphone\libgcc_s_seh-1.dll

    Filesize

    74KB

    MD5

    534b365361004828059600f05b34006d

    SHA1

    d8ff411b0939a021f47c845c6a90f1240bab5268

    SHA256

    438ae82ffd621a2413199155574cc85681f8986f05420b1485aa4be936c3bc0b

    SHA512

    1ccb3732a82f2fedca85c27afdd48e65dde70d5b1620e436d457624a2cb796887c5e7dc2983a0794ebbbcade3e5b9f9fc9320b390894471993c7b1e85268592d

  • \Program Files\Polyphone\libogg-0.dll

    Filesize

    40KB

    MD5

    a2041cccfb5d46896e0f0e7bb8cf7346

    SHA1

    fdfa8fa410e11e533bde8abe6df7500e725d333d

    SHA256

    98abbc0beec191b1bff354422668533faabd1c5e5744b34282128e61c0d0de0a

    SHA512

    5395d4dd0dcb5267f07353eea2fa50c352df979b5ba8c1a48ebde80f448750165d5694778df36d45029f31a33b66308774998535525be04c21e1823001190fb5

  • \Program Files\Polyphone\libportaudio.dll

    Filesize

    341KB

    MD5

    c6fa91e19fcff596e4cbc61c7471ac47

    SHA1

    a835d0c7989a346bf479274e2752a5e06bc493b1

    SHA256

    2ef9d21b27b69c4b29007b1136bae9a56ea83118b27ed62018d7cc757f8fc0dd

    SHA512

    d28b8f158a70e77ecd65ef0b62c654e3a435511485ffe6d5960cfa5783af957b0771c15fcfd9dc48655ff6efc3430f8440c89da7d4fc925bae0b863611bb9b6f

  • \Program Files\Polyphone\libssl-1_1-x64.dll

    Filesize

    567KB

    MD5

    5dbc158952378d9b7a6a09aa8725c30a

    SHA1

    557c9d9001b7a8d8f1820c1d4c16c723515dfea8

    SHA256

    7e8131b5876d9e6e63556d4c84410b1e884f035499a6bfda9a018ddda85779f6

    SHA512

    73c1eb5702004877e872f03758bf3723a7fe8f381a3b2c6c1de99178f3e67297ded8deacecfb6aea7c462b35d63684bab54656e190627422a38f775323096afb

  • \Program Files\Polyphone\libssp-0.dll

    Filesize

    21KB

    MD5

    926d4d9a58925bdc4ed6abd1168a80cd

    SHA1

    9e06b46cb131ab0bf2672a3c8c8e38c5d85444dc

    SHA256

    4c233a98bd8afe06580b1a5931010ec857f97b35f4a49e01bf868654ed64d55d

    SHA512

    ff12a5d631399edb892b2dd1e1cffc288f58e80ef379db4c55bb1089cdf257d0d022728bde23f2e739c76d0d3ebf6ffff339dba7f5e1f1384a6487be50c04ce6

  • \Program Files\Polyphone\libstdc++-6.dll

    Filesize

    1.4MB

    MD5

    58f1c3e85a3714b9f5441c9b513e08bb

    SHA1

    4e30e2bd5917754cf2d4f8bd30b28f7ef9505a23

    SHA256

    72ce15df7c50e8d0ca57701b0b37394942e5348654505fcb993873b515dfd1d0

    SHA512

    7b52fcd6b0b76ef192c107a7a2e0a2144eda045988b46939c5a7eff87477b4cdc5c38557a0f467b6e27fc9fb55b2b679bd00c4fc36dfa015cf471cc7f0232836

  • \Program Files\Polyphone\libvorbis-0.dll

    Filesize

    176KB

    MD5

    cc8d416f847fbdbb317a09e6592d0d5b

    SHA1

    a9a35c7ecbc3882b39bb5ec8b28473309f32dc0a

    SHA256

    3d91c201ec3e902b4ccf47568ae294b044e4a8fa00a9f385d5113865a0df3d9e

    SHA512

    eec05d72f4390734515713e0bf8ff29daaf9c0f3695b13a01414397d0aa7e6f6e7933078396446c3be05b051877a638c926630ded310f8ac868dcd482b242180

  • \Program Files\Polyphone\libvorbisenc-2.dll

    Filesize

    564KB

    MD5

    7dc183a321914e42725d312586d7baf6

    SHA1

    9adb2424770a3db565941f9dbedf245b51534961

    SHA256

    f9b04ef131e273d8a692759a123660bf33fc4a619e36cc5363ee74323e0e9fe0

    SHA512

    238c6cebec252825b4bc9e5e38e101e241b6cfdb15644d7f100ce7c80b6bfe93a6cf260ff1db1c0b8f731a1d0a00e14bf0ee488917c8bd981f0f25d00a4c63dc

  • \Program Files\Polyphone\libvorbisfile-3.dll

    Filesize

    37KB

    MD5

    85c5af40b9b9160a55519122e9a21fef

    SHA1

    ff699e277cc3fefc4fad5c2df81588b0ce078fa0

    SHA256

    e1f199bb28367dec91d895cfd8aec1b52d2c0188cd6c2c402b39e49f83667588

    SHA512

    ce9f46b6476b99ef160ec37454d8318391a5fbb52b41909034a736cba8bd8666197893585c4abdc9d677bb1385c33bc1a7a666a7474d30f41379f15851ad6a16

  • \Program Files\Polyphone\libwinpthread-1.dll

    Filesize

    51KB

    MD5

    db18b7ec5f93127e6099744ea9568c1b

    SHA1

    e9143c76e308a816837e2f1a19dd0c5e2306ed08

    SHA256

    5bbef249a0d00e2d32c699d0bbe89f714ebeb872b3990a5cbeccb1d89f63e5e8

    SHA512

    ee1e645bed0bc3ad9e959d6342153e608ad21a7f5aef60b4cd8cc96fde7aeec4bbbb7474b59cab8ced8f28dc9f66cab32f4825333c891524901dcc40e70a1580

  • \Program Files\Polyphone\platforms\qwindows.dll

    Filesize

    2.8MB

    MD5

    7c0f42ae64400b354ce7ea9bcaba32c5

    SHA1

    d7615621225849c3d6f7e37c10e492ca8820f27a

    SHA256

    5420275c89725866b70bd24b7b556222ff7ea47fd1effdecef0d0a1c20405c43

    SHA512

    c29d84e2685128e746808243d090497b6326196c32bd4385fabeee66e971989a1ecd57e87a01d5e222aba6edd0c27165212fb5aeee9029fb32e758cbb3726ea4

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\polyphone.exe

    Filesize

    6.0MB

    MD5

    99a5a2f9346454c6f51f82dbe6b72f15

    SHA1

    90f72d4d94863596e62e35cadff28c4ce983cbf4

    SHA256

    aeb89653961b3296f887f8e294efa44f4b487c2ea735948b1511208912192799

    SHA512

    b3a9f5fb3c6875b9aedb2f6c559dccbb021beee5cb4b64eca20292f35ede00effebbbc354df96829b44af8a7a6a59f608b29c9448d3b82beecbc27ec4f9a5367

  • \Program Files\Polyphone\styles\qwindowsvistastyle.dll

    Filesize

    307KB

    MD5

    feb4726f427184278dc3f5cf001429df

    SHA1

    d0a94a60a0c2b0c9db468aa491930b207a62f5b8

    SHA256

    1622ebfa4b5430ced830fd447b20e1618059507b642babb4aa55f02550eafae2

    SHA512

    11f56bb75830ec1fc2dad42103a25aebe29dc61fdc137e17e6e81147b2feb7556278fa1146ffa987ece669261576dc1a78bec26edb9202172168cfbccccc50e2

  • \Program Files\Polyphone\zlib1.dll

    Filesize

    113KB

    MD5

    75365924730b0b2c1a6ee9028ef07685

    SHA1

    a10687c37deb2ce5422140b541a64ac15534250f

    SHA256

    945e7f5d09938b7769a4e68f4ef01406e5af9f40db952cba05ddb3431dd1911b

    SHA512

    c1e31c18903e657203ae847c9af601b1eb38efa95cb5fa7c1b75f84a2cba9023d08f1315c9bb2d59b53256dfdb3bac89930252138475491b21749471adc129a1

  • \Users\Admin\AppData\Local\Temp\is-97QDN.tmp\_isetup\_isdecmp.dll

    Filesize

    28KB

    MD5

    077cb4461a2767383b317eb0c50f5f13

    SHA1

    584e64f1d162398b7f377ce55a6b5740379c4282

    SHA256

    8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

    SHA512

    b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

  • \Users\Admin\AppData\Local\Temp\is-CP6TL.tmp\Polyphone_v2.3.1_win64.tmp

    Filesize

    3.1MB

    MD5

    3ce0dad2255fee7b5af0846081573469

    SHA1

    56d70e57410d6a1138151ac52380e645fd1e7f99

    SHA256

    059f07f874cb45348122afe61948fd3d447b7bdeb23551437eea0b994090c6e2

    SHA512

    f9c3b358dbc1f41fe247f8dd16377740c3c1d274a250fdfc74f62bcf44e8b8a27d5481939bb3ffc89017feaae1f16d02304f5839a4e814c61df2dfa06b9254c8

  • memory/1316-213-0x0000000002A30000-0x0000000002A3A000-memory.dmp

    Filesize

    40KB

  • memory/1316-194-0x0000000064940000-0x0000000064955000-memory.dmp

    Filesize

    84KB

  • memory/1316-175-0x000000006DF40000-0x000000006DF9C000-memory.dmp

    Filesize

    368KB

  • memory/1316-261-0x0000000002A30000-0x0000000002A3A000-memory.dmp

    Filesize

    40KB

  • memory/1316-181-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/1316-260-0x0000000002A30000-0x0000000002A3A000-memory.dmp

    Filesize

    40KB

  • memory/1316-239-0x0000000068880000-0x0000000068EB9000-memory.dmp

    Filesize

    6.2MB

  • memory/1316-243-0x0000000061940000-0x0000000062012000-memory.dmp

    Filesize

    6.8MB

  • memory/1316-240-0x0000000061440000-0x000000006145A000-memory.dmp

    Filesize

    104KB

  • memory/1316-241-0x0000000064940000-0x0000000064955000-memory.dmp

    Filesize

    84KB

  • memory/1316-237-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/1316-191-0x0000000000400000-0x0000000000A18000-memory.dmp

    Filesize

    6.1MB

  • memory/1316-204-0x000007FEF71B0000-0x000007FEF71C3000-memory.dmp

    Filesize

    76KB

  • memory/1316-193-0x0000000061440000-0x000000006145A000-memory.dmp

    Filesize

    104KB

  • memory/1316-195-0x000000006FC40000-0x000000006FDA3000-memory.dmp

    Filesize

    1.4MB

  • memory/1316-196-0x0000000061940000-0x0000000062012000-memory.dmp

    Filesize

    6.8MB

  • memory/1316-197-0x0000000069700000-0x00000000698B2000-memory.dmp

    Filesize

    1.7MB

  • memory/1316-198-0x000000006DF40000-0x000000006DF9C000-memory.dmp

    Filesize

    368KB

  • memory/1316-199-0x0000000000A20000-0x0000000000FA5000-memory.dmp

    Filesize

    5.5MB

  • memory/1316-201-0x000007FEF5750000-0x000007FEF5A06000-memory.dmp

    Filesize

    2.7MB

  • memory/1316-202-0x000007FEF5700000-0x000007FEF574B000-memory.dmp

    Filesize

    300KB

  • memory/1316-203-0x0000000000020000-0x000000000002E000-memory.dmp

    Filesize

    56KB

  • memory/1316-174-0x0000000061940000-0x0000000062012000-memory.dmp

    Filesize

    6.8MB

  • memory/1316-205-0x000000006F7C0000-0x000000006F81E000-memory.dmp

    Filesize

    376KB

  • memory/1316-200-0x0000000067740000-0x0000000067795000-memory.dmp

    Filesize

    340KB

  • memory/1316-208-0x000007FEF6830000-0x000007FEF6841000-memory.dmp

    Filesize

    68KB

  • memory/1316-206-0x000007FEF56C0000-0x000007FEF56F3000-memory.dmp

    Filesize

    204KB

  • memory/1316-209-0x000007FEF55F0000-0x000007FEF5614000-memory.dmp

    Filesize

    144KB

  • memory/1316-210-0x000000006A880000-0x000000006AA45000-memory.dmp

    Filesize

    1.8MB

  • memory/1316-211-0x000000006CC40000-0x000000006CC75000-memory.dmp

    Filesize

    212KB

  • memory/1316-212-0x000007FEF6460000-0x000007FEF64F1000-memory.dmp

    Filesize

    580KB

  • memory/1316-207-0x000007FEF5620000-0x000007FEF56B5000-memory.dmp

    Filesize

    596KB

  • memory/1316-192-0x0000000068880000-0x0000000068EB9000-memory.dmp

    Filesize

    6.2MB

  • memory/1316-234-0x000000006A880000-0x000000006AA45000-memory.dmp

    Filesize

    1.8MB

  • memory/1316-214-0x0000000002A30000-0x0000000002A3A000-memory.dmp

    Filesize

    40KB

  • memory/1316-216-0x0000000068880000-0x0000000068EB9000-memory.dmp

    Filesize

    6.2MB

  • memory/1316-221-0x0000000069700000-0x00000000698B2000-memory.dmp

    Filesize

    1.7MB

  • memory/1316-223-0x0000000000A20000-0x0000000000FA5000-memory.dmp

    Filesize

    5.5MB

  • memory/1316-220-0x0000000061940000-0x0000000062012000-memory.dmp

    Filesize

    6.8MB

  • memory/1332-54-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/1332-66-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/1332-185-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/2040-61-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2040-132-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2040-123-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2040-67-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

  • memory/2040-184-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB