7590dc4238bbea73ddaea1695caee009fec69c87fac142d81d2fbb688d9a878a

Analysis

max time kernel
52s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_songs_of_syx_0.64.65_(64bit)_(70667).exe
Size

331.2MB
MD5

cf2a173822952fa9dec0496cbb5f989a
SHA1

6239e2617dd0c59acadeb416babffd2b07dd1860
SHA256

7590dc4238bbea73ddaea1695caee009fec69c87fac142d81d2fbb688d9a878a
SHA512

6a58d67057a9a4a6f167ac39ccc2bce10f6d44a425fa1718ae6aebe4d6ff4e5db6e80a85e5ca507938418892cac778181fb05e12bc6b898f42529aa53328f370
SSDEEP

6291456:JgeGeQs+MYA2/dH0p4r+iraf1/woqqGqUro4f1IPnwM0Nz2F08/3+R467kPKK5lX:6eG++9f1H0p4rze+zqGqUro+I4lV2Fb9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
1784	scriptInterpreter.exe
2360	scriptInterpreter.tmp
2996	SongsOfSyx.exe
888	javaw.exe
2856	java.exe
2132	java.exe
484	SongsofSyx.exe
268	javaw.exe
1176	java.exe
812	java.exe

Loads dropped DLL 64 IoCs

pid	Process
2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
1784	scriptInterpreter.exe
2360	scriptInterpreter.tmp
2360	scriptInterpreter.tmp
2360	scriptInterpreter.tmp
2360	scriptInterpreter.tmp
2360	scriptInterpreter.tmp
2360	scriptInterpreter.tmp
2360	scriptInterpreter.tmp
2360	scriptInterpreter.tmp
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2996	SongsOfSyx.exe
2996	SongsOfSyx.exe
2996	SongsOfSyx.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
888	javaw.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe
2856	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2432	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
2360	scriptInterpreter.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	java.exe
2132	java.exe
2132	java.exe
1176	java.exe
812	java.exe
812	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2584	2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	30
PID 2596 wrote to memory of 2584	2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	30
PID 2596 wrote to memory of 2584	2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	30
PID 2596 wrote to memory of 2584	2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	30
PID 2596 wrote to memory of 2584	2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	30
PID 2596 wrote to memory of 2584	2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	30
PID 2596 wrote to memory of 2584	2596	setup_songs_of_syx_0.64.65_(64bit)_(70667).exe	30
PID 2584 wrote to memory of 1784	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	31
PID 2584 wrote to memory of 1784	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	31
PID 2584 wrote to memory of 1784	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	31
PID 2584 wrote to memory of 1784	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	31
PID 1784 wrote to memory of 2360	1784	scriptInterpreter.exe	32
PID 1784 wrote to memory of 2360	1784	scriptInterpreter.exe	32
PID 1784 wrote to memory of 2360	1784	scriptInterpreter.exe	32
PID 1784 wrote to memory of 2360	1784	scriptInterpreter.exe	32
PID 1784 wrote to memory of 2360	1784	scriptInterpreter.exe	32
PID 1784 wrote to memory of 2360	1784	scriptInterpreter.exe	32
PID 1784 wrote to memory of 2360	1784	scriptInterpreter.exe	32
PID 2584 wrote to memory of 2996	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	34
PID 2584 wrote to memory of 2996	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	34
PID 2584 wrote to memory of 2996	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	34
PID 2584 wrote to memory of 2996	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	34
PID 2584 wrote to memory of 2996	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	34
PID 2584 wrote to memory of 2996	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	34
PID 2584 wrote to memory of 2996	2584	setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp	34
PID 2996 wrote to memory of 888	2996	SongsOfSyx.exe	35
PID 2996 wrote to memory of 888	2996	SongsOfSyx.exe	35
PID 2996 wrote to memory of 888	2996	SongsOfSyx.exe	35
PID 2996 wrote to memory of 888	2996	SongsOfSyx.exe	35
PID 2996 wrote to memory of 888	2996	SongsOfSyx.exe	35
PID 2996 wrote to memory of 888	2996	SongsOfSyx.exe	35
PID 2996 wrote to memory of 888	2996	SongsOfSyx.exe	35
PID 888 wrote to memory of 2432	888	javaw.exe	36
PID 888 wrote to memory of 2432	888	javaw.exe	36
PID 888 wrote to memory of 2432	888	javaw.exe	36
PID 888 wrote to memory of 2432	888	javaw.exe	36
PID 888 wrote to memory of 2432	888	javaw.exe	36
PID 888 wrote to memory of 2856	888	javaw.exe	37
PID 888 wrote to memory of 2856	888	javaw.exe	37
PID 888 wrote to memory of 2856	888	javaw.exe	37
PID 888 wrote to memory of 2856	888	javaw.exe	37
PID 888 wrote to memory of 2856	888	javaw.exe	37
PID 2856 wrote to memory of 2132	2856	java.exe	40
PID 2856 wrote to memory of 2132	2856	java.exe	40
PID 2856 wrote to memory of 2132	2856	java.exe	40
PID 2856 wrote to memory of 2132	2856	java.exe	40
PID 2856 wrote to memory of 2132	2856	java.exe	40
PID 484 wrote to memory of 268	484	SongsofSyx.exe	43
PID 484 wrote to memory of 268	484	SongsofSyx.exe	43
PID 484 wrote to memory of 268	484	SongsofSyx.exe	43
PID 484 wrote to memory of 268	484	SongsofSyx.exe	43
PID 484 wrote to memory of 268	484	SongsofSyx.exe	43
PID 484 wrote to memory of 268	484	SongsofSyx.exe	43
PID 484 wrote to memory of 268	484	SongsofSyx.exe	43
PID 268 wrote to memory of 1176	268	javaw.exe	44
PID 268 wrote to memory of 1176	268	javaw.exe	44
PID 268 wrote to memory of 1176	268	javaw.exe	44
PID 268 wrote to memory of 1176	268	javaw.exe	44
PID 268 wrote to memory of 1176	268	javaw.exe	44
PID 1176 wrote to memory of 812	1176	java.exe	46
PID 1176 wrote to memory of 812	1176	java.exe	46
PID 1176 wrote to memory of 812	1176	java.exe	46
PID 1176 wrote to memory of 812	1176	java.exe	46
PID 1176 wrote to memory of 812	1176	java.exe	46

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\setup_songs_of_syx_0.64.65_(64bit)_(70667).exe
"C:\Users\Admin\AppData\Local\Temp\setup_songs_of_syx_0.64.65_(64bit)_(70667).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\is-HPD3G.tmp\setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HPD3G.tmp\setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp" /SL5="$20192,346730687,192512,C:\Users\Admin\AppData\Local\Temp\setup_songs_of_syx_0.64.65_(64bit)_(70667).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\GOG Games\Songs of Syx\__redist\ISI\scriptInterpreter.exe
    "C:\GOG Games\Songs of Syx\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Songs of Syx\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Songs of Syx" /productId="2000476666" /buildId="57244184556147634" /versionName="0.64.65" /Language="English" /LANG="english"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\is-0H01O.tmp\scriptInterpreter.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0H01O.tmp\scriptInterpreter.tmp" /SL5="$601F8,662929,192512,C:\GOG Games\Songs of Syx\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Songs of Syx\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Songs of Syx" /productId="2000476666" /buildId="57244184556147634" /versionName="0.64.65" /Language="English" /LANG="english"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2360
- - C:\GOG Games\Songs of Syx\SongsOfSyx.exe
    "C:\GOG Games\Songs of Syx\SongsOfSyx.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\GOG Games\Songs of Syx\jre\bin\javaw.exe
      "C:\GOG Games\Songs of Syx\jre\bin\javaw.exe" -Xms512m -Xmx1024m -XX:+UseCompressedOops -jar "C:\GOG Games\Songs of Syx\SongsOfSyx.jar" launcher
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:888
    - - C:\Windows\system32\icacls.exe
        
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        5⤵
        Modifies file permissions
        
        PID:2432
    - - C:\GOG Games\Songs of Syx\jre\bin\java.exe
        
        "C:\GOG Games\Songs of Syx\jre\bin\java" -cp "C:\GOG Games\Songs of Syx\SongsOfSyx.jar" launcher.Launcher
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2856
      - C:\GOG Games\Songs of Syx\jre\bin\java.exe
        
        "C:\GOG Games\Songs of Syx\jre\bin\java" -cp "C:\GOG Games\Songs of Syx\SongsOfSyx.jar" init.error.ErrorMessage "Songs of syx" [email protected] 1 "The game failed setting up openGl on your graphics card. This is likeley because your graphics card has no opengl 3.3 support. Some PC's have multiple graphics cards. In this case, try configuring the app to use the other.graphics card in graphic card's control panel. (You may need to do this for java as well.) Current graphics card: null If your graphics card does not support opengl 3.3 or higher, please do not report this error." C:\Users\Admin\AppData\Roaming\songsofsyx\logs\error04-30-2024-13-48-35-734.txt none "0.65.64 snake2d.Errors$GameError: The game failed setting up openGl on your graphics card. This is likeley because your graphics card has no opengl 3.3 support. Some PC's have multiple graphics cards. In this case, try configuring the app to use the other.graphics card in graphic card's control panel. (You may need to do this for java as well.) Current graphics card: null If your graphics card does not support opengl 3.3 or higher, please do not report this error. snake2d.GraphicContext$Error:307"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132

C:\GOG Games\Songs of Syx\SongsofSyx.exe
"C:\GOG Games\Songs of Syx\SongsofSyx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484
- C:\GOG Games\Songs of Syx\jre\bin\javaw.exe
  "C:\GOG Games\Songs of Syx\jre\bin\javaw.exe" -Xms512m -Xmx1024m -XX:+UseCompressedOops -jar "C:\GOG Games\Songs of Syx\SongsOfSyx.jar" launcher
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\GOG Games\Songs of Syx\jre\bin\java.exe
    "C:\GOG Games\Songs of Syx\jre\bin\java" -cp "C:\GOG Games\Songs of Syx\SongsOfSyx.jar" launcher.Launcher
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\GOG Games\Songs of Syx\jre\bin\java.exe
      "C:\GOG Games\Songs of Syx\jre\bin\java" -cp "C:\GOG Games\Songs of Syx\SongsOfSyx.jar" init.error.ErrorMessage "Songs of syx" [email protected] 1 "The game failed setting up openGl on your graphics card. This is likeley because your graphics card has no opengl 3.3 support. Some PC's have multiple graphics cards. In this case, try configuring the app to use the other.graphics card in graphic card's control panel. (You may need to do this for java as well.) Current graphics card: null If your graphics card does not support opengl 3.3 or higher, please do not report this error." C:\Users\Admin\AppData\Roaming\songsofsyx\logs\error04-30-2024-13-48-46-123.txt none "0.65.64 snake2d.Errors$GameError: The game failed setting up openGl on your graphics card. This is likeley because your graphics card has no opengl 3.3 support. Some PC's have multiple graphics cards. In this case, try configuring the app to use the other.graphics card in graphic card's control panel. (You may need to do this for java as well.) Current graphics card: null If your graphics card does not support opengl 3.3 or higher, please do not report this error. snake2d.GraphicContext$Error:307"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GOG Games\Songs of Syx\SongsOfSyx.jar

Filesize
33.4MB

MD5
000707a68d953503790c9db61967d27f

SHA1
fdcbd054c0d5d74a4c6f2a54db59036558ba4b2d

SHA256
60ee660ca29ee23e5e32bebbc4993914dd20d2616c53cc75e4e1be2004e42874

SHA512
4c6c910242877a53cb1b6d54e2b570223397e36620cd221f2ab2fac08b9fb4f2147c8faf83a57a5b256196c34bfb590c04841de845cd5bb686441645fd3ef1bd

Download Submit
C:\GOG Games\Songs of Syx\__redist\ISI\scriptinterpreter.exe

Filesize
1.2MB

MD5
c8aaca5f97815ab662436e5449aed17e

SHA1
4e47cbf558a813d102aee87284c404a02274eb0a

SHA256
d8667e94d5a9fe2d81e04df7e38f792bcf37aa727c24787014a51bd77fb19c65

SHA512
50e16042834a7ee6bd30b471142d17e526419b325c45b1f945323a01d773833a7011d9a820594515114043c06b6cfbebd7948778a6f6f6883b44680c13535f97

Download Submit
C:\GOG Games\Songs of Syx\goggame-2000476666.info

Filesize
596B

MD5
262ec0f3de269fe61553810daff34c98

SHA1
e6380b4ea60cddce20ced5b222684e0b49d20628

SHA256
b78687fce98da6aa46b4901466bb05e481fd98c903ee7b401fcc9e45b473c6b4

SHA512
7dbf4dd2c8eb22c0a1732ed458ae6b0edfa9abf3b61009276eeb52ac2c54fdd8358ee1d95dc7b55f9719a0ed93e44efd3cd6efc145adb258113db75882458e25

Download Submit
C:\GOG Games\Songs of Syx\goggame-galaxyFileList.ini

Filesize
84B

MD5
dba668d46f2d9b7584e952d26c131c1a

SHA1
6540fc1fd45ffd66f570479af9891d4459730644

SHA256
5dcb5507cfae5ca0dae2592cc417b9506264b086fb0997489e0b5c17e53e401b

SHA512
c41397bdd2d072118c626f19b7b175b559e8bc8ae3c75aa305b6b39a7174a5ab81bc4b35036ae62a07acdd12ed45fea63d952e428e7769d3bc697bf4aec83218

Download Submit
C:\GOG Games\Songs of Syx\jre\bin\java.dll

Filesize
163KB

MD5
3cc93cc2e870fff4a1d957a0e621c2e1

SHA1
10b2d12bc7c029beba5a1e4a1114be855e882c7f

SHA256
95e25cd432b064b4f0eb8ffa306eb973782427077aeb639fbe80cbdc839ce753

SHA512
2e7f4ba5e4366df83f6f1caf7746e7bad1e4b6353140167036fed73c7afed1453f87bc8622b7a9b6b05ffa299308700ad3f20c847e96b8202188ecbbfb9f79e3

Download Submit
C:\GOG Games\Songs of Syx\jre\bin\javaw.exe

Filesize
273KB

MD5
5d5fa010a61dc8496ff4e701b6d6d743

SHA1
8b1737ef8a566fb2b5b490c8fd6053ecc7419da2

SHA256
5719255fe30787d2a26390c16e0795698b219451787dbc466bc1bc00631bedae

SHA512
f1fe17e0324a637da498447299ab6d3cffbe02ca9a313a99a9060aff1e8dfa9fd4cadb531e4a4c668ec70001f7ec1820583f24587bc8d59ea0e336e8c39a5988

Download Submit
C:\GOG Games\Songs of Syx\jre\bin\msvcp140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\GOG Games\Songs of Syx\jre\bin\server\jvm.dll

Filesize
8.2MB

MD5
15df4b9267d77e8f7a344d9c2f17b6b8

SHA1
4a2db3a9764216d1283984258b4c8c6cbe094759

SHA256
b9b9fa49bcfc8db39899be818aa0ce66b28651939ca81967176a029eb8277704

SHA512
d2e17177395b7f531c720f4ff7cd60125fe17bb5b5a86cf930a8e5c3c39d1f9aba9d1a42e44d4691be9e9abb394c5ef6c8925f285dfa5923232c3c21ff8bcd5d

Download Submit
C:\GOG Games\Songs of Syx\jre\lib\amd64\jvm.cfg

Filesize
634B

MD5
499f2a4e0a25a41c1ff80df2d073e4fd

SHA1
e2469cbe07e92d817637be4e889ebb74c3c46253

SHA256
80847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb

SHA512
7828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d

Download Submit
C:\GOG Games\Songs of Syx\unins000.dat

Filesize
495KB

MD5
6060f9b1ca2dec39cff1719f583a07e3

SHA1
c0a240d1be32ef3bd6136a6a524b255ecd83e49b

SHA256
91c4164e56aad4f0d8b43c9af5a190a342828004e53418cfb6fb6f2543256aaa

SHA512
59d066214152b4e3e1a4889ca3c595fea91aecf659392cea76c6f6dd68d0db60f3b8be6bcccef6abe0e6165f65564c1831dedaad58b24a7d3933fc5f34352b0c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com\Songs of Syx\Songs of Syx.lnk

Filesize
1KB

MD5
4cf7b26c8fc2fe4c408898357013b412

SHA1
aef773333c7294e63a7429744e7d7fdc8099ead6

SHA256
0ef2e0dccda5e68f6ee1b08c1331399722560774cfb18d03184ad5e3409b86d5

SHA512
03efa17fba14f6f634bc812a1f20374c5afcd38db2a9db452a78277fd8d457decdba9e01603c16904d7b37105ad721b72eb59dedb130a255924aac28082019f9

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com\Songs of Syx\Uninstall Songs of Syx.lnk

Filesize
803B

MD5
b69775c3a17efd2acd8001a9479201a5

SHA1
1d680d255b6b7dcc273ee25eb2f35f5a7bd0176d

SHA256
4e667dc406cf83d0219663ee11ab90efe576666e485c73e664c333aaa7f8cecc

SHA512
c1a21d5d9f22343938ee3c137dd1b83ef6ff20ae3cd7ffbd54269caa3882acac8d99cef9b4b81fa64f806427481c20c9586a4fa5daae8a7216fb20733b363854

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\1447688349_english.jpg

Filesize
227KB

MD5
5c51377949dd79a4d23b0af2653a110c

SHA1
22e38dcdb27c68c43cdd7167b478f4c311c860c6

SHA256
ce802e86224ddc3c753bbf26fcf32c2e47a4085754036a0d79cc7a213b3ba3c2

SHA512
62476bafcf6bb40b80ef84dcb478f5a773b05f1fe51cb99f21940229ed2ca479a22e045a7e5cb643ea9e7a7921131f10d77a82157f9af19fe21e54c45971ddea

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\1449581489_english.jpg

Filesize
232KB

MD5
b84497f26c948992cc81f7f6163456a2

SHA1
7989c8be464bacde091f1f378b72c58f2a98448b

SHA256
438deb1778ea0b0205307959ac402767da060ec7f40284016d0e3be80f606118

SHA512
e98cf1327978465b4331a61eeadd4a3103c7922d65c776e97b7b4615a17ff2a345a6bf0c8cb8357c3a6d6aaa9fabd4f16f749aded776c29c16b77ef7181dd3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\45\23\45233c2206e9f8aabc9ba52f0d2755fd

Filesize
164B

MD5
45233c2206e9f8aabc9ba52f0d2755fd

SHA1
cf978c348b988f3837c1746c943d3e5993641975

SHA256
87e768813fcb090bc2de3d742a17e67bd6b4a8ac9bc1e084733bc6209f44180f

SHA512
3fbd9ea61661b9e6ce0c19600f8de760d9f15c4913b5bd33d3b59f27c386a26f837f5cbfaf263fc0b4d32e66c6dc85be5ca76528f37b38a3922022aaaaf320ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\55\c5\55c598a4695ddb6f109926d2d52cf0d2

Filesize
1KB

MD5
55c598a4695ddb6f109926d2d52cf0d2

SHA1
d77e7562bbe357d2e5b1b633ab152c21f1140aec

SHA256
91f10dfcc102c248cb5ec8c59ef4ec4a89f862a6134a72a5bff1d21c70fb63ab

SHA512
9f15be9cf8e6c6649b39c0c87d8cac6ea39ea8cc3e5675cf147bfd466f4cac625b9905429f4118b4c630ec7d71c7a24b8a454f61c4a209b1aaa7ddc350fa9651

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\55\e8\55e881a1c407079702e2c0a00e79cadd

Filesize
44KB

MD5
55e881a1c407079702e2c0a00e79cadd

SHA1
18530fed067fb484df4a3633bebfe687989b8cb0

SHA256
1845f336651c4b3380fad78fa4b6affc37a81cef6ac83bbd672cfdf3dc4c20c3

SHA512
bfe06564c6d05dee8b4c060aba62c2e0bb2007f7f60e4f9b34c34b1a080da4c8c9186d4ac006563866c0a84b2dc5d17f727534f95da9aacc852bfd42e8a8d92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\5c\a5\5ca53622f4ec874a9b43dc371bd0bab1

Filesize
193KB

MD5
5ca53622f4ec874a9b43dc371bd0bab1

SHA1
991bb887a61771b7e03f3dee040da05d6e8a4339

SHA256
5923e7ecff2fe18447a218a6229439d042b4d4d55c9b6f9c515fe1c40ff02869

SHA512
f43c419f76f36cfdb924767021f422ee86bcf0ed5d5ed67a141a8dd0a5df1f4bc92489d1bd9fa216b091fbd67a42f193edb82d98221d7f5b8ee534331c3fe321

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\BigOK.png

Filesize
3KB

MD5
5b43a5d975a53f4fc1da67ce9f7784c1

SHA1
8543fa1e471030049942252b23cb22e0880c3af5

SHA256
59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a

SHA512
5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\EULAAccepted.png

Filesize
2KB

MD5
461dfeb75927bdb39f9db5348612a611

SHA1
b7893b1fff6801e37ee7337d876962a09184941e

SHA256
0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c

SHA512
68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\EULAShow.png

Filesize
1KB

MD5
c596bc9111edc702bbbb29b70984254f

SHA1
d4712c7b91ff4f8994e7907d31357c42eb47c738

SHA256
6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462

SHA512
db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\GOG_new.png

Filesize
3KB

MD5
d5b63bdfa47ef5954917c148bacf7b13

SHA1
5302c6715d9e9b5d2768b130f3e516e175684cc9

SHA256
0804b385c1736e009fe8c3b1b14085b9b9abb40ce487360002ab4a8f3505f4e0

SHA512
b5cde681be9ad1c1211559dc4b363003bf547e8dc965dbb9560fdddfc28ee1d8f27cc534dd00864d800fd351c48694d7dc8df55fc3d8d69acf8b702c7b421aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\OpenSans-Regular.ttf

Filesize
212KB

MD5
629a55a7e793da068dc580d184cc0e31

SHA1
3564ed0b5363df5cf277c16e0c6bedc5a682217f

SHA256
e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee

SHA512
6c24c71bee7370939df8085fa70f1298cfa9be6d1b9567e2a12b9bb92872a45547cbabcf14a5d93a6d86cd77165eb262ba8530b988bf2c989fadb255c943df9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\background.jpg

Filesize
578KB

MD5
b5c05d0dc9b862f53f7984c7195371f1

SHA1
2a14c16abeead25503325f3d933ff2f4f751fb44

SHA256
380c35a236f5f54058102bd612c6a8563b2c456dc06d061866f8cc4959f41b36

SHA512
016c611a0425ffaf4f5b9473ab6f9080612ff05aebeeb21022d322d39550c8df9703a3e986c1fead489f0ac0840225639acb304c170d28343d8df90ea2c55c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\btn_md5.png

Filesize
8KB

MD5
3befe9739354ee24a0b1ea8df05ce274

SHA1
ab0bda986a8c46aa19f57b75a2b7b22445a3c625

SHA256
b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47

SHA512
ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\error.png

Filesize
726B

MD5
df10adc25b673e74e19971c17bee5a98

SHA1
ee16fb1cf9491f5e611282f0574b27d76fede412

SHA256
142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b

SHA512
dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\error_icon.png

Filesize
1KB

MD5
263720c4b8bb111567a2a49989b8f467

SHA1
cf346fa3c70164648e0eaf72a37c6f4920ab4792

SHA256
acdf96ee4261fae138e6350a0ad50b367022ed5b908fa168baad92644f566ee8

SHA512
94f06a81dc735cf264abde86e6169e5fd78d873d2e926fd48287d2ac5208fc930c3c432186e3510add002bd1b4ae32ad8d35270b17c3ce5f18c43764a8e9de43

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\ok.png

Filesize
1KB

MD5
103c1368e60806b1b7995a0894eacf87

SHA1
971392527f6e4b655044773132505c901a6b5469

SHA256
0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e

SHA512
652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\progress_center.png

Filesize
1KB

MD5
ad7fc1e37e40da38dd57adc446cc6c0e

SHA1
08033265deb9b45243cfa0065d98ffe13a039e26

SHA256
2b9dae87340e66b67ab1d8247d4a137628e324969f92fe1098f95a7c5bab2f43

SHA512
dd715d74f8e1ed6ab75b7b6530b383ac47040d8baa7728be160f6d230bf485a9cc54f15f7dc85b122ce56e54d63fa4890e510dfc89d9c9344e31f789ebac8756

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\progress_left.png

Filesize
1KB

MD5
290c7612ad7a077028cd3dc78ce99673

SHA1
18995fbe39d05e4a1cafc7cc2e0f6fb745442f77

SHA256
85e39d909a7300fa2043ec42818582867b981401264b14fc5408e477ae0b4668

SHA512
799841f5b8a1056e78a49c823009750e4b93af130a6c4ff9dc6d386c06b88614e53b46a6df62f5a217d5c99da01cf4e2fe8392c73d39e81000045291cf24205a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\progress_right.png

Filesize
1KB

MD5
c25a41f022a74308d944d1e807d72f44

SHA1
83c6bbec3fb373fcc78ce0e737742100994cd6d4

SHA256
396a3351fe409328782ab138282cf9cec061a5a9540a3506700a620db1f54e7d

SHA512
d2f4449195f3e60c826cfabb52a083d829eb9d0509272977d8fdb33bc5214678949cd27d0594684594e0a3eda2351c39cec8d91923cb716ad144ccf2b966c8e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\slideshow.ini

Filesize
278B

MD5
81762158073c1d9dbc4cb777cb7ef1e4

SHA1
800e424ae556f8697d87147703a4ec2ac28179fa

SHA256
40d7fdde0c7c5c420403d9f057f8a55928524ecfe36430dcb05223a42f4c7766

SHA512
34d649851157671bc57d09dcd36b4d2a5d64ee53c9f42c63170199c88149f24a152901e668b7ab3f26f381614eb788138e4c8096bf75c6faba2e70f91d7406de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\track_center.png

Filesize
1KB

MD5
3f2b0c22f8ea28dcbb82b39a16a039aa

SHA1
b3f4dfc2ea86fbdad05877b4c356b7fa8016731d

SHA256
794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860

SHA512
b4bf65d751717e85418947662d315ae3bcb177f60914832fefeeb95da9eddb75eb5531c62e5a5a70ff03c8a025b5a03e61ffbdecc9f483bea9684454ca9362d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\track_left.png

Filesize
1KB

MD5
55dacb00cbe2825a8540236c5777a205

SHA1
18a52ac6c741b558500fbc1716d46b4fe4471982

SHA256
a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8

SHA512
2ea444cc1080f20761c8d71d96fcd04ef48254cdc1dc41d1d139f459ea5613fe12f6e4bd026bf33a5c01ff038e72e05dae2f8fba33ff517dd395e1911f10ff10

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\track_right.png

Filesize
1KB

MD5
ddec70b6c49be3e8c3a7d01c2f6ff1c5

SHA1
5383271999f787c36b1dc8f3cc13c8407b195439

SHA256
f54cd6e42f2b2bc5cb8a15f6a28f1499abf094a519ebdf39f4c4e167312c9c16

SHA512
f43f94b194b5a7eafcec9e831f61042859c30e1af2e2447195bdd06b12c90982181161a1c1be5aa5223ff664f88e4891bd71cfffb7ef672d6fe4f614030e0e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3-snapshot\x64\glfw.dll

Filesize
484KB

MD5
8cabdbe3d67546771b02af5d42073cfe

SHA1
2e19147110b9872a52814956bab151a7aa80ce58

SHA256
affa7e54eb0dedce4a5721c327c1a16035edbbd039cd402e08107d6d2d55eb1a

SHA512
b7f46feef779e5772fc7711fda601fdda6ee4bf41d4fb87735a0b8fdc5fdbbdab23ba1760989e15d66cf9ba65409933cbce858eda169d04f13f401198245ad1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3-snapshot\x64\jemalloc.dll

Filesize
389KB

MD5
e58d41175587d4355fe06bf8b8a1ab32

SHA1
6403f8243ea983a225b3bcda6c821a0029ad9ee2

SHA256
9abf0095066ebab37b78968e11370a8078313e48cb5be8eda01f67623c6a6248

SHA512
fc432ddb67dce8a672ac268d25f01d40c1d614e4ef34cbac6c4a2c01742ebab5d00c7ef5d9f0ef46ce0b3b6a4d5ace581fcf8c247d492c3882f561015d9e2ae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.3.3-snapshot\x64\lwjgl.dll

Filesize
468KB

MD5
d8ea3886d9f59b514bfa5b24ab69c0ab

SHA1
2bf57942dff5360889f0e89c58d5acdc54e5f1ea

SHA256
a39adf52947fafd954c2a86ce031abb8c59825f7ee50337ac8c41e4280abe82d

SHA512
ba8af0415c7b0454dd8bdccf78ed59da3bb5cc5f631dd060d3cd0eaf74d8f55d7531248b6b8a995ba5b672dc0386d3fa198e8c761f2e1cc0304da0dc029bf29e

Download Submit
\GOG Games\Songs of Syx\SongsofSyx.exe

Filesize
136KB

MD5
5c48fda011b1c4c297e6f7445f33c386

SHA1
f29c94f27044e943ed852ec0804a501fce40f631

SHA256
ddde22da7965a20899f07af4ea539be80bddce262cd560866f12872dd3943ffb

SHA512
59788436ea00ee5d042a676a96e1daba8f461ea19cce743468e210d0cd08676a796195d1dafbe4a8c267e84e9897ac11e6f3d9d7ec2231ac0c143aab935999a7

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
35bc1f1c6fbccec7eb8819178ef67664

SHA1
bbcad0148ff008e984a75937aaddf1ef6fda5e0c

SHA256
7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7

SHA512
9ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
3bf4406de02aa148f460e5d709f4f67d

SHA1
89b28107c39bb216da00507ffd8adb7838d883f6

SHA256
349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e

SHA512
5ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
8acb83d102dabd9a5017a94239a2b0c6

SHA1
9b43a40a7b498e02f96107e1524fe2f4112d36ae

SHA256
059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413

SHA512
b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
9c9b50b204fcb84265810ef1f3c5d70a

SHA1
0913ab720bd692abcdb18a2609df6a7f85d96db3

SHA256
25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40

SHA512
ea2d22234e587ad9fa255d9f57907cc14327ead917fdede8b0a38516e7c7a08c4172349c8a7479ec55d1976a37e520628006f5c362f6a3ec76ec87978c4469cd

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
43e1ae2e432eb99aa4427bb68f8826bb

SHA1
eee1747b3ade5a9b985467512215caf7e0d4cb9b

SHA256
3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c

SHA512
40ec0482f668bde71aeb4520a0709d3e84f093062bfbd05285e2cc09b19b7492cb96cdd6056281c213ab0560f87bd485ee4d2aeefa0b285d2d005634c1f3af0b

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
285dcd72d73559678cfd3ed39f81ddad

SHA1
df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a

SHA256
6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44

SHA512
84ef0a843798fd6bd6246e1d40924be42550d3ef239dab6db4d423b142fa8f691c6f0603687901f1c52898554bf4f48d18d3aebd47de935560cde4906798c39a

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
212d58cefb2347bd694b214a27828c83

SHA1
f0e98e2d594054e8a836bd9c6f68c3fe5048f870

SHA256
8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989

SHA512
637c215ed3e781f824ae93a0e04a7b6c0a6b1694d489e9058203630dcfc0b8152f2eb452177ea9fd2872a8a1f29c539f85a2f2824cf50b1d7496fa3febe27dfe

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
883120f9c25633b6c688577d024efd12

SHA1
e4fa6254623a2b4cdea61712cdfa9c91aa905f18

SHA256
4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc

SHA512
f17d3b667cc8002f4b6e6b96b630913fa1cb4083d855db5b7269518f6ff6eebf835544fa3b737f4fc0eb46ccb368778c4ae8b11ebcf9274ce1e5a0ba331a0e2f

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
29680d7b1105171116a137450c8bb452

SHA1
492bb8c231aae9d5f5af565abb208a706fb2b130

SHA256
6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af

SHA512
87dcf131e21041b06ed84c3a510fe360048de46f1975155b4b12e4bbf120f2dd0cb74ccd2e8691a39eee0da7f82ad39bc65c81f530fc0572a726f0a6661524f5

Download Submit
\GOG Games\Songs of Syx\jre\bin\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
f816666e3fc087cd24828943cb15f260

SHA1
eae814c9c41e3d333f43890ed7dafa3575e4c50e

SHA256
45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a

SHA512
6860abe8ab5220efb88f68b80e6c6e95fe35b4029f46b59bc467e3850fe671bda1c7c1c7b035b287bdfed5daeac879ee481d35330b153ea7ef2532970f62c581

Download Submit
\GOG Games\Songs of Syx\jre\bin\ucrtbase.dll

Filesize
987KB

MD5
61eb0ad4c285b60732353a0cb5c9b2ab

SHA1
21a1bea01f6ca7e9828a522c696853706d0a457b

SHA256
10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd

SHA512
44cd871f48b5193abb3b9664dbea8cdad19e72c47b6967c685cf1cc803bc9abb48a8a93009c972ef4936e7f78e3c92110828790aa0a9d26b80e6a523bbcd830d

Download Submit
\GOG Games\Songs of Syx\jre\bin\vcruntime140.dll

Filesize
83KB

MD5
1453290db80241683288f33e6dd5e80e

SHA1
29fb9af50458df43ef40bfc8f0f516d0c0a106fd

SHA256
2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c

SHA512
4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91

Download Submit
\GOG Games\Songs of Syx\unins000.exe

Filesize
1.3MB

MD5
e699827821a40556f1b04f271d2dfe17

SHA1
e9a520f17cf12fde7704c5ec4fb6146b26640678

SHA256
8aa8171f3a93b44243d12a8aed3706a5a56e2e8aecaee04f5b546a5da1e7fe6d

SHA512
0d1ce5083637213caaba2784fabfee383a04a8664b2df3e5c70f847a928be690e45e398b3547f9b38843f55546ee30d1d3eb1fa1be51817929bb84b30dd6aded

Download Submit
\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\crcdll.dll

Filesize
69KB

MD5
1d51fac9e2384eeb674199cfd5281d7d

SHA1
861dfdc121357d605d0cc3793266713788109eb2

SHA256
23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec

SHA512
921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda

Download Submit
\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
\Users\Admin\AppData\Local\Temp\is-01H9V.tmp\uninstall.dll

Filesize
691KB

MD5
7db706c324cc9b6fda497d081eed6e26

SHA1
ca97392e573af0cf61bfa3301801a85f2beea44c

SHA256
cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

SHA512
8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

Download Submit
\Users\Admin\AppData\Local\Temp\is-0H01O.tmp\scriptInterpreter.tmp

Filesize
1.3MB

MD5
01190d8b6805fd4d2a68750fbd041966

SHA1
c5c967d47cc57112eec5fe7db0229b36e22ec661

SHA256
5761e7789d813626cd68ee1e62429cfeb92bdd814cd29ef12fc4ae9ec1dbaff3

SHA512
c079f1674f800bbcfe97d95e596314ba9f74bc7f87433dede4da91978c9ba9b1f0b22a4b690a07171983c46ac35e523a52df143072f700279914279de133957d

Download Submit
\Users\Admin\AppData\Local\Temp\is-HPD3G.tmp\setup_songs_of_syx_0.64.65_(64bit)_(70667).tmp

Filesize
1.3MB

MD5
ff5ebf66cddd9913b729de78eeb638c8

SHA1
ca23d5639d1c516e3defc8f5b267bb5c040238d5

SHA256
abf8d4d522ca94a179d644ec0464474b580ec82441b118b663da3bd879f91d85

SHA512
4fa3a2dc8ad68bfffc0e039171d2da71c3c37eade709d5495e825bb53f576180eafee57e3c1f78d7dcc8d26e26cc24e1e99bb494d9b4a55f74f4145eb6e5a05b

Download Submit
\Users\Admin\AppData\Local\Temp\is-JMJQ3.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
\Users\Admin\AppData\Local\Temp\is-JMJQ3.tmp\uninstall.dll

Filesize
712KB

MD5
f3a88277fc7e0c057c40e47a7e43f9ad

SHA1
78ae0052b323139a4de7a5361a40503a39339f4c

SHA256
d88bcf910e7a5ce4d76ca48b263ef226911b455d3a8db80c9fa69aeb2b3898a1

SHA512
3c40377600fbb814fe19423404d2fb29f6342ab2a3a6d5dc50f42086fc0f59174184a0870d7f04fb6ee5f84828e1ed282396bfcb70842084af25f5af15cc8a1f

Download Submit
memory/268-2135-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/484-2097-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/812-2176-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/812-2150-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/812-2145-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/812-2146-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/888-2044-0x0000000002210000-0x0000000002310000-memory.dmp

Filesize
1024KB

Download
memory/888-2031-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/888-2045-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/1176-2117-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1784-1823-0x0000000000AB0000-0x0000000000AE9000-memory.dmp

Filesize
228KB

Download
memory/1784-1876-0x0000000000AB0000-0x0000000000AE9000-memory.dmp

Filesize
228KB

Download
memory/2132-2086-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2132-2057-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/2132-2058-0x0000000000290000-0x000000000029A000-memory.dmp

Filesize
40KB

Download
memory/2132-2095-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2360-1875-0x0000000000010000-0x0000000000162000-memory.dmp

Filesize
1.3MB

Download
memory/2360-1839-0x0000000003C40000-0x0000000003CFB000-memory.dmp

Filesize
748KB

Download
memory/2584-138-0x00000000011A0000-0x0000000001257000-memory.dmp

Filesize
732KB

Download
memory/2584-1602-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Filesize
56KB

Download
memory/2584-139-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Filesize
56KB

Download
memory/2584-12-0x0000000000AF0000-0x0000000000B05000-memory.dmp

Filesize
84KB

Download
memory/2584-1600-0x0000000000AF0000-0x0000000000B05000-memory.dmp

Filesize
84KB

Download
memory/2584-1601-0x00000000011A0000-0x0000000001257000-memory.dmp

Filesize
732KB

Download
memory/2584-137-0x0000000000AF0000-0x0000000000B05000-memory.dmp

Filesize
84KB

Download
memory/2584-1884-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2584-1599-0x0000000001260000-0x00000000013B2000-memory.dmp

Filesize
1.3MB

Download
memory/2584-8-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/2584-2084-0x0000000001260000-0x00000000013B2000-memory.dmp

Filesize
1.3MB

Download
memory/2584-59-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Filesize
56KB

Download
memory/2584-16-0x00000000011A0000-0x0000000001257000-memory.dmp

Filesize
732KB

Download
memory/2584-136-0x0000000001260000-0x00000000013B2000-memory.dmp

Filesize
1.3MB

Download
memory/2596-2085-0x0000000000FA0000-0x0000000000FD9000-memory.dmp

Filesize
228KB

Download
memory/2596-0-0x0000000000FA0000-0x0000000000FD9000-memory.dmp

Filesize
228KB

Download
memory/2596-2-0x0000000000FA0000-0x0000000000FD9000-memory.dmp

Filesize
228KB

Download
memory/2596-135-0x0000000000FA0000-0x0000000000FD9000-memory.dmp

Filesize
228KB

Download
memory/2856-2035-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2856-1999-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2996-1921-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download