73f6ab6851f9459f2cf4a38676f001444fe15feca242feb20cedd299f6e75a92

Analysis

max time kernel
70s
max time network
71s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMediaRecode3596_x64_setup.exe
Size

24.2MB
MD5

981c3209d0fef5e92592b96b6d42b3e2
SHA1

34cdd8238ef653687ed5d3bfc9b7f59537b76cf3
SHA256

73f6ab6851f9459f2cf4a38676f001444fe15feca242feb20cedd299f6e75a92
SHA512

fc90b14fb9ef3bf06870be9759f0637b6ed54165ccd8929214e7d175f6571e76fa5c0caef9e12f33acdd2294205ec34509bfbd33d98a5eaf333fda1d3b81f51e
SSDEEP

393216:czcoRPvwaJAJ7fhngU4TL18Nrh0SoxKd9b/wmJT3ruExo7vwVItxTZQCLU3ygpoP:kPvq14mNsx09bwm1XWIVI3TZQCQigm

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

XMediaRecode3596_x64_setup.tmp

description	ioc	process
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-JLVG8.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-RIV5Q.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Format\is-11AL3.tmp	XMediaRecode3596_x64_setup.tmp
File opened for modification	C:\Program Files\XMedia Recode 64bit\libdvdread.dll	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Matrix\is-ISQSN.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-LN7RA.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-JS05M.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-A4DHA.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-P8ONG.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\is-0793T.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.d\is-DQ4S2.tmp	XMediaRecode3596_x64_setup.tmp
File opened for modification	C:\Program Files\XMedia Recode 64bit\aom.dll	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\unins000.dat	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\is-RFATC.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\is-J6BRK.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\is-OFHGF.tmp	XMediaRecode3596_x64_setup.tmp
File opened for modification	C:\Program Files\XMedia Recode 64bit\vo-amrwb.dll	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Matrix\is-9OMT6.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Matrix\is-5G1N3.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-9JB19.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.d\is-M6OUT.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-K5T0O.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-EM5EB.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-HKJ1P.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-DDCCE.tmp	XMediaRecode3596_x64_setup.tmp
File opened for modification	C:\Program Files\XMedia Recode 64bit\cdio_paranoia.dll	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Lang\is-9K8OM.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-U23CN.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-MK60R.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.d\is-VQSC7.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-EQDEK.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-714MB.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.avail\is-FCEGO.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.avail\is-5G6VT.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-GOOIQ.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.avail\is-MDT9T.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-NGJA6.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-GJ13R.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Format\is-QK4OP.tmp	XMediaRecode3596_x64_setup.tmp
File opened for modification	C:\Program Files\XMedia Recode 64bit\x265.dll	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Matrix\is-GR4NF.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-OBDDU.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-6GH6L.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Format\is-I05VH.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Lang\is-S8FOR.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Matrix\is-RKOOU.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-BBPA0.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-26IRK.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\is-CVQVC.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-KTFA9.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-769JV.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Format\is-RI8ET.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Matrix\is-0VIN0.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-L0JD8.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-MIGLL.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-M29IT.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.d\is-0IQP8.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\fonts\conf.d\is-6DU9G.tmp	XMediaRecode3596_x64_setup.tmp
File opened for modification	C:\Program Files\XMedia Recode 64bit\fdk-aac.dll	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-MROFT.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-CVSNB.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-2SPL2.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Profile\is-VCA23.tmp	XMediaRecode3596_x64_setup.tmp
File created	C:\Program Files\XMedia Recode 64bit\Format\is-PPCG9.tmp	XMediaRecode3596_x64_setup.tmp

Executes dropped EXE 3 IoCs

Processes:

XMediaRecode3596_x64_setup.tmpXMedia Recode.exe

pid process

2332 XMediaRecode3596_x64_setup.tmp
1240 XMedia Recode.exe
1120

pid	process
2332	XMediaRecode3596_x64_setup.tmp
1240	XMedia Recode.exe
1120

Loads dropped DLL 40 IoCs

Processes:

XMediaRecode3596_x64_setup.exeXMediaRecode3596_x64_setup.tmpXMedia Recode.exe

pid	process
992	XMediaRecode3596_x64_setup.exe
2332	XMediaRecode3596_x64_setup.tmp
2332	XMediaRecode3596_x64_setup.tmp
2332	XMediaRecode3596_x64_setup.tmp
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1240	XMedia Recode.exe
1120
1120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

XMedia Recode.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	XMedia Recode.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	XMedia Recode.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

XMediaRecode3596_x64_setup.tmp

pid process

2332 XMediaRecode3596_x64_setup.tmp
2332 XMediaRecode3596_x64_setup.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

XMediaRecode3596_x64_setup.tmp

pid process

2332 XMediaRecode3596_x64_setup.tmp
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

XMedia Recode.exe

pid process

1240 XMedia Recode.exe
1240 XMedia Recode.exe

pid	process
2332	XMediaRecode3596_x64_setup.tmp
2332	XMediaRecode3596_x64_setup.tmp

pid	process
2332	XMediaRecode3596_x64_setup.tmp

pid	process
1240	XMedia Recode.exe
1240	XMedia Recode.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

XMediaRecode3596_x64_setup.exeXMediaRecode3596_x64_setup.tmp

description	pid	process	target process
PID 992 wrote to memory of 2332	992	XMediaRecode3596_x64_setup.exe	XMediaRecode3596_x64_setup.tmp
PID 992 wrote to memory of 2332	992	XMediaRecode3596_x64_setup.exe	XMediaRecode3596_x64_setup.tmp
PID 992 wrote to memory of 2332	992	XMediaRecode3596_x64_setup.exe	XMediaRecode3596_x64_setup.tmp
PID 992 wrote to memory of 2332	992	XMediaRecode3596_x64_setup.exe	XMediaRecode3596_x64_setup.tmp
PID 992 wrote to memory of 2332	992	XMediaRecode3596_x64_setup.exe	XMediaRecode3596_x64_setup.tmp
PID 992 wrote to memory of 2332	992	XMediaRecode3596_x64_setup.exe	XMediaRecode3596_x64_setup.tmp
PID 992 wrote to memory of 2332	992	XMediaRecode3596_x64_setup.exe	XMediaRecode3596_x64_setup.tmp
PID 2332 wrote to memory of 1240	2332	XMediaRecode3596_x64_setup.tmp	XMedia Recode.exe
PID 2332 wrote to memory of 1240	2332	XMediaRecode3596_x64_setup.tmp	XMedia Recode.exe
PID 2332 wrote to memory of 1240	2332	XMediaRecode3596_x64_setup.tmp	XMedia Recode.exe
PID 2332 wrote to memory of 1240	2332	XMediaRecode3596_x64_setup.tmp	XMedia Recode.exe

C:\Users\Admin\AppData\Local\Temp\XMediaRecode3596_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\XMediaRecode3596_x64_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992

C:\Users\Admin\AppData\Local\Temp\is-BF2QA.tmp\XMediaRecode3596_x64_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BF2QA.tmp\XMediaRecode3596_x64_setup.tmp" /SL5="$400BE,24448422,832512,C:\Users\Admin\AppData\Local\Temp\XMediaRecode3596_x64_setup.exe"
2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2332

C:\Program Files\XMedia Recode 64bit\XMedia Recode.exe
"C:\Program Files\XMedia Recode 64bit\XMedia Recode.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\XMedia Recode 64bit\Profile\is-MTEIV.tmp
Filesize
969B

MD5
e24a6aebfaa0294873708afba52f3340

SHA1
1b2f12e76659eb184446f0af8d0819011b93cd89

SHA256
f946c4fe5d6138410c15229460e234f5faac78e153d5cd998d0ea347225fc0c7

SHA512
f894fb0ef333b676be5f5bc58ca20b7ce19a8d5cf87e7b019673323f4a12034dca58e6092fed2492dea75f79321e9a6de27061c9ba23ada73b5bd56c9bebf332

Download Submit
C:\Program Files\XMedia Recode 64bit\Profile\is-T3PHF.tmp
Filesize
1KB

MD5
712ee4bb9a99a186f097bf00d63346fb

SHA1
d137dfaf7ba2e585aed3330b154f171c42272b33

SHA256
534f5d537ed3753bbfb0d77bba0833575f73a71a76942c4b5f1cf57e73118832

SHA512
07a61c07fc298379d27d491b3aac745614d3528d20087ab282b160c26eb0feb4adb49fd6a37c325ffadd02caae0043a70e3627be8917e6cca64e51db3e4c98d1

Download Submit
C:\Program Files\XMedia Recode 64bit\SvtAv1Enc.dll
Filesize
10.9MB

MD5
464c600a5a7022ec990567000eeb9398

SHA1
e6c214ff6ba4236aff6caddfd0a50f3ee32a0ab4

SHA256
eb6e8674dac05510e57bc3c6c1f33985863e58ad853dc1eaa1bd449edd51e4a2

SHA512
93da3a95b8d0f9412cac22f05d803447ba9ea7a6487ad8a637e4add5a3f82cb10d1b7c2fd2ebea55f9dde11d488ac0aa50330d4fc2a62736679512d5366f9a20

Download Submit
C:\Program Files\XMedia Recode 64bit\fdk-aac.dll
Filesize
1.2MB

MD5
e1381c4c6b87fb90fa4463511b3f97d1

SHA1
2c7cb7835a365016ccd4318d7b5d9eee5bcd8b1a

SHA256
d57be13218e6ae25a288a2b0d33a6fd6a2a01cfc5f07d4bf9816c172a6b91fe3

SHA512
e8e6318d89e76eebc49f5041f66de52111abf1f7942a77c309462751f76dd3c6ea469a811c3f6ef77e6b19128ac288b3f2ba4a1fccc42f9dbed39a5a7b17afe1

Download Submit
C:\Program Files\XMedia Recode 64bit\freetype.dll
Filesize
672KB

MD5
ac9e6e472833bb00b042b4bf9bd122f0

SHA1
ecad8e61f15904c52fa3ed0fc0c28c4dd4138d15

SHA256
03e7ae06920f23aa6868d97441628efe51580ab879bcf058a3b5ff46e5ee8eda

SHA512
a4a5b9ee5e34cb241209516d5c77ff5c34dbf75a300f99a5e37c6a1adaa0fe78c9ec4692c3a4604cb38d944c7acdfd5ed4ea49402825da4f1e7f1a830ba925fe

Download Submit
C:\Program Files\XMedia Recode 64bit\libass.dll
Filesize
816KB

MD5
37351b17cb08b048af9c6c7587e160b6

SHA1
bb1e2720abaad8029dc40a00099da28915a69503

SHA256
cb1bf920d17532e93e26ec7d44bddd89e28542cf51e59276a4ae90364dda1fe0

SHA512
f4d5ba5ccf829e96cbafd376b46ea305449937cc12dd0b58a147c69cf5ddaa9737e19d1aa1e8ee27fcd2dd3a3120aaefd78b4a2988d6e60f708cd386666e33b6

Download Submit
C:\Program Files\XMedia Recode 64bit\libiconv.dll
Filesize
1.0MB

MD5
1fe4548e598d8dbc797886e9cbfbd626

SHA1
705788d774aa5273a39ee54299811fec3d02bc5a

SHA256
9f665eb0e32e5e8c03d47b974098f0b76482f395d0b65719330d96e4dbdbdad4

SHA512
ed076faa051115156213192575ef06b3403a163b43bb9d6495c9126e320337fd5a0096907a25fc64880e4b43bebab7481664a7b580d3faec4e3cc1ecd51c7f05

Download Submit
C:\Program Files\XMedia Recode 64bit\lzma.dll
Filesize
239KB

MD5
1a09050d184d12b341ac71a42d1dc242

SHA1
e2cb4423258ab2aa9f9a8b791b8292420aa08518

SHA256
b1013504ebe014b7c25d6b746578c5d166f981afb6d9e9263bb1ce311b3eea41

SHA512
dfa82afec3f212abe804dfea09597ee6de51270f3ae05ee777b3eec0da1af23c89b7d9b6c03d379a831747e9633d5c42cabbfa0949ebce52709149d9a9dc47d9

Download Submit
C:\Program Files\XMedia Recode 64bit\vpx.dll
Filesize
2.3MB

MD5
17837b44408ef6b87a78b98d7501d15f

SHA1
29fc73089bfeaa258274ecb6f2e8790d977a0bb1

SHA256
8f00022df18eee7ffcf6b35d5aad71776cd3fc81af39a42d5b69f6af0deef177

SHA512
6bf82a9f6e1da15f92ac91ae584e0e964a306aad485c8e62f6127b362e750bbe5c742ec4f1e24a5d115ae54e693ef82b476c5642fb2179b81d30f61406fc8456

Download Submit
C:\Program Files\XMedia Recode 64bit\x265.dll
Filesize
16.6MB

MD5
a3447ad3cf3bfee20604ed9f6d23ac1e

SHA1
82bef3e252d378073ac5c346445ec69791975285

SHA256
793513b71a66047e4fc62724b4dcca898a3bf47c085a99ccbf7b20a57ea8c426

SHA512
418ee8c29763bc62d1e59283ba156cc8f914558031a1329d9c3d3d8bd6d119d2f1ddc239d312ee4efb20ae56a8817e64bacbebcb0886f4749858c053f2ed5c42

Download Submit
C:\Program Files\XMedia Recode 64bit\zlib.dll
Filesize
82KB

MD5
9e3f4f776b9b3744ead1c1ebc5471644

SHA1
c6dd26691b9735ceb8db7ff32bc4fd17551eb973

SHA256
ce94deb9ea0796eb9d3e51697a4ec0b0d5b90c6b037ce4173aa09b5b02306d63

SHA512
5472ec53100d6ec8a7261fa099e5970149a257808a3438d69f04e9683a13ddc9ea11c72403b41a93381aa0ab858338ec7feab31253e525b5f94587e7692c18a7

Download Submit
\Program Files\XMedia Recode 64bit\OpenCL.dll
Filesize
27KB

MD5
da746581f32cbcef0a011f1b4d55123a

SHA1
5c89bf3537c6cb24c529b13297eba4d55ad9155b

SHA256
c7c2ea85d72de34153cff418762e7e958a20b8b78578750486583a70f9a1e998

SHA512
e245f7721cf8e62bacbd55791c19ee3000ef6c0e7f311ebfe5c4d84cc82e193082c4ff970ef73e9552fc18c403e2e360a7ac3fc771360db1f61229b341472123

Download Submit
\Program Files\XMedia Recode 64bit\XMedia Recode.exe
Filesize
9.4MB

MD5
bf851203ed07ad2e76b1d026fe2354d6

SHA1
d826d0f3be6d6de83798343c6e9390582bc2b8cc

SHA256
f8f16d6b2d31617ccb912cc44897fd0f08df14b46f5dc0fbed75a447f9f029e9

SHA512
dffca90096cb497a7fdd97dc71347f20dbcbb681ea6be4a48fdac05f799bd633146c7e29cccabd3d9b90eadf3ed8882187349be2bd8d2b56c06361874a7b2051

Download Submit
\Program Files\XMedia Recode 64bit\aom.dll
Filesize
10.3MB

MD5
d1687899d676f2857293abbadd7a6403

SHA1
cc09e760781367425f5a51d6dc29ae79e4592b1f

SHA256
d602fbf3c079734e6e32d6ca7e476712a0d9d3d10c4da5f1b2b160ba2af0f073

SHA512
6113a14d7cbbb97bc342c13aa4399326b656fc6a36749e12f095fac3b9c640c6913d33474ee9439458a487d5e48f4769e897cdeb35a20cebd3cf13f60681a688

Download Submit
\Program Files\XMedia Recode 64bit\bz2.dll
Filesize
195KB

MD5
8942eb26a51b067a41096937ce1395f4

SHA1
8fc9f3ed2e72f5f88ad554dcd2e8b67db8142978

SHA256
801ab379ac787256eabac029f68d6f961ddc14556169574f4d347d6e75d9faa5

SHA512
b72f6a90dd744a27a4ecb04b5403fb962b3798df4e82b96827211dbbbcae9239e300451d1f85e90b51fd2ef4f21d3e3e20152be51c97a605cc57b437359b9367

Download Submit
\Program Files\XMedia Recode 64bit\cdio.dll
Filesize
355KB

MD5
b2553f5a6b035bc7825778c0a059e588

SHA1
44574d78c9f34428cc49229d77bc8fcb14f5de46

SHA256
eb7d6e259e6b98068670edc43c414801936a21b72ae2d61c2c5c44be9ab14a19

SHA512
b62faa254824910f3f9e1286812bb716d55c1798ffc0327297e08dba0eae23eaed81ac04965e4c697a0783c2da62fb5b5c8467ce4e725823acca8b4f4de0fc50

Download Submit
\Program Files\XMedia Recode 64bit\cdio_paranoia.dll
Filesize
191KB

MD5
aa24d2cee4cb502e8179b6286da6eba1

SHA1
99db438d6e411c28e5cd0d641cf17d5d7bc0a00d

SHA256
567127d9d73a8aaceee565730d611fe4628fb30e5567602a8cb0e003845b1b65

SHA512
444fe49734344c5d634bc8bdd02d3642b0d0c38c377ffa0dc6661754c1eee08ab42458432f3c1c380e8a8e242828f5621c039861a07f763c6822de1f57fa8de1

Download Submit
\Program Files\XMedia Recode 64bit\ffmpeg.dll
Filesize
16.7MB

MD5
e2a6bbae7940abfef6b0c28bdcf4cf58

SHA1
910f0ca4b6b7b4708defc3d57fffe325d7ba457a

SHA256
e5b2a31836fcd56de233360ce54038f9f707e698a73381091666c279b4d0f603

SHA512
d892cdbb96925a4cac94017b1475928959001fdc04cbb7d781822b1fe758e6a4fa02a716beda4073bac308442cfa3b03702eaa70c8cdd169d9cf9d53b48c6ae0

Download Submit
\Program Files\XMedia Recode 64bit\libbluray.dll
Filesize
467KB

MD5
3cac6a48a27c2040feb255ebda1557c2

SHA1
f7220c5a62340999dda4d4768cc87a8f26c3c155

SHA256
27984be30e80b1580154a83c1a238c6c4ad76ce7f18437b6c48433d223815a06

SHA512
6f9ea5f890c24c7d647d73d76cd0b8a6574651c13d62e3128b5fa6b22cf54704bc33569471dc95d4b0ee21523a97b6dff5588bb8e543d77c116745d92f1e7dc7

Download Submit
\Program Files\XMedia Recode 64bit\libdvdread.dll
Filesize
827KB

MD5
265a7b88a2da34e7f72cf74f9caec369

SHA1
deaad03ee6a6ccdc7c29e3276d1b07ef532d6b87

SHA256
d97b4170cf85a0b826fac6fb2de0d0f81b4bdb9fe41162c1e33f25ac08fdd25f

SHA512
997c0078449386f046509533bba43d07642074e60f79485940fce48eaf39b1799a1cd371102d18d8b34fd6eac791e73ac2466db050b7bb9ce434668b584afea9

Download Submit
\Program Files\XMedia Recode 64bit\libogg.dll
Filesize
480KB

MD5
638ea72a0de6c4b06c1b8a1e05016b9b

SHA1
67a2b77cd145532e9130fa0edf692166aeb19722

SHA256
07e1d53cb9a97d281170acf7a3c657cb01684d5c8bf1536c363c232df3a40edf

SHA512
bf366c0b5ddf04c35e4b3cee56e4315f977ca7dad16e3031e749caf44c1b9823944b4670060fd5c7b59780be0fd41fa8208bf5626610cc061826ca28c673dbe9

Download Submit
\Program Files\XMedia Recode 64bit\libopencore-amrnb.dll
Filesize
811KB

MD5
eb5d13780f5bee0829f3bd642f94d06a

SHA1
cdddf56e96bde5e553e3d50879f11e2a4f7bf0d4

SHA256
5332a84d2f70c8b6e0f236fe96e4eca58aed0d2d2f2288c414dcc5fb2efd181a

SHA512
a990d8b643bc81c361a9a9f67c75e5bc5d1c6372843df8a54b83716fa45c67db958770a2994789c11339e83adb01043bfec982c702e57172c0b2195c5125ae7c

Download Submit
\Program Files\XMedia Recode 64bit\libopencore-amrwb.dll
Filesize
545KB

MD5
fd6a2fcb2e6b9c4e0a49524a51ee9046

SHA1
39baede354f0adcc5cac55ca5d706ee36b2d3c87

SHA256
031d59576ccae560a5471ec20d7297197abf25e5ff42050a2d3faf516c784ce3

SHA512
4fc8b612c34f6a081a198145bd9b4338a03f72e1fb95421138b44d0050093e856ffad499a9922ca978d71ec8baec6b4bfae4d2308eb26126b0d6bfcac24f1699

Download Submit
\Program Files\XMedia Recode 64bit\libvorbis.dll
Filesize
728KB

MD5
48167b3c5ef3cdf3e5b3b4705e4630bb

SHA1
6c90abedfd30817f4a44fc98bb52e3c8fc3d778d

SHA256
ede62b125cb04aecca726d7b70a968998f900a3a46f4a7f2080963c19f2d8526

SHA512
c16a4d1432cbac8d3179bdb98d2ffc02ad150cfae621b19b03c4bcdbf4554540b1bc9ec2669fb5ce2fa6a4419c3b3f0031a464188b20d3dd9fc2e8f862b2cc32

Download Submit
\Program Files\XMedia Recode 64bit\libvpl.dll
Filesize
189KB

MD5
556a748fdd3d6ed97fb5f014cde682ff

SHA1
d78f15f2b3be9894c1beaacb4a7de455ab6fa84e

SHA256
5ab87ec14c721763089e22c71c865d110565e23d9a605e03413422f53a7b2caf

SHA512
a5af00854dbf8d2eca7995bd074353a6634c3f75bd320e65b002fb248279a72a1200282cd13d5daf53af641d08533d4e91bf72e4eb09b33b8a2d002447732715

Download Submit
\Program Files\XMedia Recode 64bit\libxml2.dll
Filesize
1.9MB

MD5
550e41b9e79509c443fb0373d42ce11d

SHA1
e0089d1afaa0bf12aae0e93ab8b071ddd93fdd46

SHA256
659607cc4e044b351a995c6ca275fd544c055a4a4796d143a70dbe8ba1e3163f

SHA512
263718d7da925439379a0bed879deddf8bfd3ce4abac5921e45266924605428b985fd5f98aef2e96af2d9775e0902ea9b655c850ea57cea09ab5250a7106cac2

Download Submit
\Program Files\XMedia Recode 64bit\mp3lame.dll
Filesize
566KB

MD5
99128d32f7b0e4296d73fb424faf9106

SHA1
81dbeb05db64d5f0fc2abf62b7a763e0cff65fa6

SHA256
fcdadfb4aaf985df247cbbbe3761072e303832db9b1fcdd2379552c0d0fb8971

SHA512
0ddc593b4e006fcd3a0945037996373c9db6cb024c7da013b661241cd51b25fc370ca2560817488a0d3612e813ef198466f4a025dc02ce14f19fcf6ce72dc101

Download Submit
\Program Files\XMedia Recode 64bit\opus.dll
Filesize
6.3MB

MD5
a247f650dcd853fe23c017ebc8f22b03

SHA1
4eaa43e681107d3b922a20b6bde920047f3d30a1

SHA256
48304732b678ddabaa26cf6bc4717437d7710764143ee983cf134c1cfa67a120

SHA512
3d58f8d99d596031766c04da18371f5afefae0d1b089523099956445c43009fe5718a6c57faef3a72418c7e67aea202397afe13e9f8852eba217626d995ac76e

Download Submit
\Program Files\XMedia Recode 64bit\theora.dll
Filesize
279KB

MD5
0c1385a28a3c3a18834b92e37b8573cf

SHA1
ba7c5faa6508679bc390fe25fc89e73b10abb9e6

SHA256
de3aa6a57baf01a28dc156aba002143922fbc1b6712921b60a02dc99453d4ed1

SHA512
9bda4df519a3653a4e639f4d46d3cd15d12485f0b138ab7bf46a841d1be86cd839aa7430032726236e3addd6353947629366dc1f1328a65014ea81b17e015baa

Download Submit
\Program Files\XMedia Recode 64bit\unins000.exe
Filesize
3.1MB

MD5
4aaa7adafbb0ed405501110a3ebbcd6b

SHA1
7bce7a307be1814e402c19b94fc85ed952e1d974

SHA256
18a26436305d6f7f64074e01beec9ed1cc82f7b1495899da56ae947badecfc0c

SHA512
2c89f0aed4e53eabe163f98ca018dbe464bce2a05bb069f9b5c513ee68a1f85f17f1aabb5e3286cfb5ccc7aa8110a204b363f1f2f81a68d6bad24fd140999b02

Download Submit
\Program Files\XMedia Recode 64bit\vo-amrwb.dll
Filesize
184KB

MD5
7191558332bad182f0c20db19723e4c8

SHA1
ffe6980f3a5ae2065a59995baa4b1c273776c7fe

SHA256
faf2cdd1d7655055c750d8fb0ca27873dec67105d8fc1b57779014e387cef21f

SHA512
c0af3e286f57f3b2eaf05e63920beebb9a9ecde33e297544f593e99d9d9443e26a274309d1cfa8914f97e91a7c386ee920187f018d15ec21f38da0c4ed939b30

Download Submit
\Program Files\XMedia Recode 64bit\x264.dll
Filesize
2.1MB

MD5
0fd3a4b931af67521d06da5f47e08cf8

SHA1
843a52443af854979bd417328b3c3220872d6b6b

SHA256
b93e5dd4c086f339f47161f23ddae4ffbc7cf8c7c3deecb3acdd860a2ba9887c

SHA512
f1cde5e6432b1d123e4d63598536ed3e95718ae70002b3dbd5265043afc3d5f851ce24c190ce0c6e235e6b90db9d2698e74da9edf3ebe3a490126892211b6b5d

Download Submit
\Program Files\XMedia Recode 64bit\xvidcore.dll
Filesize
767KB

MD5
852a010d6c2acfbf1bda662c43eb074a

SHA1
2bfa368f58290552fbb0393cb5206623963707e0

SHA256
b48d3f9207524ac6f36a73d246ce1e6d16724a7078eace2e0cd498af3642fc0a

SHA512
4a48803dea728db6f4894ecbc3b06a0b12417c6f198338a0dab6d8a2823f66462084b79367fa3753392e2fc35fc59216dd500d16f41ab92225c0720f2d13e632

Download Submit
\Users\Admin\AppData\Local\Temp\is-BF2QA.tmp\XMediaRecode3596_x64_setup.tmp
Filesize
3.1MB

MD5
72a98a5ded279d924fee43f8b0979294

SHA1
903563b7e19c864ce9568a6d79fc0d867e154186

SHA256
1dab9b036de1e7adcd92b4ed54837b34099cadb130d9b0724d19c587c10617cf

SHA512
540a977e675d9130ed5efa8d1f60d411008991c27ca040eeb9ae0549e9f3c8182b63463eff681d657c18595c5866078ce6a2758437b27f0dfd035d5f9e64e844

Download Submit
memory/992-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/992-1076-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/992-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/992-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1240-1030-0x00000000003A0000-0x0000000000473000-memory.dmp

Filesize
844KB

Download
memory/1240-1045-0x0000000000510000-0x000000000058E000-memory.dmp

Filesize
504KB

Download
memory/1240-1048-0x00000000005A0000-0x00000000005D4000-memory.dmp

Filesize
208KB

Download
memory/1240-1033-0x0000000000480000-0x000000000050F000-memory.dmp

Filesize
572KB

Download
memory/1240-1075-0x0000000002770000-0x000000000277A000-memory.dmp

Filesize
40KB

Download
memory/1240-1074-0x0000000002770000-0x000000000277A000-memory.dmp

Filesize
40KB

Download
memory/1240-1094-0x0000000002770000-0x000000000277A000-memory.dmp

Filesize
40KB

Download
memory/1240-1093-0x0000000002770000-0x000000000277A000-memory.dmp

Filesize
40KB

Download
memory/2332-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2332-11-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2332-1004-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2332-1039-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download