c11dcdf36cbcceda36b0c4b761ce730f2d1acb6e73753fa261746ce1b2fd3a05

Analysis

max time kernel
203s
max time network
212s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-fr
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-frlocale:fr-fros:windows10-ltsc 2021-x64systemwindows
submitted
21-11-2024 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup_10024.exe
Size

66.4MB
MD5

adeea644383704c111e174bf39838624
SHA1

9e5a9159a31577aa0fe3d8cb8735b111bf045e9b
SHA256

f2eb9bcf157d1667550e43ac62ba7da2d3ac5af3098bf27cf68d20fc79efafb6
SHA512

5f5e6ad62ef78e485700dc1686c8fcf7088bb7c5c3898cd50c6b21147281db92c6820b459eb0fd0a0d093e8242023096452967e7ecda1340a7e3bb03460d1ef6
SSDEEP

393216:aHHFEHHp1UNNtUWnYv3QYDez3QzCQSPIaXSz69II65rUVQ:p1UNNtUWnw3ivhdS+9Ix5rUVQ

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 4 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

1012 netsh.exe
3840 netsh.exe
1208 netsh.exe
5108 netsh.exe

pid	process
1012	netsh.exe
3840	netsh.exe
1208	netsh.exe
5108	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup_10024.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	Setup_10024.exe

Executes dropped EXE 7 IoCs

Processes:

Setup.exeElevator.exepxsetup.exepxcpyA64.exewinamp.exewinamp.exewinamp.exe

pid process

3476 Setup.exe
2644 Elevator.exe
4180 pxsetup.exe
4428 pxcpyA64.exe
3796 winamp.exe
5808 winamp.exe
5388 winamp.exe

Loads dropped DLL 64 IoCs

Processes:

Setup.exerundll32.exewinamp.exe

pid	process
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
3476	Setup.exe
2164	rundll32.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe
3796	winamp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 7 IoCs

Processes:

wmplayer.exe

description	ioc	process
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmplayer.exeunregmp2.exewinamp.exewinamp.exe

description	ioc	process
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\D:	winamp.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\D:	winamp.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe

Drops file in Program Files directory 64 IoCs

Processes:

Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Eo.S. + Phat - chasers 18 hallway.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi + Martin - dive.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\jnetlib.dll	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\scripts\mainmenuoverlay.maki	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Bento\window\numfont.png	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\texer2.ape	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Hexcollie, Aderassi, BDRV, AdamFX n Flexi - It's a start.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Unchained - Unclaimed Wreckage 2 (Hemi-Sync).milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\shifter - brain coral.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Unchained - Fuzzy Sciences.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\fiShbRaiN - toffee cream and icing sugar.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\textures\paper.jpg	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\buttons_mlpl_bg.png	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\wasabi\Scripts\standardframe.maki	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\options_scrollbuttons.PNG	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - strangely dynamic world.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Geiss - Skin Dots Multi-layer 3.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\nil - Disco Comet.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\ml_wire.dll	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Eo.S. - heater core C_Phat's_class + sparks_mix.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Redi Jedi - off the fadar.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - hardcore mix 2.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Aderrasi - Contortion (Escher's Tunnel Mix).milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\docs\t_vars.gif	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Aderrasi - Contortion (Escher's Tunnel Mix).milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - smashing fractals [acid etching mix].milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Idiot - Subnormal Trance (Remix).milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\ORB - Magma Pool.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\fiShbRaiN - one step beyond (jelly remix).milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\xml\standardframe.xml	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\Community Picks\Tuggummi - Shiny metal curves.avs	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\scripts\pltime.maki	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar + Flexi + Loadus + Geiss - Tone-mapped FractalDrop 4 [moebius edit].milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\Winamp 5 Picks\Nic01 - Rototronik.avs	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\scripts\colorthemes.maki	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - meta4free.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - predator-prey-spirals [stahlregens gelatine finish].milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\in_mod.dll	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Upward Current.avs	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Geiss - Cosmic Dust 2 - Tiny Reaction Diffusion Mix.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar - Torrid Tales.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Stahlregen + Geiss + Martin - Ouboros (Metal Finish 2).milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Unchained - Making a Science of It 2.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - satellite view.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\in_cdda.dll	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\displayoverlay.png	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - cell tissue.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\wasabi\xml\xui\xuiobjects.xml	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\about\about.xml	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Stahlregen & flexi + Geiss + Rovastar + Shifter - Even More Fractals for Hexcollie (Reflecto Fcukup).milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Zylot - Crosshair Dimension (Light of Ages).milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\videoavs_bg.png	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - gentle happiness.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - violet flash.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\buttons_eq.png	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Bento\screenshot.png	Setup.exe
File created	C:\Program Files (x86)\Winamp\Skins\Bento\window\menu_file.png	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - mindblob 2.0.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Geiss - Cauldron - painterly 5.milk	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\DSP_SPS\cockos - octave up.sps	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\Community Picks\el-vis - rittaufdemfeuerstrahl.avs	Setup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - strangely dynamic world.milk	Setup.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Forum collaboration thread - second try #4 [Goody(2), Stahlregen (2)].milk	Setup.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3552 6064 WerFault.exe wmplayer.exe

pid	pid_target	process	target process
3552	6064	WerFault.exe	wmplayer.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

netsh.exewinamp.exewmplayer.exeElevator.exenetsh.exenetsh.exenetsh.exeSetup_10024.exeSetup.exerundll32.exewinamp.exewinamp.exepxsetup.exeping.exeunregmp2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winamp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elevator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup_10024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winamp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winamp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pxsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

ping.exe

pid process

4072 ping.exe

pid	process
4072	ping.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

Setup.exewinamp.exeElevator.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9e77a3fd-df03-4077-ba10-001d52acae44}	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39c806ec-eb0a-4f6e-b40d-c41d92281b5e}\InprocServer32\ThreadingModel = "Apartment"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.NSV\shell\open	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.ASF\shell\Enqueue\DropTarget\Clsid = "{77A366BA-2BE4-4a1e-9263-7734AA3E99A2}"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.SD2\shell\Enqueue\ = "&Agregar a la lista de Winamp"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.RMI\shell\open\	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbInfoWindow\CLSID\ = "{e7568058-32ea-4b10-af1b-8b666978891e}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d7fbfb00-25ec-41f6-b64e-fab7668d5b75}\Programmable	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b3f484a1-e3b4-4ad5-a9a9-52592a08dbd2}\Programmable	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.VLB\shell	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.NSA\shell\open\	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MID\shell\open\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.XM\shell\Enqueue\command	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmz	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UNSV\shell\open\command\ = "C:\\Program Files (x86)\\Winamp\\winamp.exe %1"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbExtData\CLSID\ = "{9bac7636-3c83-4a17-bc39-aeff43f8780b}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{099A10ED-517B-4387-A12E-AF3FE90B5856}\TypeLib\ = "{05D652C1-7997-40F9-982D-347B8E29F8FB}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AMF\shell\Play\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AAE501A-6D20-4AF3-8C79-473106BD5391}\TypeLib\Version = "1.0"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{03396E62-5ABB-4E75-AF96-5CC6171354BA}\TypeLib\ = "{49F3CCB6-3BA4-4B64-9451-CCF4D42581B1}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E1EEEE1-7227-4BAD-B955-B84BEA914A5A}\ProxyStubClsid32	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MKV\shell\Play\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A4471DA-0283-449E-8EE2-B0716E3C168B}\TypeLib	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA5342DC-41D7-4954-9501-FDC6ACD0DC2F}\TypeLib	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.CDA\shell\Play\command	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AIF\shell\Enqueue\DropTarget	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbInfoWindow\CurVer\ = "CDDBControlNSWinamp.CddbInfoWindow.1"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B6107AD-D1F2-41C3-B9B9-3349324F7E7B}\TypeLib\Version = "1.0"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D6F791C8-A7F7-4702-9D24-4B8F8CA4C807}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9F50E0F-859D-4397-959E-3BB7AACBB564}\TypeLib\Version = "1.0"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{751E8ACE-610B-4336-B425-5038154F68A2}\ = "ICddbURL"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27C6EFC-76ED-4724-9741-9531FC52242C}\ = "ICddbWork"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1754C0C9-24B5-4ED6-8EEA-52620ED16E58}\TypeLib\ = "{7919D0CA-3043-4C02-B778-AB2BF4931F58}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AIFF\shell	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.ASF\shell\Enqueue\ = "&Agregar a la lista de Winamp"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.SDS\shell\Play\command	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.WAV\shell\Play\DropTarget\Clsid = "{46986115-84D6-459c-8F95-52DD653E532E}"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\ = "Winamp.File.WAV"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbWMATag\CurVer	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenerator	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE4E7FEB-EE3A-4A41-B370-AE37E656BE29}\TypeLib\Version = "1.0"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.OGA\shell\open\command	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.IFF\DefaultIcon	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.IFF\shell\open\DropTarget	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4997bae9-4015-4030-80aa-1477ce28e66c}\ = "CddbCacheManager Class"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE5E5B63-8154-4CB0-8FFC-A0AAB7DBE9D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2C6C4EE-32FE-4BB7-8A47-DC615034BD7C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AVI\shell\Play\ = "&Reproducir en Winamp"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AVI\shell\open\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.ASF\shell\ListBookmark\ = "Agregar a la lista de &favoritos de Winamp"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MDZ\shell\Play\command	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.STZ\shell\open\command	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{614D9D0A-C012-4863-AFBF-9C9DD01E04D1}\ = "ICddbRoleList"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPL2Criteria\CurVer\ = "CddbPlaylist2NSWinamp.CddbPL2Criteria.1"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenLimitList.1\CLSID\ = "{f78ae80a-3ef5-498e-bf16-7696f7d31fed}"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3FFD3787-FE3A-4F44-BE99-4289875EB925}\ = "ICddbPLGen25Criteria"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B29AB5C-52CB-4A36-9314-E3FEE0BA7468}\VersionIndependentProgID	Elevator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.SDS\shell\open\DropTarget	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MID\shell\ = "Play"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3254573E-1053-4430-9CA6-7B9B89638515}\TypeLib\Version = "1.0"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27C6EFC-76ED-4724-9741-9531FC52242C}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7052a035-2aee-4d5d-be82-6b12437bfcba}\TypeLib	Setup.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

winamp.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob = 5c000000010000000400000000040000140000000100000014000000ddbcbd869c3f07ed40e31b08efcec4d188cd3b15190000000100000010000000181c2be05851f96993e196f279954b230b000000010000002e0000005400680061007700740065002000540069006d0065007300740061006d00700069006e006700200043004100000009000000010000000c000000300a06082b06010505070308030000000100000014000000be36a4562fb2ee05dbb3d32323adf445084ed6560400000001000000100000007f667a71d3eb6978209a51149d83da200f0000000100000010000000e8a598be84828efeae701115013576b22000000001000000a5020000308202a13082020aa003020102020100300d06092a864886f70d010104050030818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e67204341301e170d3937303130313030303030305a170d3230313233313233353935395a30818b310b3009060355040613025a41311530130603550408130c5765737465726e2043617065311430120603550407130b44757262616e76696c6c65310f300d060355040a1306546861777465311d301b060355040b13145468617774652043657274696669636174696f6e311f301d060355040313165468617774652054696d657374616d70696e6720434130819f300d06092a864886f70d010101050003818d0030818902818100d62b587861458653ea347b519cedb0e62e180efee05fa827d3b4c9e07c594e160e735460c17ff69f2ee93a8524153cdb470463c39ec4941a5adf4c7af3d9431d3c107a7925db90fef051e730d64100fd9f28df79be94bb9db614e32385d7a941e04ca479b02b1a8bf2f83b8a3e45ac719200b4904198fb5fedfab72e8af888370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810067dbe2c2e6873d40838637357d1fce9ac30c6620a8baaa048986c2f510080dbfcba2058ad04d363ef4d7ef69c65ee4b0946f4ab9e7de5b88b67bdbe327e576c3f035c1cbb5279b3379dc90a6009e77fafccd279442169cd31c68ecbf5cdde5a97b100a32745413318b85038491b75801301438af28cafcb150191909ac8949d3	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A\Blob = 19000000010000001000000014955ab9df8b66e553228ad2f2f890240300000001000000140000003921c115c15d0eca5ccb5bc4f07d21d8050b566a680000000100000008000000008024eed112d20109000000010000000c000000300a06082b060105050703031d000000010000001000000084cca4bd69d41035b3455e859fa2a69214000000010000001400000000add9a3f679f66e74a97f333d8117d74ccf33de62000000010000002000000077407312c63a153d5bc00b4e51759cdfdac237dc2a33b67946e98e9bfa680ae30b000000010000005c00000041006d006500720069006300610020004f006e006c0069006e006500200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000310000000f0000000100000014000000b31da18fba765c5ed3df3080593871db9e0dcc292000000001000000a8030000308203a43082028ca003020102020101300d06092a864886f70d01010505003063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f726974792031301e170d3032303532383036303030305a170d3337313131393230343330305a3063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f72697479203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a82fe8a469060347c3e92a98ff19a2709ac650b27ea5df684d1b7c0fb697687d2da68b97e96486c9a3efa086bf60659c4b5488c248c54a39bf14e35955e519b474c8b405395c16a5e29505e012ae598ba23368581ca6d415b7d89fd7dc71ab7e9abf9b8e330f22fd1f2ee70736ef6239c5ddcbba251423de0cc63d3cce8208e6663eda513b163aa3057fa0dc87d59cfc72a9a07d78e4b731551e65bbd461b02160ed103272c592251ef8904a187847df7e30373e501bdb1cd36b9a865307b0efac0678f88499fe218d4c80b60c82f66670791ad34fa3cff1cf46b04b0f3edd8862b88ca909283b7ac797e11ee5f49fc0c0ae24a0c8a1d90fd67b268269323da70203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e0416041400add9a3f679f66e74a97f333d8117d74ccf33de301f0603551d2304183016801400add9a3f679f66e74a97f333d8117d74ccf33de300e0603551d0f0101ff040403020186300d06092a864886f70d010105050003820101007c8ad11f183782e0b8b0a3ed5695c862619c05a2cdc2622661cd1016d7ccb46534d0118aada8a90566ef74f36d5f9d99aff68bfbeb52b20598a26f2ac554bd25bd5faec886ea462cc1b3bdc1e9497018169708138c20e01b2e3a47cb1ee40030955bf445a3c01ab0014eabbdc0236e633f804ac507eddce26fc7c162f1e372d604c874670bfa88aba101c86ff014afd299cd51937eed2e38c7bdce46503d72e379259d9b882b1020dda5b8329f8de029df21748682db2f8230c6c73586b3f9965f46db0c45fdf350c36fc6c348ad46a6e127470a1d0e9bb6c2777f63f2e07d1abefce0dfd7c7a76cb0f9aeba3cfd74b411e8580d80bcd3a8803a99ed75cc467b	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A\Blob = 04000000010000001000000014f108ad9dfa64e289e71ccfa8ad7d5e0f0000000100000014000000b31da18fba765c5ed3df3080593871db9e0dcc290b000000010000005c00000041006d006500720069006300610020004f006e006c0069006e006500200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790020003100000062000000010000002000000077407312c63a153d5bc00b4e51759cdfdac237dc2a33b67946e98e9bfa680ae314000000010000001400000000add9a3f679f66e74a97f333d8117d74ccf33de1d000000010000001000000084cca4bd69d41035b3455e859fa2a69209000000010000000c000000300a06082b06010505070303680000000100000008000000008024eed112d2010300000001000000140000003921c115c15d0eca5ccb5bc4f07d21d8050b566a19000000010000001000000014955ab9df8b66e553228ad2f2f890242000000001000000a8030000308203a43082028ca003020102020101300d06092a864886f70d01010505003063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f726974792031301e170d3032303532383036303030305a170d3337313131393230343330305a3063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f72697479203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a82fe8a469060347c3e92a98ff19a2709ac650b27ea5df684d1b7c0fb697687d2da68b97e96486c9a3efa086bf60659c4b5488c248c54a39bf14e35955e519b474c8b405395c16a5e29505e012ae598ba23368581ca6d415b7d89fd7dc71ab7e9abf9b8e330f22fd1f2ee70736ef6239c5ddcbba251423de0cc63d3cce8208e6663eda513b163aa3057fa0dc87d59cfc72a9a07d78e4b731551e65bbd461b02160ed103272c592251ef8904a187847df7e30373e501bdb1cd36b9a865307b0efac0678f88499fe218d4c80b60c82f66670791ad34fa3cff1cf46b04b0f3edd8862b88ca909283b7ac797e11ee5f49fc0c0ae24a0c8a1d90fd67b268269323da70203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e0416041400add9a3f679f66e74a97f333d8117d74ccf33de301f0603551d2304183016801400add9a3f679f66e74a97f333d8117d74ccf33de300e0603551d0f0101ff040403020186300d06092a864886f70d010105050003820101007c8ad11f183782e0b8b0a3ed5695c862619c05a2cdc2622661cd1016d7ccb46534d0118aada8a90566ef74f36d5f9d99aff68bfbeb52b20598a26f2ac554bd25bd5faec886ea462cc1b3bdc1e9497018169708138c20e01b2e3a47cb1ee40030955bf445a3c01ab0014eabbdc0236e633f804ac507eddce26fc7c162f1e372d604c874670bfa88aba101c86ff014afd299cd51937eed2e38c7bdce46503d72e379259d9b882b1020dda5b8329f8de029df21748682db2f8230c6c73586b3f9965f46db0c45fdf350c36fc6c348ad46a6e127470a1d0e9bb6c2777f63f2e07d1abefce0dfd7c7a76cb0f9aeba3cfd74b411e8580d80bcd3a8803a99ed75cc467b	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A\Blob = 5c00000001000000040000000008000019000000010000001000000014955ab9df8b66e553228ad2f2f890240300000001000000140000003921c115c15d0eca5ccb5bc4f07d21d8050b566a680000000100000008000000008024eed112d20109000000010000000c000000300a06082b060105050703031d000000010000001000000084cca4bd69d41035b3455e859fa2a69214000000010000001400000000add9a3f679f66e74a97f333d8117d74ccf33de62000000010000002000000077407312c63a153d5bc00b4e51759cdfdac237dc2a33b67946e98e9bfa680ae30b000000010000005c00000041006d006500720069006300610020004f006e006c0069006e006500200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000310000000f0000000100000014000000b31da18fba765c5ed3df3080593871db9e0dcc2904000000010000001000000014f108ad9dfa64e289e71ccfa8ad7d5e2000000001000000a8030000308203a43082028ca003020102020101300d06092a864886f70d01010505003063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f726974792031301e170d3032303532383036303030305a170d3337313131393230343330305a3063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f72697479203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a82fe8a469060347c3e92a98ff19a2709ac650b27ea5df684d1b7c0fb697687d2da68b97e96486c9a3efa086bf60659c4b5488c248c54a39bf14e35955e519b474c8b405395c16a5e29505e012ae598ba23368581ca6d415b7d89fd7dc71ab7e9abf9b8e330f22fd1f2ee70736ef6239c5ddcbba251423de0cc63d3cce8208e6663eda513b163aa3057fa0dc87d59cfc72a9a07d78e4b731551e65bbd461b02160ed103272c592251ef8904a187847df7e30373e501bdb1cd36b9a865307b0efac0678f88499fe218d4c80b60c82f66670791ad34fa3cff1cf46b04b0f3edd8862b88ca909283b7ac797e11ee5f49fc0c0ae24a0c8a1d90fd67b268269323da70203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e0416041400add9a3f679f66e74a97f333d8117d74ccf33de301f0603551d2304183016801400add9a3f679f66e74a97f333d8117d74ccf33de300e0603551d0f0101ff040403020186300d06092a864886f70d010105050003820101007c8ad11f183782e0b8b0a3ed5695c862619c05a2cdc2622661cd1016d7ccb46534d0118aada8a90566ef74f36d5f9d99aff68bfbeb52b20598a26f2ac554bd25bd5faec886ea462cc1b3bdc1e9497018169708138c20e01b2e3a47cb1ee40030955bf445a3c01ab0014eabbdc0236e633f804ac507eddce26fc7c162f1e372d604c874670bfa88aba101c86ff014afd299cd51937eed2e38c7bdce46503d72e379259d9b882b1020dda5b8329f8de029df21748682db2f8230c6c73586b3f9965f46db0c45fdf350c36fc6c348ad46a6e127470a1d0e9bb6c2777f63f2e07d1abefce0dfd7c7a76cb0f9aeba3cfd74b411e8580d80bcd3a8803a99ed75cc467b	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3921C115C15D0ECA5CCB5BC4F07D21D8050B566A\Blob = 0f0000000100000014000000b31da18fba765c5ed3df3080593871db9e0dcc290b000000010000005c00000041006d006500720069006300610020004f006e006c0069006e006500200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790020003100000062000000010000002000000077407312c63a153d5bc00b4e51759cdfdac237dc2a33b67946e98e9bfa680ae314000000010000001400000000add9a3f679f66e74a97f333d8117d74ccf33de1d000000010000001000000084cca4bd69d41035b3455e859fa2a69209000000010000000c000000300a06082b06010505070303680000000100000008000000008024eed112d2010300000001000000140000003921c115c15d0eca5ccb5bc4f07d21d8050b566a2000000001000000a8030000308203a43082028ca003020102020101300d06092a864886f70d01010505003063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f726974792031301e170d3032303532383036303030305a170d3337313131393230343330305a3063310b3009060355040613025553311c301a060355040a1313416d6572696361204f6e6c696e6520496e632e313630340603550403132d416d6572696361204f6e6c696e6520526f6f742043657274696669636174696f6e20417574686f72697479203130820122300d06092a864886f70d01010105000382010f003082010a0282010100a82fe8a469060347c3e92a98ff19a2709ac650b27ea5df684d1b7c0fb697687d2da68b97e96486c9a3efa086bf60659c4b5488c248c54a39bf14e35955e519b474c8b405395c16a5e29505e012ae598ba23368581ca6d415b7d89fd7dc71ab7e9abf9b8e330f22fd1f2ee70736ef6239c5ddcbba251423de0cc63d3cce8208e6663eda513b163aa3057fa0dc87d59cfc72a9a07d78e4b731551e65bbd461b02160ed103272c592251ef8904a187847df7e30373e501bdb1cd36b9a865307b0efac0678f88499fe218d4c80b60c82f66670791ad34fa3cff1cf46b04b0f3edd8862b88ca909283b7ac797e11ee5f49fc0c0ae24a0c8a1d90fd67b268269323da70203010001a3633061300f0603551d130101ff040530030101ff301d0603551d0e0416041400add9a3f679f66e74a97f333d8117d74ccf33de301f0603551d2304183016801400add9a3f679f66e74a97f333d8117d74ccf33de300e0603551d0f0101ff040403020186300d06092a864886f70d010105050003820101007c8ad11f183782e0b8b0a3ed5695c862619c05a2cdc2622661cd1016d7ccb46534d0118aada8a90566ef74f36d5f9d99aff68bfbeb52b20598a26f2ac554bd25bd5faec886ea462cc1b3bdc1e9497018169708138c20e01b2e3a47cb1ee40030955bf445a3c01ab0014eabbdc0236e633f804ac507eddce26fc7c162f1e372d604c874670bfa88aba101c86ff014afd299cd51937eed2e38c7bdce46503d72e379259d9b882b1020dda5b8329f8de029df21748682db2f8230c6c73586b3f9965f46db0c45fdf350c36fc6c348ad46a6e127470a1d0e9bb6c2777f63f2e07d1abefce0dfd7c7a76cb0f9aeba3cfd74b411e8580d80bcd3a8803a99ed75cc467b	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656	winamp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

4072 ping.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3524 WINWORD.EXE
3524 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Setup_10024.exepxsetup.exe

pid process

1544 Setup_10024.exe
1544 Setup_10024.exe
4180 pxsetup.exe
4180 pxsetup.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

winamp.exe

pid process

5808 winamp.exe

pid	process
4072	ping.exe

pid	process
3524	WINWORD.EXE
3524	WINWORD.EXE

pid	process
1544	Setup_10024.exe
1544	Setup_10024.exe
4180	pxsetup.exe
4180	pxsetup.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

Setup_10024.exeAUDIODG.EXEwmplayer.exeunregmp2.exe

description	pid	process
Token: SeDebugPrivilege	1544	Setup_10024.exe
Token: 33	192	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	192	AUDIODG.EXE
Token: SeShutdownPrivilege	6064	wmplayer.exe
Token: SeCreatePagefilePrivilege	6064	wmplayer.exe
Token: SeShutdownPrivilege	6004	unregmp2.exe
Token: SeCreatePagefilePrivilege	6004	unregmp2.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

winamp.exewinamp.exewmplayer.exe

pid	process
5808	winamp.exe
5808	winamp.exe
5808	winamp.exe
5808	winamp.exe
5808	winamp.exe
5388	winamp.exe
5388	winamp.exe
5388	winamp.exe
5388	winamp.exe
5388	winamp.exe
6064	wmplayer.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

winamp.exewinamp.exe

pid process

5808 winamp.exe
5808 winamp.exe
5808 winamp.exe
5808 winamp.exe
5388 winamp.exe
5388 winamp.exe
5388 winamp.exe
5388 winamp.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

Setup.exeElevator.exewinamp.exewinamp.exewinamp.exeWINWORD.EXE

pid	process
3476	Setup.exe
2644	Elevator.exe
3796	winamp.exe
5808	winamp.exe
5388	winamp.exe
3524	WINWORD.EXE
3524	WINWORD.EXE
3524	WINWORD.EXE
3524	WINWORD.EXE
3524	WINWORD.EXE
3524	WINWORD.EXE
3524	WINWORD.EXE

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

Setup_10024.exeSetup.exepxsetup.exewinamp.exewmplayer.exeunregmp2.exe

description	pid	process	target process
PID 1544 wrote to memory of 3476	1544	Setup_10024.exe	Setup.exe
PID 1544 wrote to memory of 3476	1544	Setup_10024.exe	Setup.exe
PID 1544 wrote to memory of 3476	1544	Setup_10024.exe	Setup.exe
PID 3476 wrote to memory of 2644	3476	Setup.exe	Elevator.exe
PID 3476 wrote to memory of 2644	3476	Setup.exe	Elevator.exe
PID 3476 wrote to memory of 2644	3476	Setup.exe	Elevator.exe
PID 3476 wrote to memory of 1012	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 1012	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 1012	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 3840	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 3840	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 3840	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 1208	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 1208	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 1208	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 5108	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 5108	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 5108	3476	Setup.exe	netsh.exe
PID 3476 wrote to memory of 4180	3476	Setup.exe	pxsetup.exe
PID 3476 wrote to memory of 4180	3476	Setup.exe	pxsetup.exe
PID 3476 wrote to memory of 4180	3476	Setup.exe	pxsetup.exe
PID 4180 wrote to memory of 4428	4180	pxsetup.exe	pxcpyA64.exe
PID 4180 wrote to memory of 4428	4180	pxsetup.exe	pxcpyA64.exe
PID 3476 wrote to memory of 4072	3476	Setup.exe	ping.exe
PID 3476 wrote to memory of 4072	3476	Setup.exe	ping.exe
PID 3476 wrote to memory of 4072	3476	Setup.exe	ping.exe
PID 3476 wrote to memory of 2164	3476	Setup.exe	rundll32.exe
PID 3476 wrote to memory of 2164	3476	Setup.exe	rundll32.exe
PID 3476 wrote to memory of 2164	3476	Setup.exe	rundll32.exe
PID 3796 wrote to memory of 5808	3796	winamp.exe	winamp.exe
PID 3796 wrote to memory of 5808	3796	winamp.exe	winamp.exe
PID 3796 wrote to memory of 5808	3796	winamp.exe	winamp.exe
PID 6064 wrote to memory of 6092	6064	wmplayer.exe	unregmp2.exe
PID 6064 wrote to memory of 6092	6064	wmplayer.exe	unregmp2.exe
PID 6064 wrote to memory of 6092	6064	wmplayer.exe	unregmp2.exe
PID 6092 wrote to memory of 6004	6092	unregmp2.exe	unregmp2.exe
PID 6092 wrote to memory of 6004	6092	unregmp2.exe	unregmp2.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Setup_10024.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_10024.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Program Files (x86)\Winamp\Elevator.exe
    "C:\Program Files (x86)\Winamp\Elevator.exe" /RegServer
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2644
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files (x86)\Winamp\winamp.exe" profile=private,public protocol=TCP new action=allow enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1012
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="Winamp" dir=in action=allow program="C:\Program Files (x86)\Winamp\winamp.exe" enable=yes profile=private,public protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3840
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files (x86)\Winamp\winamp.exe" profile=private,public protocol=UDP new action=allow enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1208
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="Winamp" dir=in action=allow program="C:\Program Files (x86)\Winamp\winamp.exe" enable=yes profile=private,public protocol=UDP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxsetup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxcpyA64.exe
      "C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxcpyA64.exe"
      4⤵
      Executes dropped EXE
      PID:4428
- - C:\Windows\SysWOW64\ping.exe
    ping -n 1 -w 400 www.google.com
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4072
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\SHELLD~1.DLL,RunDll_ShellExecute "open" "C:\Program Files (x86)\Winamp\winamp.exe" "/NEW /REG=S" "C:\Program Files (x86)\Winamp" 1
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2164

C:\Program Files (x86)\Winamp\winamp.exe
"C:\Program Files (x86)\Winamp\winamp.exe" /NEW /REG=S
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Winamp\winamp.exe
  "C:\Program Files (x86)\Winamp\winamp.exe" /NEW C:\Users\Admin\AppData\Roaming\Winamp\winamp.m3u8
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3a8 0x4d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:192

C:\Program Files (x86)\Winamp\winamp.exe
"C:\Program Files (x86)\Winamp\winamp.exe" /HANDLE "C:\Users\Admin\Desktop\ResumeComplete.asf"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 3120
  2⤵
  - Program crash
  PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6064 -ip 6064
1⤵
PID:3720

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\InvokeUnprotect.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Winamp\Elevator.exe

Filesize
90KB

MD5
5e90e4e003ff75b207d956227c8db1fc

SHA1
e05c30b4e1dd22afae5fe0a117e62ee69af878fc

SHA256
35f2265273b38d3f81d6ef07f57bc20fca07f62687445aab6651c141157cb519

SHA512
7dc765ebbdc8c707da12e4a321f80545def74cb93ee73c6545893a7366173ead0108292603856dcc6136bbc46550f73ecaf36553c12eff5ed32a391d1efe63ab

Download Submit
C:\Program Files (x86)\Winamp\Lang\Winamp-ES-US.wlz

Filesize
1.8MB

MD5
22a376599b2849f93c7253c100eb4331

SHA1
77b6e26057f1a693f8102d5d7a1198d6945ee12a

SHA256
443937635937f0fa82240d20a81477ccb97fb4956aa1049af3408477a4513b86

SHA512
61900ef01d4eb6e8945fdb341287c01d41e79f3dbcef57c59727eea19dc40ab37a4b1307cd483c4ba9b917b7ff4731cf879f42d3d54e027dc36ca436557549f7

Download Submit
C:\Program Files (x86)\Winamp\Plugins\Gracenote\CDDBControlWinamp.dll

Filesize
1.5MB

MD5
72ab7ff3886957602a68b3d89bde44fa

SHA1
91365edba7dc4aae61edf0c5a16705552e668b6f

SHA256
025ee64129129e7e6bff4c0769cf93e00e095b752299e7d633de5d9c261e173b

SHA512
ac1b58c308bcebe6c4b4672b5a4aa14cd1d3a923c80ac495f4d42aab45db0d085ddbf51111f3045bbdc74d1456f642f62775362cf3d132c1b6aaae0c47663c35

Download Submit
C:\Program Files (x86)\Winamp\Plugins\Gracenote\CDDBUIWinamp.dll

Filesize
1017KB

MD5
ac5430ae266925bb85d2d5800d03c262

SHA1
b9a86664a0fac9b79c162587a203674bc6ae9191

SHA256
fb4211686c2ddba152cbc239ef8b630c5d2a8c05e9056d4c797cd0ddb200e9e4

SHA512
3992049fe87785c6827fa35b271c37696733b362bf276d5098b0e1befe6c217ee7847d1256dedc1fbbb2d608e7cc195e9229dbde7519615127b7f361edd8a15b

Download Submit
C:\Program Files (x86)\Winamp\Plugins\Gracenote\CddbMusicIDWinamp.dll

Filesize
905KB

MD5
37ffbcbc724d72a49248cd6df27cea84

SHA1
7ee0fa08510f549d9ad7538416e0e19bdf911ad8

SHA256
98a8b5ce8023885391bd4be08781deb141479eaae5c70e264eac2d6c2da54f7c

SHA512
b6fc63a76321e241547061a876f50f5b99e68880f6ba4af3d66656354cf827d99f07d38ffab6764c83c5ab1f35748876077af04743d747df3a3a5f86314a69e1

Download Submit
C:\Program Files (x86)\Winamp\Plugins\Gracenote\CddbPlaylist2Winamp.dll

Filesize
1.1MB

MD5
7c7f404f3923a9346978be902e2257de

SHA1
c1f41edfb4af754db2e2679a8ae40d3b1a9075b9

SHA256
1239b23e01467f6fdc2a0dd109c5713588fe77a4d206d60dfb3712e08d1dc3d5

SHA512
c60806b31bcb314c4d6e3e4ddd394752a665d16ee223359677e6d08dbf288aef88967a4aea46efbe28600f35f7abc5b6267a6c69820a29ce3f9f2e805fbcc477

Download Submit
C:\Program Files (x86)\Winamp\Plugins\gen_crasher.dll

Filesize
50KB

MD5
41b366ede1fbc0934ab725b98028dd09

SHA1
ba6790ebb79145bc35af7f1a197cc1f2048457f7

SHA256
4b561f368f71f524a1fd5b12f3b74d88e9baa89a9cf6e59128e6977fc47762c1

SHA512
1bbd61391db3e2c96c9140bf3a62a1fa0d2b1dd91e8240c62bec9be62e1f74007e42d5274100280fefc0bd7127ec993edb62ecfd3b159a8ba13b4d451dbfdeb6

Download Submit
C:\Program Files (x86)\Winamp\System\aacdec.wbm

Filesize
259B

MD5
1add8602b0fbaa04bf8d5d3dba1b5773

SHA1
c07d835ecd5066a13b56819a3e8499d5adf4064d

SHA256
53cab9e0cfafd16c6d0553f7d32cf847e2c3c2ca6c3b2026304c772f7860614d

SHA512
f57d10dc83ad2ad6e3761ff07047fb2dbb7ad9981675517dcca4f661de97e1c1a0c6d43f0320090cbebcab1b3e761acde37c047f8ebe455098f250331511cf3b

Download Submit
C:\Program Files (x86)\Winamp\System\adpcm.wbm

Filesize
90B

MD5
e429629d090e3b1ed4db75aee35efc96

SHA1
f37ad76303b6fbdfd4820a8a6386ca220932c70b

SHA256
fbd9d49c94d98f0de4d07370d94ad002a670c15937be86005c627f377174be85

SHA512
a3a97d6cb886bf7f0497548339b3f50d4e74989cc68f96deed7030d4e93c9804932ec1222aacb73e9fb372208425e73c531936aa9efc91fa6995e2e128b43ca2

Download Submit
C:\Program Files (x86)\Winamp\System\alac.wbm

Filesize
44B

MD5
6596ff2e19aa263adf10d3378ff0b78f

SHA1
b47c8381470092f730e578a8a9b847d301fe011b

SHA256
4b728d5a18f24095b5e2faa23406fdc5ed99f50a11be113422ef8a372399c4cf

SHA512
fe380383a41b50defd83041870f6b88813f6564c2bdbe01b34827cdb8f3f33dda056dfe105055ee0a12d8ab7f4233dd59538cf6af6e739367053a4b0120be383

Download Submit
C:\Program Files (x86)\Winamp\System\albumart.w5s

Filesize
25KB

MD5
3fdfdcd756afba33849d8b7684fe77e7

SHA1
1c06b7c06082f217b96277b3962e7e021e7685df

SHA256
93aabe12b37713acba5c7c94b30d3892e539683df69af7cc73bc1bf2551cf24a

SHA512
a1677d97d6ce58c076938d988367cc4f95c575cc6931b046dd7435cdf135b173aa69280957119b1ce8370382ad832f36ef758723782f2c1d16b47f013defdd41

Download Submit
C:\Program Files (x86)\Winamp\System\auth.w5s

Filesize
166KB

MD5
dcd7d62e2dbcdd7d7b90b18a7b6184ed

SHA1
4b6f23e077651e3cd5648d30e7d54bf274e5d452

SHA256
c00175ca500e434592cf16a6b3dbf6b02dad2b26150660fd22c5198c21b0fc7f

SHA512
dff9bb0a14b80e1fcb516e8ee7b9af7685ad7b5d52a7fd632e789424072ba8bd54613065c79311f752c47e7a59450dc7118ada48a56ea85debfde9c1df28b9c3

Download Submit
C:\Program Files (x86)\Winamp\elevatorps.dll

Filesize
50KB

MD5
c990acb402c04bd44319183198c748f3

SHA1
d20358545f8148394a1205f63d6bfa3bcb950f28

SHA256
fde86abbc080ce9dc48975100ad908b05a53e5c1026e34d064f3245a01770fbb

SHA512
86c5c5027e9e4571888d5edef060eb71fe1a2a365c5f2933ae95f263a188f2256d9f9e7182616e53146455f81892f1a923da2c2e10937de06f888d6d2bc8dd70

Download Submit
C:\Program Files (x86)\Winamp\jnetlib.dll

Filesize
607KB

MD5
792104d32753ab1011a7dc41c80cb504

SHA1
48314163f4815452b61c7069531a6faa02775bc9

SHA256
8d52761d0e9f753f05bb0dfb37d9fd14eba0af4023608012710ca0c3db79e444

SHA512
bb3ddc7eedf30e4776c06a667b0ff9aee2605cd32d8e0fee1f93839ff29075fe37713a2b74e5f6ec51c0bc7a6d44dd5f022e196f068f969cd75f14482c5be587

Download Submit
C:\Program Files (x86)\Winamp\libmp4v2.dll

Filesize
205KB

MD5
40bcb601ffc793df132ca679a7be3751

SHA1
612019f73365bb71ed37bc9db8ce4f74b79554aa

SHA256
9bcb761abe667618bfe3511f540d19167d649b6eed8bb4f84384f96c38791381

SHA512
87a9ffe04cab651599b9d99e009e2a849a18fab2cf448bbf19a5197f8c4aee398ea3b5fdf2c83838880eb00ac59ee9884d968f8d78e3368afba98162d6f7bbea

Download Submit
C:\Program Files (x86)\Winamp\nde.dll

Filesize
84KB

MD5
d1b7c43550af02cf4e9712b1c1a63cc3

SHA1
0f0d82a6b341dfce6fa4d2b93252faf46a211e19

SHA256
202e7e7e30965d970cb37462f0bd763551d757bdf35e04cdc78721559118a469

SHA512
22d45cfa22343d5b74101e91cacdeaa73d6520588a365b0667c61e8e82451e78c0624b021e7ce5421d449e5d33f7df15355e272defb9d70c1cdbb89f611760e7

Download Submit
C:\Program Files (x86)\Winamp\nsutil.dll

Filesize
409KB

MD5
cdc510af97cee27fe9b7f6e79321960d

SHA1
7a676c673e46a6bb33edd35bb8051dc8428a39e4

SHA256
714149e044c0b1598d50b0de75f0e6c7b6b4b879a4d8fb195243e68758cf3f84

SHA512
4bd33b051d8a0ea158ae665323383d4ad326a6f7693fcd02aa6b4a6f6dc6ea28b75c26f394710668bba50a46cf4896eb173b664183389a95ababb4aa0e68207b

Download Submit
C:\Program Files (x86)\Winamp\nxlite.dll

Filesize
28KB

MD5
f270d9dbf305256d0979841886f288a3

SHA1
6e85e6d9e80c97e2d85b1754170b4ff9e50fe6bb

SHA256
bdc9e1a1edf9d42ca846b67256fc30befdf63c69354dcb30046e594e347a39ac

SHA512
b5b139870ac0ed729d6281a47ad002af2ac9102624846f0ca9ea198322fc20db9825261d4b3df26833df93d1dab3a2dbb8896eea100d06c7bcdbbd5ed08ea1f2

Download Submit
C:\Program Files (x86)\Winamp\nxlite.dll

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Program Files (x86)\Winamp\paths.ini

Filesize
30B

MD5
8ad85a252352aa655f18d1b9300667b1

SHA1
5d2939f3b6c29739303f2caa4560d1f5376309c6

SHA256
fb7293e289aa918d2cbc3c362cea48dd061b0e12616924460466f26df28ff05c

SHA512
aa3c14551846a2a89b7c4ecbb9ac63e3c83501de5e088634c77e92ffd068a0aa547ad5c0d06890b553469013ff0de0dfe2058de86677966ace9c4d0b8c7b5525

Download Submit
C:\Program Files (x86)\Winamp\tataki.dll

Filesize
86KB

MD5
54784a40c6e296df888635fafdc199c3

SHA1
863c0ee77db87557f39762e82d305d5bdc36fc91

SHA256
081220e46b00d9d1671f15658b6a9df7504223f514b03a593e5b9c56c68f135c

SHA512
5ae6bd6fce3d6f346409624a4229ec60fba113715d4ac17fc3f72c557a0b00b51de601bc44f214e39549e29d085e9acccc8aa5bc5acbe89638f1358fdc5d69c2

Download Submit
C:\Program Files (x86)\Winamp\winamp.exe

Filesize
2.2MB

MD5
e000683011d966dd6cccf2bc3b6027c6

SHA1
7fea5c8039be8e5476c9322f14eadb9d855d1d72

SHA256
6760afda7a59a7dee557680e48a957cf1367ed04194808af61f779b7fb668850

SHA512
2dac85d626cb64b0ebc811b8d92d06503e06306df4830c562195a8116b25ae531bceedacb2b36487901454279cf4d9e328117f1133ea0fabff0a973ad7f4225f

Download Submit
C:\Program Files (x86)\Winamp\zlib.dll

Filesize
43KB

MD5
dc5f4a3ef0c9a72118882f70263a0882

SHA1
2f386dacfc412c5951698260fba10dfaf1b19ff8

SHA256
6ec25680a10a0df7ba353705a0c32b4470758390f6c9b2afef98862dff4a8779

SHA512
cfdbf20adaf1255ca73f2be15d2e6007440cee15e930d6b1ea085cf1e89e1d1bd4a67a7bfec02bff61e3abe0c5659b67c5ee28637968c9e0dfc5304e5a741652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
a593ca599b5af9d0953fb8ae6d75da71

SHA1
2525db0a664b640c7e5a755f4306b770536205f5

SHA256
95b8144225539c7f8c36f32a09a2ad0ecea7be1ad3ed1abc553a693a0ca6b7ff

SHA512
5b891e31e8394a392288965f383d8078b71806f49570cdac0fb59342a128c45cc397d696f3ab6051c2dec6c51e23bfe1f09cc344a039f9d05750fe5d271d66d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
e925bd251f0a092e0010ccf2ba2a5db9

SHA1
e2af25cc358480498d75ac5fafa646328a61de9e

SHA256
e8624b207e8b5f6e10960f91d39696f65236310ca184e94b5ed34ded291384b7

SHA512
5160c56634afbe2a1d88ed7e3d1d321f03ecd21d915d9aba21383360ba75adb3cad9f001a9fa58d89a2c4f70ddf782d99355a652d7582be93e084bf8836a5ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\auth.lng

Filesize
11KB

MD5
bcca2e48c48f639b0fdaaeee33fc25bd

SHA1
d1ebfb4d6c35d20f0768c4e3018e4f69d629473d

SHA256
5cf9580a01bf71bfebc11398fbb026f1cf0841d7c76d8fdbbf13cf44490c97b6

SHA512
4b5d4428c68652fa94bebae884c7ee83357404053f768c7134ce2c52dac380d5e65f080c559938f45af616030a0c4c8f8979fe029f8509c3c76d6671b745cb1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\burnlib.lng

Filesize
66KB

MD5
e95ed72d9400f332d4edc536345e05b3

SHA1
b2347885ce40c6b033ff407ca241dfab3694fb7d

SHA256
22a05ddef15ede4a85a8599d1176502be1263f774b3d9670ed94c901009e2b07

SHA512
b3544ec9a90b63fe10c139e5b85dd288941420e66d79a633f5d945c4a8902dea07085021940083efedaa2496a5b7c298b8bc557bd5af5f5dc9c034681353e53c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\dsp_sc.lng

Filesize
26KB

MD5
a3037c1ff7dae9d18e2fcbd3a5a06743

SHA1
ce601a2286286c11dcc74a173c09bc0fa1fa2297

SHA256
9d21b5bdd3a400b4b2ffed87a696c85263ec9313e789afc96a760fc5499bec10

SHA512
ec70ad6838daf47137f65d40283409c021823e42cdae0b8d5398b5892131d6037fa22cea661ad0dd312ff96f5461c5b6b9046afed1f2fb8b52e7a1c4ec866dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\dsp_sps.lng

Filesize
13KB

MD5
517176fac173c5726233a40c118b6891

SHA1
0b2b2ec1c042813cc8b7696dab013258c794ddc1

SHA256
22329de40fda8b27190ed15049678813c0639d75fa6ca32b3254371691beee26

SHA512
712c67fc3797612316ffaa36137fe1dc6cc912da7504abfa8075c71129e25eb5c8d50fd625db42702601f1e3018a970f77da95de091527f628372382dec46ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\enc_aacplus.lng

Filesize
10KB

MD5
2ef4b31b3441940c0a405f867999a0a4

SHA1
58d95fb13e179b161fe2487b052a91e3b8634d31

SHA256
86fbca874d3efa38920bc5df15b6ba05b801bcc4898565a8228ebbd33dfef507

SHA512
3d3d8c9fdeec552a04a50e682d26133442de2f173b932a53550cb13bef086f0aed323bad23b154d0986a2fba6772aa4a083d7c5452e9f52b7f3bd6ae4219b9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\enc_fhgaac.lng

Filesize
20KB

MD5
38d54a740eee05de54c0eb70e960789c

SHA1
35f8710648a50dfbe95e5b1f3044ade3f15a5997

SHA256
55388222098696772c29a13c53620f4be042e2996a4cd11bd70edd39294b53d8

SHA512
886013b9eee35885fb79ba0e9f0bf3ecebb791eed24423d42e8fc62513ac4bc77a43f588c9f9ba08aacc0d3697b1a0e8cd82ce8b1fc107ef2b4e5e421c4c2a80

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\enc_flac.lng

Filesize
4KB

MD5
4b0c5110f7d3bc4a49d8b7e52c974e46

SHA1
a9f45f6ede51297e5a3843d4570fb18e0c4d1ca6

SHA256
8a11867c20fb0d98d5a21108e2673346a997d3bfeb11fd6f5638d705477110ea

SHA512
de66aab21cb51f18c8febd4189e28ad22d6cd98d34bf260eb562c4befaa7c006b0d63e6fcaf9947ea33e0688eb2f60d33e5b29d3cb66aa48841846bdefd7a94a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\enc_lame.lng

Filesize
5KB

MD5
85217d537a8a8795a78659042c13f8d5

SHA1
2bbd20f7b89ff2536cee1e843e9309e04f93c352

SHA256
c858e9b535903262778e6e163ee7e27d87dc534327e3bcc627cfe68f835dc44d

SHA512
7664ce70bec38c728c5ab6b2005d0fbb649e1f3be409730d6e32d4b2e6f7a42a16a5e3d9e1fa55000326bd26c04400fbc13a61df88f2027679a55d8b03cae5e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\enc_vorbis.lng

Filesize
4KB

MD5
7028d63caedfb6eb3b3b9286cfc14546

SHA1
8507c10ef669dcbfda85440e5515b2be38363878

SHA256
9cb8b822a9536771be79980b41d84b22166964728ad620daa39141fc934ffafc

SHA512
7ff3282aaf6eb59f2f5a86aa9c37bbbb14c0590cec09adf63ac539884d5e4bcfc8c4f825a00ac10056a7f411b8ad301b067a460c1de900e86963180db58062cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\enc_wav.lng

Filesize
4KB

MD5
4a1763a8b5c0d03468c47269f7c0d143

SHA1
f870dc39fd64c27295ee539318d8ae76bcb6dc22

SHA256
433f42a30571fb50aa76a7f140820c924839d23daec3b0d0c33a4e94163d4f81

SHA512
3350aaeac54d435a6ab3a10f25756c12188d662a3d74a697656ad2ce59b17dfdfc2044d87b3426a96cca4286d177eed7c3f7185eec4d4eff2fe0601d95df7ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\enc_wma.lng

Filesize
6KB

MD5
09dfd067cbbf19ea0b58e513e9d4a8be

SHA1
18c01a365a72f8f2e159dd68d0c14f0b376e4553

SHA256
e96258e7e04602326c0e461cee3d2c7f71c6db8259c542f2ae557b613d6d0256

SHA512
8950c1f24a3de08a91ba37499d161babf27f6051be95ab552d83292c74212b8603c55534efba9416749c0882a165182c864d1583c1655ce30e93543fc507ff5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Bento\window\menu_file.png

Filesize
168B

MD5
3c301faa63c0d6741738575b59ce1bd1

SHA1
02593f8994170378ea4383d8089285986318e509

SHA256
4096d255d7eddeeaad8508b58166a8e10d17186a64cd3f8555b5b194be37cd00

SHA512
125065eb97fa2eb48c5786e54da6a970c1c914b1481bc4c3f60ad156afcc618a19ef4e192b4c3e519219a74f53f5e921fe5df13cdb08499afe4fe1366c354507

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Bento\window\menu_help.png

Filesize
162B

MD5
e3c3cd7e3ed7e2d369f3f733943500ed

SHA1
c269f322a4fd410a07f235e4c2e69013837ca922

SHA256
dfa6f01a78de385c1363c0da0637ea88034d2fe562837df208fe65caec33ddb0

SHA512
e107351d5a09e0d979738fc5696eddb24c9f400ff6866ff7659469630385844ccd75feed520d3533ce3ec15d8dec31458df4a9bf81c0be1f8077dc2fde9ce231

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Bento\window\menu_options.png

Filesize
168B

MD5
7573dd824b5c8763228c407a15100367

SHA1
d566d103de9fb324970ddf253d977063ebd20a05

SHA256
729833ec1a3fe3970dc82474f7d8e44004f979231cec71a5f09a29f5fc383c04

SHA512
4a4e1989affaf0af66da1ad0b008ba185f9dda850874f748469beffe1ef67192e45156eb45e8e6734f660d63bd83320e171417b772eac03d518ecc662b251b19

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Bento\window\menu_play.png

Filesize
181B

MD5
6058d77628f9aeec2c00a45a3c54be93

SHA1
b38e41f3cf3e0a0437e7c770971d5941b130fb20

SHA256
a4b09144d48510c12c1275be451ba7861814b33c766ba59a145e95cf9b557a38

SHA512
d461a41cf57c82ee26960eae6cee52770ef419d2f660fc62ad8830b4aae8ffe97f02f3274ec0283ea63319515c9a3779ad6e2962ec642e908c2e77d4b57a697b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Bento\window\menu_view.png

Filesize
140B

MD5
3e65444a3b4758e61243ca644083c2d9

SHA1
862580983b35317975c4d4e1276437582564893e

SHA256
eea160bd99af15a1e08e501c597c639d230fe9bf46c474cbf7bf9672b7e2f09e

SHA512
a227256c17b9a2073a3f21381ea68d6ed3352e78da2a0c276455f6a37c442d0f75b741901195ef2b7118854903144a81ad4bc9e8ae13ad17dfcacdc0f7fedc83

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Big Bento\window\songinfo.png

Filesize
829B

MD5
67fe882648eb3ab4d12bbafeb922406f

SHA1
5dd872fad2dc7bc4baa116f1c7bab13b5e1f7aad

SHA256
fed49bbae92a1cdc9799fdec0898848f4691f7b48724a1bec7a697fde4b2a12c

SHA512
c21e3147a1ac725b10e504537d2c8670cd279936af5d4ac183068cff47bb76a1e7179a682d852b383fbae19929b732da2de49dc24f1aac6526e5dca460df7dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Stringtable.xml

Filesize
2KB

MD5
5e28dc40160344145a43cf34b181b273

SHA1
989cbe82b7c26e53b1f8d388820dd147491d7a3a

SHA256
6bb5a8d5e219b0898d01635d319a9ffe6a92155daf3f97196e489c200f6c48ae

SHA512
e789537ca3d9bfcc9d863a994f8568514dfc849d7f599d5991cb47568245fcff2e9bdf41b0d22818bfe128fdcb5ce7e2426bd6738554969b6e50bc02627a191e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\freeform\Wasabi.xml

Filesize
87KB

MD5
dd7f5b9724e01f1a76e1c0e994bdad99

SHA1
ddfccac74b11e0178d5d49336f06dd7ab7a86ffb

SHA256
66ded03afb81bcd243144c7ed659a6c2f8c8912f774a6e5b53588905714e3675

SHA512
6a1053c2a81eed6c0edffa3e4302da245de637a3ee623926cccff0bb40e85889e0757a190e44dc116ee203860c4a4d70acc07ef494a570dd2827e848b86759fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_classicart.lng

Filesize
23KB

MD5
e308ee0c34f3fd4817a358c8388fc1fe

SHA1
3250bcdba5883166ec07ce744c6c1d57ab65fa2a

SHA256
ea483db3d6ebf1e9e86afe5e87f1ef0452d953cc39d92b941e416a526254fb3d

SHA512
d500021be978a142dbf668ef6a9d1ea0534c51a0ba1909bc87257a46d66403017517e63ca56c7e92731a0bf9b0694011cf4a6e7e316d574557de289474de0f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_crasher.lng

Filesize
7KB

MD5
aa08733fa0aa27895410d5fe74ae43c5

SHA1
28206bb3b0db69aab3646d48484a43bbb5fef01b

SHA256
e6cf87e6a0992784454fc012f5ef599a41451307093e38099f4bdfd0eee4360a

SHA512
c89c562d7a43d2938cbdc93535b8ccaae9e915451b32224552908b566900adc2643fe77e49e03b3dde53064d39283c89c97a71ef3c30df7b024a76a4fda121aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_ff.lng

Filesize
23KB

MD5
d04c20715da3283fe12fa5e6719572e7

SHA1
3731c4b50cde7a5fd5e9082805d96abd8f369910

SHA256
ceb73f97f0500471adf8c2f0a31dc4b45e0bbfc268774f363871853e247ff414

SHA512
0c0fb06d74c2afafc833387971b6fa4728b1bf5ffc1c0744a06b13405cdb9d245b487a422307a89d630f61020555cd30aeaa53c927765950de9b3d5930e0f02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_hotkeys.lng

Filesize
11KB

MD5
d1f864cd1d12554433beafe39d92cb6d

SHA1
fb4878408b7adaeabec11abd6e4ecafe62fe7d8e

SHA256
0a6a664e67d5ce4b37922128ac25f58877608e223a953fa3c14de7f2713e782c

SHA512
aae9137055eb752dea446c4bf81164790377a9db1fc42159b3f5df402408c711f553b7067e9a696287cafbedc1813815d942d04eb761fd5be07260dfc4d365c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_jumpex.lng

Filesize
41KB

MD5
f63f9d9ea1a52e25804d9d2321f676c2

SHA1
712c114e77a06848d459daad326b5fe698103019

SHA256
60383c8bd445fce307c616cb0ed0332a3677cddd4e83bcaf1985634d0ed4ac92

SHA512
a7aa7edab767d68d72b6fa29f0340ca23a043b6ada26296b5c7537a01cc2b846b58962a8da4d1a63822f12b98657e2d3e42bf2302e4c112bb109a9b778586c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_ml.lng

Filesize
22KB

MD5
bc4c95854db2f868be6c0ed827ee9401

SHA1
903126c465a0e3492f4fc1f9bc624630c6b08776

SHA256
038262a56e9f4c3047e0359cbafb38fee0e88a878cf7bfd4d782d0be97841929

SHA512
bf4a23be8543e3a125dded39bb1027a97829ccb438ca0ff9a3d112522eb3f7812a910b0a3089051afac7fa85e001a5204777ba0f54496f67f6ed32820ebef3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_nopro.lng

Filesize
9KB

MD5
ebf3d8df7d4a159c738bb86682222db1

SHA1
23557fe5284418d2ad68e52a328821aec8341501

SHA256
e6903b11efe3e90573aede6a4a58df531b5682feed4f1a2daff79ec9289753fd

SHA512
e40cf3241f4bea317a4df882eb056a5770431b75d9f7ab7b9a8d186a353d3b9c28452b79bd0dbb34665b2df8ab64330a61543b6b71f72795dfc08a395567e6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_skinmanager.lng

Filesize
11KB

MD5
17867f1e74a74ad8ed2b05b1f6bd44b8

SHA1
011ef3e45b68b22cca775cd8905473c4685db9bf

SHA256
69f1d7868afa86ba9f52751690e6b2a9e726734fd226e5525548b496de9da296

SHA512
1743a1e0f5a59bbf0a43d94575b8bd49c23bc13efe8dd5bfb2caa21c182cf936e4cfd5d24fac2709af0dfab28a2fdba6a4341e0b550a56852ddfb9c54521c39e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_timerestore.lng

Filesize
10KB

MD5
9e232130760c1639afed3ff166e03159

SHA1
1c5153e9e8ea817cff046f92fe9d8e0453fb9d7a

SHA256
ecf275a934a48629548900b99b8f26b9026a6bee2e98c36714c137babf4f081d

SHA512
b9b1c1df9acd342b32c328dc6f0d51b681e729de248d9deb7c9b7160f479335b4d9d8a73f71666fcb91e3dd94c4d1b155cb15dfdd19a0210cb92479cd2cc5bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_tray.lng

Filesize
7KB

MD5
e28388eaf5db6a6fe38191c31d9193d4

SHA1
ad9defecccaecea2c88c400e237a1f512aa44539

SHA256
4b8aae02b7776e33e3d475fd196d3abecb23a1a5c102a8348af2716d914f7da3

SHA512
76400537a595d6f9d873b7fcfbfe865ce0da1bc7f6d6a1261f299ed2db9a4c0ce50a2b8e1b7f400f7e7045638239d17f4d9d83be4900095a625243d26f826a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\gen_undo.lng

Filesize
10KB

MD5
20ae34aa46fda21871c312d47dc2162b

SHA1
965a237817fa5727b260c6873eb7e30ba1b15e09

SHA256
cd85abc7077df57e65910cf9d8c36830500591c5b9c2da37cf2e3036ae9f05af

SHA512
28e3f5305f4a2f268000a42f6756da7848c6703aa5bad844daf733889934ca8f40578f27cf773b5440a6c0d8bb3a657f3aa96c91833be210203d944d0a426c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_avi.lng

Filesize
5KB

MD5
927f9f7ebbb2d46f9202ca13a2e43673

SHA1
c418a41d9b9fade85c64b5e24076b00753088a70

SHA256
8c52fe3921e0a6061c7c3b25dd646fb90fc63330f6b571ec26eef8f405d097de

SHA512
ead8f700ef89b8fff5d4363db8803c136ab5d8f31245c1b5b380f157005445815b7971a5337884247cde41a6e9a08df80bc6cda21948e2beb91ca92efae5b76e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_cdda.lng

Filesize
13KB

MD5
8253fda7bb0e31fd61682154ab3e4cf8

SHA1
28cea34f4839e45ce0d5f8998f69fdf040019992

SHA256
3066aafe6dae5dff2f96c31b451f8e2c073c647eb484e4db04bdf1920f3f3100

SHA512
73e0bffefbf7da1bb16176d7226ccb9551cb39a4c63d77d62194003f3b332bdbbde34af64e2f055af12f7c2890327683c74c7526ceef26554f19b91a45e41311

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_dshow.lng

Filesize
7KB

MD5
8093b582b49003b079378d415ec6d423

SHA1
2f09e268fd821d4d925f5421d5287268a5602884

SHA256
fe887d78f8fa1623a13603f9c1e3686d31115a5b626e99d3881804a1f2550273

SHA512
b788cc95e4c603fd8a95bd4b3139124308f08542fd301470c8f0ca55b96724bacfb4869485ad1df92c27fbf76b06b29f4c3c12d4a5fc059bdee891a26e8ecb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_flac.lng

Filesize
6KB

MD5
f588e07641b3a020347714a1ddef4916

SHA1
bcee580e4106f7a05457c1c9758eed77fee55f65

SHA256
b6ff50cb33f48b07d59e0785548d859b5228a36f3a51e5f36817ed11d7f457ca

SHA512
471907500bb8e569a4ddf655b140c8c01b97c9381b9f0dfde75057fc7e632a3c2be9c2d4bc1b2290a3eeb377aba8678c3d6fd45a4434fdaa81f0f3c2c8bf9c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_flv.lng

Filesize
3KB

MD5
44f669ad2f7ddac1a3b724e1d8f4df7c

SHA1
4d075ad2176284b65e0217259cef3dfb34caf3ce

SHA256
85da99ca4ad41dae970767d14a5d7e0c74a4a50df04464cd3d55d43ae81efdad

SHA512
ff1e509ee63bafa4f9dd0b45af5675b54bf22adba085e6529c10cab3e9e95604c38beb009a87b9ef7f53ae83b382a1934f5d540102f97f837077178648c62102

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_linein.lng

Filesize
3KB

MD5
90e49648ecd5f5a9c5904d58a8888604

SHA1
8f3b00e178483a302bae6da54611d5b2b4ead7ac

SHA256
36b97ff5eb8dbb52e13891b1c3b6266fd0805a12620e0838c7d9e598111f71e4

SHA512
84694c7d5c1bd9ed14e43b54aa59b83f0429a7c1ca97e44104fcdddd38ff1f0de53b5b9fd89360ba871943f2935c6fb8614028ad52f0665218c850d58d73cc13

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_midi.lng

Filesize
20KB

MD5
d6eadd7a220c66869077e4ffe526e141

SHA1
5cae3a10067ec4ff65bb7d1517673a74c1d36552

SHA256
173a6cd25500afb4b1f937bd2fcfde3754dc4f017abd1ccb6192583d2ed85a0a

SHA512
f08b58cd1ab022a5e9fa6cbf2df64406f72c08d5804de68a82b69f8d2296d0b12e8d38db3a5f2f4084bb5a920e5248f3f2c3416e756dee7ae8fb1cf1c275a704

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_mkv.lng

Filesize
4KB

MD5
636de176f204743ebad252959a33eb61

SHA1
8de9f896ffad413518d2b0705d88fe73db8c80c2

SHA256
3ff02b1f961ae6afe22ce3c2b6f9e8013105f21a62436b10c0ba3205b10ea684

SHA512
8249db858bf14236dab666544a4e294e5f008f2fe9009b6ec3bc8b7c32100640d9b1017ddec8dad37a4e9a1238e1002b7daf9ada0c1b41b8280d71746fb43ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_mod.lng

Filesize
18KB

MD5
85034184b7829c9d9634eff4571d9318

SHA1
53ea4b1fcb83812a99b7369f6c936a7ca00811b2

SHA256
d3033b1b63d99fb18355376c9b032df8251be7ac817db45406c4dbb1f4168ed0

SHA512
f78dd0c50a40bd7716102258d997d07daba55f96a089c364104c0c8389748024b8930934fc56692d2611553a1ea8e66b2e5c37a4a925d36a1b4e8a8f0d90e7a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_mp3.lng

Filesize
22KB

MD5
629770c02598669649049486a49ebaa6

SHA1
0c4f538b583cbd43daf238e9dc99c31facbdd7dd

SHA256
9e5f6ce7678e0b90f3da091707ca5a91a1fc5299c0620c9ef68986991b4cf3cb

SHA512
199d188a31150b3e3623779dfba67754bc04bd2c857c553748a08ae58a2c88e09a647e108728e8445d9aecdaf5d80081338a73324448c6f2bae9d3c0881f17fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_mp4.lng

Filesize
5KB

MD5
db16b9a541e9f042f98d3d61e50fd357

SHA1
607ec3fad6eeffae51493274961302e5b541ed14

SHA256
2bbc252cee23e2391dfbc370570d683e315c73aff16eff56256cc60307d20d96

SHA512
61fdb284b8ac68e665d4078af1fc112cd32445e43cbf41e57adf2b08b9b620cf166fc399a1b70c68663c4660db2bce1ac8e569cade5ff2be3ac58c5af84dbe25

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_nsv.lng

Filesize
11KB

MD5
91b3ac73b67d669329c2dbe3c4dbe991

SHA1
73bcc956712478d5ef75ecec7d771d7be3166592

SHA256
da79291395c28730ef21bdecab19030acd2913efd4038f91b51bd149a0d68c31

SHA512
6d3a4dfeacd31b9edd2f00d8fe1a88580c3f15254a1bebb46cde1f9fc72f4d6757e36c4db031a1b966b78f22d154ea585290b2fbdff198390c01b22d10d26d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_swf.lng

Filesize
3KB

MD5
5f1b5cfbc9824cb464879ec160a60bb6

SHA1
b18e696002baebe959e9de32541b8722b510bbe7

SHA256
d9a528e3bc2cb8e156c3477eda6ae0bc1a0190b2154bcbd3f63c5277621b1d4c

SHA512
ba7f7a36eb6751de04dbcfde9f7f697725e1f9bafabbec8296e2e769091630f45fe743e1224e4e1abedb4dbe52ff0c021a6dd52a63e891764253e47c1469135d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_vorbis.lng

Filesize
11KB

MD5
48fca3872a927342fb4fcaf023881027

SHA1
241bff4cb7357be25379420e0d7b39a54ea5a8ac

SHA256
e2c31d5bd57ee13b4d045793c3ba0ab40bcad2daf59d8e2e1e532aff8f7a63de

SHA512
fe9169086b63f8683001135b58dab76de0a58f7a31f0d9d935434de93d86c0cad5885914a6c8996adddb2df43022cfad71c3f0a3e4a8c8889e2982598413eaf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_wav.lng

Filesize
6KB

MD5
bf2b94fb1b250f8275eab70670dad458

SHA1
94fe8979ce4774e69448c04112006dea2413bd42

SHA256
733f1739707743a5818d1480d51b00a6b876e9e071fe1faa9c515d45959d50fc

SHA512
a4ed0149c047db6865ad19934c8fd09442d896346d68e7600e1559e40b51e78c1731d8d37cd16852299fa1dbd13c95f73f7c2e2d1515f867aee38f8467e672a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_wave.lng

Filesize
5KB

MD5
7aee8448b822637ffe28b1e723b7857f

SHA1
a1d654487546e16320ed272bd5108c6fd7945d11

SHA256
4e0e5efeee84073a52af5ad21f6a4075d93ecf04a5b55d8acee8e7879f071c8e

SHA512
b81d5c2971d8b105d35ca8026979020ca765e036d6c9f5a1fdd91545d1ffc555b8e6474046e0f12d9e0c8f22c3aef166ef8d44ffa301e31e0345a0da330c20b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_wm.lng

Filesize
15KB

MD5
a64b7afe61e7f87082b9492da10b18e2

SHA1
f81477265f669bf010f2acc6cd3e468c9cdf65ad

SHA256
24ce1d28a76b085fc4de12d4c155bc104650f370abe1375d9b30f42678cd4fcc

SHA512
ac3579e4ed339f6f894ab358012c71429084b4b5295de4fa93b122ab55950859e0ad9358763d5a95379bfeee6b65f93c3faf943afa578427a53197b6ad45cd8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\in_wv.lng

Filesize
4KB

MD5
c26c8f36740b9d797d5ddd19295e276e

SHA1
3dcf870aa54ad29f68e1e832a701f66668e7ce38

SHA256
4ebe0d348b9f54a8e827b834695d6b8e8e8c444bf58ed3a9736a64479e035b2e

SHA512
2ca30ed760e58ed74fb363525554cd8b1d67459d5fe13deee166cbcd517a484a39b0f825ee04d6a0713b5e373927a9e144a2a0d7948d4b500c82b17db73c829e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_autotag.lng

Filesize
7KB

MD5
40689049a1ca514bf589570cd84c50aa

SHA1
5aa24d189fa377ddf33d30ff29e668036edc15a9

SHA256
f0c6f171a4bdccafaf3c647be00dbde96f163ad845f3a8de085beca2e624a4f9

SHA512
dfc03e7a03a51e8943c390c37d04835baa0e8ae6f5768816b5f866565db724ae72a9e9e7c26324337403f458a6a55e1407c6545c5c6e03c50ba74d6e7a2abf2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_bookmarks.lng

Filesize
5KB

MD5
d14d43ddeba6776b9d7d3c975e05bef9

SHA1
bcfc5a019404fd07d368d76c4b9c84862e4b0eb3

SHA256
b9f74214b17de3065a5c696b8d10be0772d64287769f8dfb2be38798d2128637

SHA512
d6e3566a98440d23a458949546b898a129203a971eb9840d8544c2569097dfe18047e10ad7667f9b9a0e230241a292a3e6ea77d6a23f8af9b947b78568f86063

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_cloud.lng

Filesize
23KB

MD5
53cc4d3dc90dee8957750ed792ce7ef6

SHA1
b9f522c599c9c59c5d99fecfbec3238dfb38a80f

SHA256
713ba66d81826e8bba64cd91ef8129c01f9988b9554f913768459c55db32b02e

SHA512
5b14c3dea891ac4a445d608796b5abec7c7e8179614a7972beef593a4b45786021f08f001b3056a6e2e83072a4564d5deb8ba16ffdafc7dfac8eb06c8d00bff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_dash.lng

Filesize
4KB

MD5
5af5a95fb495dd7bbc3deb7f0c6ba3e4

SHA1
1cc301121818517a62671e6500a07d2fe5eb2383

SHA256
6e5380bccbd0d01f67706af576289083ca9e33fc613d6b642e53930b1de6fd03

SHA512
189d565f23343edaf31f2c867348b0c7b63d09420680dc5ba1806a262ba9d529261a832b081c7b94971cd1ef56192f7726213fd62074b8bfd5e935a73d9b1203

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_devices.lng

Filesize
8KB

MD5
bf5aec9b47b25faff235915b9155dfb3

SHA1
b67a365417d62b3ad68ed993e8d03e7ba1940dd3

SHA256
942bda9d08d79da3f010c6b5fce3f97811df9124875cbc35e38dca4819784413

SHA512
6dbb52a0842a0dc0540b3da99a5c04c4af9b255fd9ae1d3c9ac6e8580a1d67ad4047237972476189c075a9988504a7fa9576fb4a6aa251b3401aa6a509637d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_disc.lng

Filesize
44KB

MD5
cdb62465b28121c54e6cf4b1763de90a

SHA1
1eccaceebc92b37da1afd6cac6cdccfec1697b6b

SHA256
49fc518171e30aa3b4cfb1152d43a99292beaa718034fce0cb0957dd91e9d3d5

SHA512
281096a34eb60c461a61b24877e1c6f3553b9805b5bcb5cc79e5d7e3613e901adec382a6eefcf707627e96adacb0dfd06035bcd89f64f65ccf1235a6364ad725

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_downloads.lng

Filesize
9KB

MD5
a67c9a68f8b151273f91b53fa9179c1b

SHA1
c2e967ec123bab6880972d6c22a051179b1f781f

SHA256
330ad0946dcd0277c9f235702a827cbf0b755c9ebd2377507faa546658afa54e

SHA512
627946238e184a439fcc5a9159055043f343b9179f1b6ed3fab7f78ebfaf2da4e703f92b2c0244246163aea93ea5f76f9d9b476e0b5ba8e5ba76eb000beca480

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_enqplay.lng

Filesize
4KB

MD5
a644c9c22910e4fce4ca65e1d8c462ac

SHA1
0f8b0a98786726c8231dff8b6e0020952d110603

SHA256
e0b87ddb435d832918c73be245b2549c502063f732e5e63ddee4c198f458510e

SHA512
44100a8854bfac473172bbefafcc9c5fd7600efec7c3ba9690774e5bb398d5bf231a5aacfc70dd2b59d3b07b40b2f5803f40f95ce52412d836610bb86095ffd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_history.lng

Filesize
10KB

MD5
4d79b6e14b664ec712c7fc9daa48d0af

SHA1
ab803ce541ce40df8f0b95547259d12068292a9a

SHA256
1e57ce3db5a7f5c3deaa4ca9fa43aa84c0bbc0eeb12ec38db01f558e5dd79630

SHA512
f122ce63f2eebe2e445e4953969c92960a234ad3d325336c5419c69332b02c9f9ff654667209648c3c1cfde17c57dc0a47238741d771fb03cfd44fe4aef6e744

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_impex.lng

Filesize
5KB

MD5
cc47c036bcf8337b6d3aa9bc337a7b9a

SHA1
0293cd9e97abe459ff58ad6eac086d9d58b01473

SHA256
134a0e51e961216b04853901e30b7116f7604cac60123c2ecb7fda52f31e58e7

SHA512
74ac3cf48acd5f18af84c5f44f56f71fb8a7480e9a0d3765544f4b2c36866fea60e583f347e9cf335051139f547c3a2d226e83e1dab65d4268db3b0f2755e574

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_local.lng

Filesize
55KB

MD5
555079bbb245f483eb4580267e1244c9

SHA1
b268b8101c8e65b7f03006e7b750e02ef7ca344f

SHA256
bc9d3a0badcc8e83612776fbf53161b5c2c14794f51e437856964ba358d2945e

SHA512
6338dde346f12020f81486e8a2894bd389e057c1bf9dd6a91e4ee58371a1d9640e4bdba0b2a0043b9290868c619a33460042ffbeb1e0cab11483d0b66280b9aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_nowplaying.lng

Filesize
3KB

MD5
3575743c9bbfb4df0c3f25374ca7deb5

SHA1
69ad447ae50d6b5713551cf0472057c82d654771

SHA256
0b2c1baeb0c6253adfc31c8b1a5fabd0c3b902ccdd7b94cae72ef2f4e4bdb894

SHA512
58fca0399ec84bac3bb3d99731b67e6fca9f29234431a54dbe91510bdef414dd78cabfffa8e37aefcddf93a5f0dcb4fe955ba4f9086690bf41d2930c5e82d6fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_online.lng

Filesize
16KB

MD5
1f19640340e7c9683ec69fc8bcc0f075

SHA1
0c5973aedd13c0f0604a55c8637418176522df48

SHA256
b599bba0c898655f9be95d10cf640bef5764e11501d003ca1bf19c18a67373c2

SHA512
513c6bbccc0df5f05175f6fc5ad9d674c8a80d91ec569ded6fcf1fcde9800628f700089d3cf01481f85e9972d8721750cdaed0fdea544a2a451c3c23b70e9efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_playlists.lng

Filesize
18KB

MD5
c9aa9240fdce3589edb7f75f9cfd0a98

SHA1
bc5412a5031aae96b893ee697d32eddfc54f5bbe

SHA256
f5a93299fb9464c0875820f46f9d301f693ff774deba8251cd0b8fbfba3da8d6

SHA512
21a78237b1a6d476ec1cf7393aba7d31eaef07bb2d22632ba88a993929416e0fb9fce73e98082534e23d2f216777d550befc02d1a3b0202ffdc8c41443a4d52e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_plg.lng

Filesize
12KB

MD5
280ebcd4837e55b42141b12db7e83430

SHA1
e7954152e241536facb8a48b672ad67d677373f6

SHA256
4968ae0a77d7f807ad26b021e16b8d0594bbddcd059c4ce95f551b58c2c1a5cd

SHA512
a49d2648edc3afa3d311c68112433b25458bdb097a407582467991bae2f923f6aa48440d26e511dbf292483458404b272bc101d00572d17e7a658f667dcfe666

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_pmp.lng

Filesize
55KB

MD5
8f359266f04abd2309bb29dd77eaba1d

SHA1
c7e5a527aa2d36740ae3c50f77de6cd981fe4d40

SHA256
9f4790bf4b4a2b056f46b8432f2f2a1899c0b46d4215e5c33c3ae12da51657f0

SHA512
f7448bd9f8620cdabbba2771bbf9d064a3f14f30dca4c611ca03da7a597df50d37c5aca06b928a2ea4a1ffd740c37757f0400e80747938f14901609264d6cbe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_rg.lng

Filesize
5KB

MD5
c085eb2d1d05a9311606c1f92e85b3f7

SHA1
dd371bd7c1d75e6991f0fb24fbb05ae1210cd97b

SHA256
75754222c4d7c38634b7620fadb69a5ab41cc8a6035a2eea290163aa314cdbc3

SHA512
e3f0e4f5a1006ba53880217f025577bce377798486cc0dd4f1e2c3c2511fc9a6066059245fe91ec8bd8b7335eec70bbb0616beab65815109d3957bf969bf0feb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_transcode.lng

Filesize
8KB

MD5
9b60503bab2f96eeaea82ca6dbca57df

SHA1
7756194710fc80c40bb7404a7644fd9c69e0a4b4

SHA256
756ff7b5e2848c7b1139ba80c0b8fecd58a5c4ec0b35a81a01c5d422c3688a28

SHA512
9da8ea184080eda25070b40d9b4a9b4fb03993853dca1ba247d48844778f56aefd8281b8d63364dd2f18aeb74b0c986e64a1b8ff59192625db0b557aac94ee8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\ml_wire.lng

Filesize
15KB

MD5
11a9475a2af7e98cfe808b20e4c5d49f

SHA1
a652c3543045248ed3246bf48721c07f3dc06e5d

SHA256
a8a33d41801bfd9dec0d03154b4401caa3a8703dca6681581f33a815d9491bc2

SHA512
c3a5d9d8977dff5da8417657199ca935d4e45e599b3b1db60b8f86c3c3b728e163f5b79aa02a8f4cf845ac5d5263ddf16b76dc4515a883b90efca74a76147319

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\out_disk.lng

Filesize
6KB

MD5
7ba9877238cbaa098e3ab07bc4b71596

SHA1
43805882dd5f306e08b506b68631aaf7755c70e4

SHA256
cbd30cdc1d43cb24f7dd3c269883e4a5e21bd03a39f6beb8fc53fb2db6681478

SHA512
0448a55187af043d0a81d6970162ba46fdd54accd9646474d176b5e9ff70609f1f49ac19a6f89f1a118e02a930654454e2f6dc7441a5cc8a3b38256385ddf8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\out_ds.lng

Filesize
16KB

MD5
e4db65d06d63fe74e5a1d433dc428261

SHA1
99ec61d9ad91e1f065849d5453a895dee9a9b971

SHA256
cca5e6aa6992372d9561a1293a515a989aa47760cad5a9057b1cefbf93737e4c

SHA512
80323b86ccdfab62c4cafff6e7abfdd033489f3eb98db16d6eda044c7e5e689998e72c01cb78d550d455ed934ef6ef69e81ff55844940b74011481f5b606b012

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\out_wave.lng

Filesize
7KB

MD5
df84f69a00f7b5b6a4af70bdfb69291e

SHA1
4b2902d612e2ca7cffe721c6239ae18e7e3efc60

SHA256
a9b44648bb43ee53baf8accf95dd821eac702512bf568f52e70e02eb8f300d39

SHA512
6c65fa2cf9abe2a6e67db9cd155e9775c3a7b99de409dfc78a268b62e95e77ac0577401d9f4c32249fc996fe105d03d87b8d810d794454637e4f8f55d44b96e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\playlist.lng

Filesize
4KB

MD5
cfefa74a2763cece869d65904e9da79b

SHA1
30585df25a88bd1a6a7073ba39e3fbcd199caa96

SHA256
207a769e185eced2904bed7c5678a757c1a2059129dab0ded2742a1434be5b32

SHA512
86466d3117ce6d013ba0a643bd5da758c32cbc27229b6a67a61ab5021e48c63204bd992ad593b2307d342e4adf833ec4a42e467d36541bded86ad6e3fbd6145a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_activesync.lng

Filesize
4KB

MD5
8cf7377555a9172274d09fe291c8003a

SHA1
add87ad31d5f46e8faf8ab40f7128be0ce0b2ca3

SHA256
9249af6cb578238c1ab7f2cdf4b676e1192f2f3e7541bf9aabfbf3fe10553faf

SHA512
b977fb00d1266aebcf444a7b19e34cc519ebec8bc8cf593a912d3a9cdec759e133590d4a5e307036e3ae80db2da9336651920640ceaac6876a236d5873a0a167

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_android.lng

Filesize
19KB

MD5
91e06eec26bf53f4168e8f928ca2d561

SHA1
aff83614a2ee4afde4906034e906b9127a99982c

SHA256
77bd98920c02969917bcd7d610268a0d9be89450d9f1cfcac0881f8b4b24e589

SHA512
aa4611477d61cfae348138d0aff8d669b452ad38cbc0912ace5dc58833cf9c4b3b316d81640dd69e85fa13c24d2d6a8038f3014c1e12dd4a4cc3b8d76519f39f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_cloud.lng

Filesize
7KB

MD5
ce47915aa5775047ba47424185ae2a96

SHA1
ad46dfa3b4c7baf4b0b6e29fb85ab0a0e8afb6f1

SHA256
3f6978437457198e095a3b06af9a4e0d1c86b11e2b74d261df68c64946eb5be2

SHA512
5a2deac83705bc29776a5a9bec281910345af35d41fac79aab1a38b29925e79f1e53c934b36e7b324f03000af309fe08acd3ce9ba4363ea8d5270890a3219c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_ipod.lng

Filesize
6KB

MD5
36b12f30c39570fe1b3e61fb3350613f

SHA1
68518b838dae3df8677feac98eaf0223d311fa78

SHA256
02a8080457435db571f200577c02ef85c1fd3103309330c6450b2fd64e6645b5

SHA512
e1042f377df8bf65be63da4a9703093bc7fc95438e5a4e8591273c649ada8946492d94b500e1a85717aa1441932a7e60d56b21399e0971635aad4d0bae37204e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_njb.lng

Filesize
3KB

MD5
f4968ca0ee522724b5c69070773ec83c

SHA1
a3054b8ae98d9791e6c8780a9724a776f3f86407

SHA256
a6a42a509fe8c199c846928cf7e69a993d520a377f9191bd46ee7dfc5e9d7e72

SHA512
822f8b4ae32d5623bcd3d0bcbb6bffdabb16e2ef71ef2acf668a5f809e704bfa0606bc7518e0ec654855a4db3e9df4e916106e8f97fad69555165aab4e42a0e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_p4s.lng

Filesize
4KB

MD5
8a42821f934981b35d9ee65a9ba948b6

SHA1
7fc4c34d3ebe1734da343ce863e8ad5c49037ee1

SHA256
40649a9168b490ff6dd80f6a7a6b2d7a7c22e03f7bd26dd565c75b285a06bfe1

SHA512
5db26f2017ec18fcc728101f9250cd0a5c3323a11ea2a7837718b0f373eb78a81aa5dbfb2615defcfc9ca9ad70c0ae69cc4d854bffbf06744379d206e26c821e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_usb.lng

Filesize
10KB

MD5
7f85f5fae3035d77f1c827877c0838d6

SHA1
2839199b37a86694ea5b96331bcdf16c41fd5f43

SHA256
060307b367ed6e2bae8a5a497ca007e9edca7169852c74a3c768016733c9a962

SHA512
7ddfac8db0b7d48fd5f297acd50e40a24da4792216582abb5beb987b21e4104e7ddd1ea04b9883d03c2b03b8ac304e6e7841cde60b892c69eb3a122dab9adb48

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\pmp_wifi.lng

Filesize
44KB

MD5
3f8448696b7f2a3c00c533fc7fa29ec6

SHA1
33c085e4c90ac9ea75d20609c7702ddc1cf06ae2

SHA256
9d6bb526c4c88a1ab551d08284c5eb1c0b0dd5c0c3bd4c3282fe6a97f574a197

SHA512
1fc073ac6d8de4d61cd4bdddb5057c0bbb1634dcdb500bc60fe17122107bdb98119dcf80ebb4208255f7271f832228c621512077a81956c8a114507a409ddd09

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\tagz.lng

Filesize
6KB

MD5
1cbcacfdaaa8b9f0241698ee3df839c5

SHA1
84ffc3cb9b951be12f460144a93f033acb4e0cab

SHA256
e8e33514db7dbd4a9c4f6849e639121f5e2bbe1ff5152d864730fe2df5c5c47f

SHA512
eec20add816196c0889d8cc62b7eaf7bf7f4e5ce5d4bde280be5a040e1af272d93ca9222b989201b084786d19b7bfc99b31585e0f628156708ccc7eeee015b14

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\vis_avs.lng

Filesize
86KB

MD5
0a589bb097f02fdb7c16ea2ba5f95ece

SHA1
52e3caf36fc579ad4274ac78521c9a30c56eacb4

SHA256
caebba84c6a3659a1130c8c267bb301c67329cbc8f1ae4b07d10263a6d03f4c6

SHA512
f591179cac0e3737c7bdf1c055aa183dc61502f18477c83e416e6df2d240de7d099897b5a8a7debc29e7ab03ff50ebd21bff43c85fbd32f934f1d80b55035dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\vis_milk2.lng

Filesize
150KB

MD5
d6a0ebd6d81c729faa64211a32b68442

SHA1
033a92c29bffa3f9b5bdcf5b2c59332e7f65fe79

SHA256
d4b426bd80cce6c07f0bc9c2f96a1e3826d9ec5a06fdad745ae82bc5c0699784

SHA512
0bd489ff88c809468d03794ab776e73d6d8e9a0d205332435d829829bd331c11fb5c0c339c95adda9371fe5738876f1f688943e258c400c673043c74e043444c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\vis_nsfs.lng

Filesize
7KB

MD5
48acd10d2552f6ae1f5fe579d5610f1d

SHA1
49c7a1a71ccd1d549533d3f45a6b236eb9231695

SHA256
f20f8cac87b1ae1e6e3f61995e3c52d8c5fb490a0d6cad5cb53546a0df14fec6

SHA512
47c3745df71dc834541aa34c3dc3dd4f9c9d6669326363fd3aaa6817fe64eff6d32d5894aebd231f7310bf40cbc818b16587fb689d882c12f9269df8aca9ec10

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\winamp.lng

Filesize
181KB

MD5
42f5ecd23302ec6e8d6d4fe1a7a9b3c2

SHA1
44fc5cf9e36369839815ad2ab35578b315688dc3

SHA256
505238597b21baff9c8c518de5d7a113debad6b578172119574568ede432dadd

SHA512
2a230ac9ff65ca984561cea90a3aaf824cfc86e5d30028da1019ae99325bbdf891b7babce38148313748fd403a8b353ba9db6166953df08042d937e56a196b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES5DA2.tmp\winampa.lng

Filesize
4KB

MD5
47790ba12d5cf9e27ae297bac96040eb

SHA1
cf98781225c209811f26e347ff24a86a8c1d5124

SHA256
1e9931906d666b0bbce6c6c43cad71cc68e2c90ed2774efda50e729f0858d347

SHA512
03aeba52a383aa3752b28eecab79a31fed159c6a79345d081d5d67f270e8195500eb1485bfa138d263cb8d491d043ae9a8c6e79c56c7f6cb69150e77dab66bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WES7683.tmp\ombrowser.lng

Filesize
10KB

MD5
01891b473049ce79da02069c94bcf13b

SHA1
0409c3a0e83934fccc66bb3f145f5b19d1259db9

SHA256
7b46de4ace361780527e799e6338405a2abfe21b74174dc739a19d1b11e69615

SHA512
173efed2cca628a7a5f8731bea502ff53eb4420daa81848cbcfa097f62c451f3857364a010282515ca3466ca25fa3f6840d79058facd3a61676e0e7397701cd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WESA41B.tmp\freeform\Bento\window\config.png

Filesize
11KB

MD5
f1cb9b4927d7422dc92ca75a7487c9d1

SHA1
4b4b301ac4394a9afd99a98df671727e9e12fe9a

SHA256
f4a4cf784832613510f0b6c8f5831cac69351a17930e959dc04b2968c5415390

SHA512
5734ef04809780ccfab5f3806248ae01ba95db617f76b1f88fd4862e201cbd443b0546f029af469059236510596bf28f9536f04ad7aa0c77db94782fc7a2967d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WESA41B.tmp\freeform\Bento\window\controls.png

Filesize
5KB

MD5
890ba0f2b3b82d18a837d6c04a3e3781

SHA1
829d6ce0dd579a48fc28b0a72466f8c3180e257f

SHA256
f46c5cf893eb7dc6a59ebcf50f00d8de08df597fcb90ae4dfb7aeed96e27133e

SHA512
d229a06e97e556b08371d58975527f390ece15fd310858631db59244604e4684309de7e17883e89967d8d114d26ef5a5d689ea4d2d42793e259592ad703ec716

Download Submit
C:\Users\Admin\AppData\Local\Temp\WESA41B.tmp\freeform\Bento\window\window.png

Filesize
1KB

MD5
2a41e2f14321a33f140866d4652364a5

SHA1
0ad60c4850839047468f8d0be57f24bcb176bdec

SHA256
7b3708a4648cd960008c979a2e6c3c3c06cccb9a449c4e046967c9d27b42f84b

SHA512
332a2f89bf817a402b1d0963022e67c64aa7d08ee9892e1e6a329ea77d07c725c85c6fcff7c799b3c31c74c223f94d64d18883cf9317509c3dde8b33722476ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\WESA41B.tmp\freeform\xml\xui\browser\browser.png

Filesize
20KB

MD5
8b0fd638e2f340216aaa7986dab91a68

SHA1
6284bf8edbf03fa8fefeeaf0221e98f295ba856a

SHA256
b28dd330275a8d3cca8ef0492e64f9bbd638402647ef33de539ac7876e4dd124

SHA512
1abcfb23e187e27ebd4bf0365ef5392ad1af93d232803f43a2dcfbe7499955c58f2bcda6e66194b057612cd13f915399b6113c67dac294b7a1251e34cdfc40c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WT6226.tmp

Filesize
1012KB

MD5
fa3228aadde0db988e1822c2f736c131

SHA1
66154062e9902d6664f9855bfc04138e8b0c7c53

SHA256
c9b76220a5be42ead4733611e417cd65c5fd8aeaa33eb56576ac378a37d130a1

SHA512
c74e4d5c6f1993071650ec3fb382470fee4e428904d8e162e9edcf28327390295a48fe35d5149e1bb61d637216f401a80eb7b1381bf1187dbb6a3b0d3571a920

Download Submit
C:\Users\Admin\AppData\Local\Temp\WT62C3.tmp

Filesize
917KB

MD5
013ec165105a40eb43bc1130d530bd1f

SHA1
f13912f8c9abd51339c48b11bd8291e3ecc97584

SHA256
b890858df485549d20fcb0a2c519dffe9c5c155d16b55e0b9252d6e66db555e5

SHA512
d9cc43dbebf7d5b42bfbb7a64e8ad40e5bdf76e67a313713a576bacf0da5758c7a17d8ab392cae44d2cc3d3fa13078b749e4e2ce59250b3bb93d578156f71c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\Dialer.dll

Filesize
3KB

MD5
61b40a89c8b94ad6355262e118c8420c

SHA1
6b8fcae8baf661e115763cec2d69db7a6b767030

SHA256
4e63d7b877a7e8889b6cd7bebc1dec767bff0f5bd41d8936d4a5b29d934ea4c5

SHA512
77f7e3cdd2f2ec3a2cf619afec6438e0966a2f0d43539d62e9cd8e2acce56322e2dfa2f747937c3d62346640fb64e1176b52a329027a5a0569e0f05ceeb7a126

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\LangDLL.dll

Filesize
5KB

MD5
a1cd3f159ef78d9ace162f067b544fd9

SHA1
72671fdf4bfeeb99b392685bf01081b4a0b3ae66

SHA256
47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6

SHA512
ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\NSISdl.dll

Filesize
15KB

MD5
7caaf58a526da33c24cbe122e7839693

SHA1
7687112cb6593947226f8a8319d6e2d0cdef3b11

SHA256
19debdc4c0b6f5dc9582bda7a2c1146516f683e8d741190e6d4b81ad10b33f61

SHA512
aafd0cb2abb3d2dee95c2d037a6a1a5bff0518e3210ced0c39e6d6696e4fab4734df01476fe9dcb208f02c529cd03346bc8b7f3319ae49701bbf2cb453d59bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\px.dll

Filesize
682KB

MD5
dbb66b386c194a58e29e49d7ebbebe65

SHA1
78dced6be8870938a2c8fefb1b5b884159e5fb21

SHA256
309a40e28271eee4e41cdb5cd1f83c0087702d42f9fc3a87d62f9f30dd53d68d

SHA512
6a49783c86f2bdb6cb522f0e53a6e653eccb89b1a2d0d800bfae499d304cad173f621d9dad7765a13848a1e8bc4da355d94fc1a4bbf2beb5c4d999ea79257764

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxafs.dll

Filesize
130KB

MD5
e66569100ada3821d49be51109fa111c

SHA1
da0d6e0d9073b7d384e410916ae0306e16eee23a

SHA256
b7c5e5cdb6bf6fc01d1823b6aa1b0fef62f1e594886e2797a00a03809589c0f4

SHA512
981128e378ff2c286ad0aa9ca0012fc72cace283b0bbe4bb21ec7429735ef0b4438a6c6ff8dd3ac11438e25af33162f320a085223d6fcc41f5a7b060d88efb8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxcpya64.exe

Filesize
66KB

MD5
08d51e037f487f9ca9fd0b0388f4c15a

SHA1
67188d670673a5e9185616923d1b1a8aa22ad8bc

SHA256
fbaa0fd8dae9bde80bfe497dca28c6fc9174c14b12ab93e3942fffa04e3db3cf

SHA512
a40bb551fa8a705a5ac2bdc02a17ebba1c6c70f9ffce38c668b07bc538dc4461658b0bf220e26aa1833f624009f417f05c44aa0ff81af59a5ada4f97dd99013d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxcpyi64.exe

Filesize
120KB

MD5
50a76d2d5e4be94556326c4bf748c758

SHA1
dd2188e2fde11b75fa73003bf7502515182d4c88

SHA256
1c0e698d620f3703f940baccbfecd883b5f5e46d2436f0c17cb0c6c99155a4ec

SHA512
f60decd858d2dce3d7d57f53e7a2f7f1090d2d5fffbb1abcfd37c67718ecc2c92bfd45a208a2ec93efa5e8fa9c33f29e84bc52891998195dda237d6f1ea971a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxdrv.dll

Filesize
558KB

MD5
8f6f3aa814143099b431744b16845664

SHA1
67f518591a1cbb954a031cc7421faa1aeb25651a

SHA256
7c9449c2e774087305a28117e47fa48bbf33638144e9694f20d20fb15065ac9f

SHA512
5fdd908862dcabc37a794d0f7fe134e6df9f34d0e52cc69a535c37872a4f2edb44e2448654b3832a11f41fd57be36f1ad0f863603d1f268f99c6180a3a48bcb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxhpinst.exe

Filesize
70KB

MD5
d2728a10ccd2a675638b016d47b1c254

SHA1
9311a83a94d7b5694109e0e9694eada76765caa1

SHA256
8ca37574a79fffe781375955362eca8ba4511593dce6672590be8c42a775f146

SHA512
a6a31019f560b69935f5873fabe192b5899785544b9cf3841c1a846740edc56b3ba5f396d43d104f51acfd59faa97121f104abf7e4ac4a3fef5539cbd85a9759

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxinsa64.exe

Filesize
66KB

MD5
6d3630b7f27b3643fde05d1088f84f2f

SHA1
be742991eac9c6c8b0674c4be1fbddd10f7b9d37

SHA256
573d87feddc84eba6b3450bf00ad7ddf498ca99cc8809359fa9bb60c7ac76f68

SHA512
48a218a270357d3513596d92410bc865ef51c3bda6bfe5f53251e2ca3a5ff6edb31d722ee50d6b85d4e3bc7094b956180bed88575eac226236b55d81e0528ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxinsi64.exe

Filesize
123KB

MD5
94f95be2a44c8291132d314582f141f8

SHA1
d5bb1a7519221964497560b579bb5c1f1ab30aef

SHA256
df83d7cb34c59e1406fb5bf1edd083f8bca649db97979c6debc3d3ab0e36b980

SHA512
4a726c8431d9722f1213659e3cf150cda5a0850bb874f0f7c4c280f6805a122d14882531e06b11cbcd36d8a9a741a67f12b46dd02933d00c65ad1e255e1ca1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxmas.dll

Filesize
214KB

MD5
746833260d2123ebb46ff44afcb8103c

SHA1
54275329dbc8caafb8a4a61198cdaa0986756ee3

SHA256
6cc2fc325653f7fc8725808270792921423c7dffba4f4e5bfdf5d396f89c2d97

SHA512
a2a577a39ece8b3b1407b528b17a3088179bc5eec3e1a9b14270529f82f6175d9c950da957bf6d707c968e4395eb55464e08778bb887b2871351f5655507252b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxsetup.exe

Filesize
70KB

MD5
4ee24c7fd67b098431c951db7686bd19

SHA1
5b14bed150ea0bf619b938ce94b9f32b02a6aadc

SHA256
0f445c4b76bc309a940d5f4ba615bef1dcefbc0d160f3a8d06e0038160d9b4af

SHA512
7853bcd7482b85ab362935060506a1b44779946e9428838a1c95cc54fcbf94058ed9c2101b5c4e3114ed125b88692ed694b394ff94ecc8d88c39b57bb21f08f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxsfs.dll

Filesize
2.0MB

MD5
e5ae8bd7d28eb4bf87f9c56daa6d3e3a

SHA1
61b841bdc9006953d504c137d5d7d8e8602fb31b

SHA256
780e084efbe74ac28d8d91dfff1e3bef97ebda3c54c7bd5c8fbbed128f21ea7b

SHA512
4930e9e128f9e8b55657752b5a8b1aa82c252dbae6ed0fc5d3112e5be85f30e6381e514e668ce5eb5dba8177583151d89707410b102d4c6466424682bcbbf0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxwave.dll

Filesize
430KB

MD5
24fa4bccc5ac82f5471abd0e3c9cb878

SHA1
9d9caf552519395fc76c7b756532032686827586

SHA256
a90d09923443c749266f65797176d70235854b9157a023362701c0d8477b78f3

SHA512
5e05daf7eb1de0baad166758304a5450750a876d4f7a521215aad279a00dfbc34a96299389dc2f523b54a73894433ce35480f559ed04d10ccbb14b1c75111914

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\pxwma.dll

Filesize
58KB

MD5
cbaa54ae75a0b8430e6bb65c72c7683d

SHA1
5fdead1d32a164426c623f5b871bea3d547801f5

SHA256
4f69dbbad8775b22d328968461c0c7ae11fe902bb949e178bf1878009705d0ed

SHA512
18b51a143af0d7d279c961143c4e3b5a42d439f59d7cd495dda174e062f3b9981363c021e474fe7901ff4651a174883f748ca98766a12f08606378cca3c4f504

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\PrimoRedist\vxblock.dll

Filesize
98KB

MD5
ba8559b1de9e06e1ebc5b41138839fff

SHA1
b2eb5557c01a3731adc3e0539b9c9ba32329f35a

SHA256
ffa5a535493c11595b1edea75e67ddd6e26e587a27d36e06a499acfa0e0a002b

SHA512
3314838685b476cdde9f9eb5be4881b29494b04b3f93a544736a2cbe0716c03cdf7f38fa14cf3e68844495a5452dd00ac1ea335fdd030556dde4715826d50fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\SHELLD~1.DLL

Filesize
4KB

MD5
9c266c2dc7eca5bcab2d8df4990e0c1f

SHA1
662da3d9ca18aacdbaef884065fbfffdfacfabfa

SHA256
ea7800b89e49e7d7214c1405b4906f366096dfadff28d0732acb90ab2e9a99bd

SHA512
e9318db79b02df6b3b72ed16c5d70e4b46bab71f31544ce0323cd6dae739be1948a9d3a468977d703576d7f33580e3be5d1d1ace1fb29cee9dfe325c6e828139

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\execDos.dll

Filesize
5KB

MD5
0deb397ca1e716bb7b15e1754e52b2ac

SHA1
fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

SHA256
720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

SHA512
507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\install.ini

Filesize
804B

MD5
3c27be217a2be2b6f63923d40ffdb1f8

SHA1
c992daf9f73e1603de62b5c3dcb2d4770eef2597

SHA256
671ebc0313d6f492d3968793237bea451b95f90bc0830f254afa77b231e03831

SHA512
fd0569df36a4301171f703dd01763eb5c060d68da1fd1495655bc5e1066e70984098b8befe11fe7f883e3d7a298652a26508432e18489ec2d09c027e4a6efe51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\install.ini

Filesize
1KB

MD5
02403f7a6d36dce2861138640d61d485

SHA1
cc7e1d868b2d71437fa5926d9350a89c5da79502

SHA256
f11f2271ae5c45c343809adaad22d278c73a13fc0155c59beb3c33bd0dbe4081

SHA512
17e16ec20946a570832ab14092e7cb56df17239341c112cb4ea5cdd2084452aed52a14d4445661d09df7fda07be7a851de74c03e8f14d3c6c92fa798190825ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\install.ini

Filesize
26B

MD5
385081d5feee87a4ed1a6e5dcee85f36

SHA1
8517162855b477e5498e95ff2e82584ef06d5c6d

SHA256
bdc6fb93206c1e7a590f2d4e97d0dab7d3badaf8b4e1a7b8487e9cf59f05eddc

SHA512
52bcb1cdae8abbe4b14ff85b57e03426d61e5cb25b1535a827af526ec66c00ae0a327b187cd10279cf18c379c912d3e478ef9966bb497a8b626824fe32d1093f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\modern-wizard.bmp

Filesize
150KB

MD5
2d63e33fa1cf672338a22c88fa45e6a0

SHA1
86c510009d6c71d05eb2707fe6a10039df525192

SHA256
7ae875cfcb6e3b1f4a06460fbda99d8014dc4674ee256b0b79ec656777c7e292

SHA512
d42a7401c1d0d77d517d2f8086286bd6cf487cf5400cd8b8d720bcaf15149727751677f444fd9a8e340072deabad51347956894c1c034dd81df793b3b8087252

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\nsDialogs.dll

Filesize
9KB

MD5
4ccc4a742d4423f2f0ed744fd9c81f63

SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc

SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\nsExec.dll

Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstC13F.tmp\nsis_winamp.dll

Filesize
4KB

MD5
1e1ded1cf1c69852f2074693459fb3b5

SHA1
81b165cae4d38a98760131989fdd8aed2c918679

SHA256
5946278545abbd0b0f5188752fe095e200c85abe0783632a00726d090c0753ec

SHA512
a6f9a43d4432658c3504629e9209ad350af69eff542d139e0ccfe0dbf8662f15034edd3cf8b56d606a740b66c8221cafad999088a4e64a4c9c9fb47793a19f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
12.3MB

MD5
76954d7dbf005d6db5e38d64f25a8c20

SHA1
054ad10803aa95f512a2c56293be7d1a287696f7

SHA256
e9e2eb114941f9f9157b4fb139e5588665fb89b709df82d4a8346ae66ccf03e1

SHA512
49e77880255470096830059bda1baf1d955f7f33659118995495aa6a6e090e32c798a8568504f213a90c4d3c3c81db41c22c54359d0689adb7b233c96c4fff4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
22389ba468f26c12938a633c150169f7

SHA1
3ab5743eef45947a65939c6fd43a0fc6817ed486

SHA256
1ad9753faa42bb3c6246f2a137237beff83b08aef1bfb1f487ec128bba0b615e

SHA512
bf5165cf720a9e1ca2110bb0a4e8e001599e3b9c63279d42e5d5351d52be288a410e64214772aa9dc28b09f8aea7db70e09e3c2e8f7e690e573e87a79fedf02c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
6b2ba4235851b9711182b796a54f28d8

SHA1
37b93aaf987f481e5d31fe105bd003073af0abff

SHA256
d65888d72341783466a2543d9e6775a07af40f755e903576166052499ab374cc

SHA512
d36b66c5bde103aee228dab4fd7ec64acb8c9ef63a92fbaf36788cce525ac1e64fa9b7d9acca0826000b9acbd673cbeec68902b92151c4280bbd12bd30f00869

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
85B

MD5
661f2206ac253963428371f575ce29e2

SHA1
a3ae20abb92b0a39f5be0e48387ff36c878d8999

SHA256
5eddd08dbbbb3f45bdbd18c5cb621e1d8b4f88961a51b25fb61c972887a20bae

SHA512
49a4ab478e326a5b820399c64169cf1a28bc1c7f00cc3a3c5b34b3e5f0553527087c4bd43eb2b4244202186f47e5ea969bf962290ce338f0e28b974d2af6d767

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
85656636a879a9f221926e338ad426b6

SHA1
b19138a5cc83a22b67b9542695345a6eda525ba0

SHA256
528c4373f2a6b55b5cbd696ece047ba63e59e7d5bed5a23099723d97a736ce39

SHA512
164e9edc9fb7cb9b16e42836190b20d9a682ab92f8e2aa06f50debd7cab39ec4f7208174ab574c65d67117e9e5c96a65ad2bbc50d592ecef6e53a6473cb29ab8

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
ce24d075934178fc2b128b0e2175459a

SHA1
a720a0048350f965e1b09477da59fb9312c23ab8

SHA256
5a68e317f1675c38605d475218886a8f623b0b55dcda41de49f90aa5a2454115

SHA512
10508478631cb28bf1943db4374bec214a4a972f9409e3735d8a74a39e154fae5698bdcd5f894d328527be33a7c19b6d226b9ffad67ab0761aaf56aa1b55c670

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
1960ecdc4601c17bf2aac3b52ade4d8a

SHA1
ca6cca359f3d7d7df0467ad1ae2eebba03321279

SHA256
be6b32cf3280a565412a1e8616f01cca2363e1eab8fa0607f11046e01c3afacf

SHA512
422ae7103058ecca8ac0f3361f20d5418f12adde8b3a3c9544e4e0545305ef796afd346d4075d7de24eb2475bba6161ba2938e2780f1234d5c1ac3a95343c6fb

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
540cbe1662faba4053dcbfbce63c591d

SHA1
5851abd461c0f03bc3979bb493c4e32e335185de

SHA256
317833f13f92dfca2b0c6a0e7b5cf26b52d319200a35c3157fbb562068b87578

SHA512
bf8d8b6d6039ae2b1a27f3d7c5ffbd2caaff586b3456cbf78034bf70916b29bff5ea20128e6cf291dfbc222943f05a59a3256eeefd6f1efc6a43797c342c66b6

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
4b63e610cec3a6941bd46f12e666a9da

SHA1
a4b1d6ffd32d0228528274bb8187200ec7b52f7b

SHA256
f34754acf7a64f597065fbcfef4dbd4a228f24e05a774ced0252cab9bd093e05

SHA512
d0b8abfed46c79b78266057f247b4d47c2326eb6eede7b6e02ef8c1a397575b05a59842a63a9f6ea503585a7acf060dc4427e57e111b061b77511c70e27a4b99

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
057db545ed750df495b4435796aab491

SHA1
f500d59e83d1817900304859fee2097c3bdadae4

SHA256
3f25eac7a7a79fb0ac3716a2fdc98bc5174e7284e218cccf127a9ccdbfd25967

SHA512
4da981883dcd5436fccfe68bf7f7e9ab572025814cd652cfdd2b82129b295577b13cdfe619e913d52b5c4c7c116eb9b4372cfd5e070b28ace4e9be4e5b4f4af3

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
54cf4163717f91bffe4c296bf6776f68

SHA1
990b7b9e0a991425323b0c618f116a1eea4723bd

SHA256
12b8ac6327e57c267c4b483734d0a26e8599edaea12790264e08f2dec153e362

SHA512
3b64b24de53e6265f4c6099ecba471d5708fab862212e3c0e91f2fd62fcc7d63bc10cdd17507a55851d6ac7aa9825dae8b98ae199e0605aceae5ead0f3067beb

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\main.idx

Filesize
68B

MD5
73e8a28d90febbf7088b012a0f893ed3

SHA1
3aea1d040f40c2c9b22de92b46c49e1c5eec429c

SHA256
00e28a7b755044117542de142fca891457af9772147548eb3615ebc92c1f29a1

SHA512
1fda2678f7512c765b71e8d5802a98ac1542dbc95354179bf13ab78af79056067ac99162210540a8f3d7fc5d21e9bc9c030fa9475146a5017ac50ca73306d03e

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\ml_online.ini

Filesize
54B

MD5
869c023e6356f60322b9959002e199b0

SHA1
11f9f69683019566bdc932b2cdd8cc69fc6ad926

SHA256
be56a246bd91885254c46cd2b13bb2b1298a7810df495d4b5ad9e12e857b6aab

SHA512
58b089e54eb3bc7b2de61e9cd726a370289f0e8737c8bf56fc4513b250991b542b1a1ad5cb57a27133b741ac54301c3c9981f968caabac4815fbc48dff12cff3

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.o1d000016B0

Filesize
8B

MD5
76a66845f666c52790c3442f7e1a491a

SHA1
e392a609d9dc81fab060d8aece449fe616a40053

SHA256
101f682d9c519400a4d36b6a09cf0dd39a9faab6353b3ce0eb2f071860b6d05a

SHA512
71a6ab36ebfb6ff89ec6fbedfd1982fe0fb7e8c76981d24467eb73a924dc96cc4a0483381beead6517f829fa8babead0176a8df229072040564e708d99b4c783

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.o1d000016B0

Filesize
466B

MD5
96ef5fc50f283b1b7366dd7116dd0cf6

SHA1
c006b2170fcd03de4ba2e6afabf3dc4e913686b8

SHA256
81410ad2054a340f3326dc2aae1ece077ec636db6ebe07b38fc9149231945524

SHA512
a5c63c0ad0864c02cc3c3ca1a9c75fe18a4c6caac477d6a880958e64e99f14748914da8e797820e4c488ca6ad5bcdf4af127d2123c623fa7e260723d3a7c56fa

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.idx

Filesize
68B

MD5
d39305c16a773b222871032c4148600e

SHA1
196b2a21dabfd3d001e2c79f3fdc7c411c4ca261

SHA256
01786514a6a5bb357099b7c11c23615c0e8e6e07aced1f3764f034b6a6be8d29

SHA512
bc16b755eb56da66ff8290d1498c9ebbe7a29e27c50a4326cf3cd9018d20c13bccb4d23e63429e07ac33e323ec19e11a69ad2e25c1b5a4a67341ea2019862093

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.idx.o1d000016B0

Filesize
32B

MD5
137faa0c3baa69f733eaadb966b64ade

SHA1
a55982685efc19bb0afffa2eb1f3750241480eb8

SHA256
9cc291dcb5847e7f0e6d4bf322164461c6607da934ce9d376c0e15f7ddd33181

SHA512
b6286a581aa3d1add62836804a1fc79a2399fd6fa7144945b47f2ff8c0ebe88af3f289bee95db0cae1aa7c532b487a4bb6a9e65710c581afa2b7f13989885d78

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\etA757.vmd

Filesize
910B

MD5
fa6b6eaa81a2662b8c45b126727ea832

SHA1
6087f9505d21819ed2f656517a0a13664aeead2b

SHA256
370be262ff415bed2a40f450f69dfce660e3e635af0924dca0c1f118e489c046

SHA512
f26688d6236021172c0f2d001e5636f018fef9ba7c7fadf688bd78fb1f9633c766cdf9ff2581997bc7af8a5ffd92da19cba699a46a64a555ccc0e7e57bd7b3c1

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\etB729.vmd

Filesize
242B

MD5
d836c09aa347ee2c42dee31a9432de4b

SHA1
4c8fa95c7ab1ef201acee309450c9a0e7cd61233

SHA256
fd7b5d8ebf6f865b37f75ff80638d6d25eaafc8f55e91b458bcd7ecd7132963b

SHA512
16d789a2c1633c8df41b030c0980b2deaedd07ef260352e293ace1fcfbd24e7d640297e2e9d32961676fbc4dc834b10afc7b2e3d7d687dc62eae4dd108dfae17

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\etB729.vmd

Filesize
342B

MD5
2ae2947bcd285e259d2f2cf15771fe70

SHA1
4a4b7a0adb8159faaa2e36a34d2e300b4ba62be8

SHA256
682e7f2143d789d847184072a61be585a6a869ccf2830b03a45af0e1ed812b23

SHA512
de34ee2e3a9feba6cb9101d06f1c9007b3b7a18f7438a683a9979e7867cbb4e3c831808603111a42c07aa9160790f74065d43c359b70216475dd5662ed332561

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metA766.vmd

Filesize
127B

MD5
252e14c85c8b8288fda93614891308eb

SHA1
636d352077cab476c805fac2bc4ff58d83a14b99

SHA256
cd160e25ecd10aeada7cbe1b0913b8dc8098d009e43b9a549765e0250531c81b

SHA512
7c5654607006bd1300874257f9c452b7e5aeaf90e4815ccfa0f195988f7d51dfb8dce68c71d15649242f8d05f970d67101917c4ddeef12ea05d39fa8aa1f293b

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metB729.vmd

Filesize
174B

MD5
9936bebab9c4e0e2aac7dceffc42dbac

SHA1
c1d2b8ceed49c904db7f174e06cc4e8ef851a87b

SHA256
ee730918e759544d7d087fe0b2e0aee12145ec36ecd4f4aced4336d85503a124

SHA512
16a5da57970c1d9b0e00bd8ac21ad53260b48db7b7b8bdb1953c625e8b6a9a132afa53fcb835163b73fe6a5dae40aa5ddffda9a11f42e8942c07b180363f2ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metB738.vmd

Filesize
103B

MD5
eebb8da8e062bd685542bffe0bb94e74

SHA1
75faddb50b83eae36988c1e3eab075fe8d5a3415

SHA256
ec58f79fffd619862667c1a7644ad34f76c4623f2b7857a5341640c893d4de18

SHA512
8a23a32b28a558e9a5d3a615d4412b768af8948f132b09e97ca121471db46693a4d05ce4df64f1ad951749d65c4d19000e08f7870d99eef9b90b62d2864f1bfa

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metC6FB.vmd

Filesize
126B

MD5
2cdaffaec77db6248825896e5c424893

SHA1
fc8df8ddc7811bfcf8f426dce0316c7eb6366b69

SHA256
6217223a02d019b85e566e2804ae6ae4dd3643c95578279a27909c9eedbdb961

SHA512
387e12cab715c8d9530b21725808c91bface84949f03d17312890464ec53ffbd79ce3a83685e0897e208a2e26e85c8296b848d91b0677df1bac446c229cfe05e

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metC70A.vmd

Filesize
125B

MD5
d39c2a872b313f71c47f6bef8a44b425

SHA1
fb0b1e55ba114f0ec0856cec44934c692690e487

SHA256
84f5b0b1ecb3612db2d369b18c758cd0de8ad31b371943343fc5b776092fceae

SHA512
b21b234843480ade18abbfc1dcae5edd536def427bfbd39d0c384e439c2b0692d1654703e32b4648ffb6f719fc1236edbc588bffd242ea7792fbb41b82d65b7a

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metD6CD.vmd

Filesize
116B

MD5
c386b2dab1e50ba2766d84fbff261563

SHA1
04689715512886016010a77f4cb1e6659e0df0b5

SHA256
ae6359b0c31c69599ebb789f3016908d680c7079d452c4648a3af0226b78a84b

SHA512
f67d207fad5f0a78d1c7e507257aa903704020f8339720c7e6e23e7d4699d084a57628703a0cd4f33b0460e5454a6d33b99c51f37e346a95504949ce30929723

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metE69F.vmd

Filesize
116B

MD5
c83239613245411ebd5416fe69629720

SHA1
e0b7924b12a88958fb9e18d5d8bdf1ed9ab84337

SHA256
a1defd5d6eed464399dc2a0f2c07d1f3a10e45963899ff4b824f748b690362d1

SHA512
f3d264e25bbceb2c58d741bfa16c35213df9a629ac59ef9a275c2ec60320b6580c6f1468627e966e14bc27695d9e157ce264a6259a4f78995e7fbe304d5e4528

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Winamp.ini

Filesize
320B

MD5
fa33be2a87484b7a94a93d8073d14875

SHA1
1eec5f9b91a6fb7ea52f1255076d3c0ce6aad220

SHA256
acf74dc668b8697cd093a8529ac57a5684fd83807be5ba341277e6b5adda7289

SHA512
8ccd9f9ed4eb6f4f3a5775941b6a17da7283f9033bdf57c1c4250e541008665c6bc9a4c13d74c0f1db191316b6a5f25f644f4dadc97235ad885eca5989ab1791

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Winamp.q1

Filesize
4KB

MD5
d24f1b829d1bd197e157b12d19c220e9

SHA1
555274f63e5b6ddbbd548179754fd0b2cbddf888

SHA256
58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8

SHA512
55c5c6bc1c466eebde84b98e024d774711bc1f1e32b28842d77eaea93dc030878e74012ea48179925313490b7c77d07383213ebb63d691228d2333e4217b33fc

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
432B

MD5
b8c7856b52fa963a2a88b34c6bc221e5

SHA1
ac11228f605cb8d64cfa63aba8d4cb3e8d43ca36

SHA256
a0bf7e06b1ec22a0e8336b24e89ee20f31b6e8d07e5515ee13e0792f3cae6156

SHA512
71e46c5195db8cc084fa24f6bf033332109275fd336a944c890f3c4f86b8a800da2ec044fb9a171df9a797aca4c0e190bf31e96f1dc31a308c0b9ddc31081f67

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
455B

MD5
aa3c8466a3ea9779bc1a3050b9380d2d

SHA1
4a3c9259daa5047cf789b31ac621fe9429418961

SHA256
55088a97a797f2ac19a8131f39d4dfb6942d52a10d237aa02e64de5c97053e2e

SHA512
1ca97ac99834af7af195fce66e1c7d686c35dfab2fb9a676b633946aa0546e2dc9339f69f37711a88fd036402f5ed27d405b111eeec2bb12a1510ba0088f9117

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
467B

MD5
add39d42ef4f2e2f749b5a40abc3f656

SHA1
5364113e0257d19844d59b4890beecefff90c3d3

SHA256
eec7d01ac92f3037a10416bdb1c93dbbb921918fbfa79a9eab059ed47685482c

SHA512
97617c3b2a4d575214abc233afa7c7432431045542674ac7a1818239dc46b01eea718ec6a2517c7044d124a2aff01c6b96ee617718d04df2aa0c39ab5f5ca894

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
873B

MD5
36a11d54ff7305da8fe9519f3795d2a3

SHA1
b07cd6e73cd61865803823e751d0d1245b9f257b

SHA256
101817929023a8bdc752670ab004d4d0a84e059ddd3439f5d5f2c9a15a14cc0d

SHA512
0147babc32f141592c5379e6ee6b64008b72a78730c157c82e0aae53fab600659761056b59bd1ca176d2b4fe396ae319192250326d1bdd75506f65172f740f22

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
2KB

MD5
3c3e23b6509220540f6559854e5234f3

SHA1
7a3d020436d96480e71817b9e1c04cc2b8f7cadf

SHA256
03df78169c8bf69bf320c6f86a19029c5dc38669f5573bbbd04f638340f4fafd

SHA512
09779dedc39d99bd433f3c6def8b94135cf35be4ae2f602614b09efed57e58f499449eb4316b8403dc49d3639b093279c42013e51e14c6669aaff37731dd5e23

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
2KB

MD5
097694a1e51ca395f5b67981f6008f3e

SHA1
b8aba3e5f3552cf25d73f2ff470ed97a86c3ae2b

SHA256
f010eaf34c6049dd7aa61cfb287a8f3bbd0505550b91bad03b7c194f7993e52e

SHA512
f66ec7b4e6e948d68257cae98a74a94d599ec55f03c9c0f745017075228cb27853db2d2064b579ee9593c96e43bca592280cca7b29cdbe902d13e05cc10f6782

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
2KB

MD5
591d9b51b6b927bd867ac70a10d62ee0

SHA1
af2ba5d3ab0c55784f13b05f79312b534f54e070

SHA256
d70a73e00a9c0a5adc661e3639e9f550b4b443d36eb6cac2d7991ec700d44a08

SHA512
85be2319ed718d4b202aa64dac1a17702aff70f9d3b56a17d0e11b95ace0e3255a08b19c0bb62f338e0dd69d2faead0ffbc736fe91334902872685010af3015d

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
2KB

MD5
4a4e4cc214b0a121184bc65d994ad468

SHA1
131bb6afa8c650f00c2ac8c9f19478c348bdc0d6

SHA256
5ca7bedb6cd45e3e0fe498733b3ca0bc7b0c7dc3a53e5e04e505388b90c60cb0

SHA512
1b2064ba1cd4e70c201ac55a76ccbdf0acbf729f0c4e9c93be5a2cb1a29fc1d85ee9d88a11ec28f32313fa08217f0a104c542e3ad8dad252940aef3b607b5230

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
2KB

MD5
25e1ce789ce8bc75f567359c270678d6

SHA1
901ce6a8bbe145101c6003a02cfa6db8497ff2a3

SHA256
bc74bf7e873053464850122288c9f877ddf279f8def5f9928b948a22c24ae34a

SHA512
d542727bbbe3e8172bd9f00a7e5bbbbb9e4d11a0df6dc75799cb41c2d69a1dcfebae8bfab2f9c886f68b7699cb08c901a594d97a6f98f068ccfd2acddf9bded5

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
2KB

MD5
3ac676829846078c885669541eaa02a6

SHA1
6f10de6fe699599397e2eb0fac276adb341ad806

SHA256
849bab5d2ef72e0fabdedfb6b55d7d2a49bde307411a04d76c642a1f2369123b

SHA512
6234bd408c51aa42d1f036335267faa35612be996b7df6ab3edc69874f886e7a7015744c28d22143761c0da50b597f5840ad08b385eca3c26aa28ec977fea498

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
3KB

MD5
2d6623f7c088a616bba52658805b66d1

SHA1
3139060bfb39f06694123a0e477d8f1c748bf11f

SHA256
b668d6c5590f87804581b7bfb3ee273ee74c8c720b539e162f86bbaf799f462b

SHA512
76a22c6326693436ce9e66dcd5d2e5197f9a5c5190b0a8d2ae8fc58881b26e5997cf76b1ceb6c184078807eb36929536d7a301e5aa72f5c3a05b9c53b8db5fc5

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
3KB

MD5
dad752fd2e25c5aadb794f8d39ce84a1

SHA1
c7e9475eb119bdb34f407eda95f30c3defbeb9e5

SHA256
f212fd75f3991efbfbddaac62ad8759579007ce19451363382be68dab8d9fc95

SHA512
4cffccbc2e1dca210182f8df7deaa5cf737cccd8eb5e9299ffb08c64d82855b7fa2a04145a5f3ac02dfdf35b37e91379b31d033b7b99412b8efc34f17bb5a744

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
4KB

MD5
0cc58bbbad1fa04e8ca8040bfd261783

SHA1
63fcfeda4f6abd15ad37e2445055a7a23d77639b

SHA256
68a23bd5c87643219aec0d84287b08e5614d9b419a8d933048b4ff639e5c7867

SHA512
1dd71a4a4a1043221976f2c4ed10c920cc2d20326fba36cc60cb9a02f7954b4e2a1ecc9b5a117a9df9a903f7a1eb06697f077d54c9ae5a5decfde4968acf0f83

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
4KB

MD5
203f7dc010980eee0b0dd1566688c992

SHA1
9dc96f4be7b8eac19c7c4961761cd8098603e4cf

SHA256
982bd34caf6296f5f0b683b297a87ce6d8385c2ec03daaec036ae398c92c4298

SHA512
26f94089787e76e81eb374eb72d6380f7e4045ba621eaef7f35fe04b4ccb0fcf88ed859e9cf40d56f4d20b25618fa53637f121eb06b2386adbacaa2fc8cf5934

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
4KB

MD5
38f6d1a4dae252136c120ecf4cf45d4a

SHA1
6930c3a51c705a443b79686c677606e9fa488154

SHA256
75bfb896b7ad02fd3f83e988b376e20e868cb5a644cb8654f4ac7ad26ff4fbf3

SHA512
0851e0240f507fb6a3ea3afebf00480f0c5d4fc94fbfb02a7499824cbae8fa12437518d05c1b80ed3458ec44dddf939635347ec888b6d1793a467e9b659e12f7

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
4KB

MD5
a743393c54e1f9bb395106f5f9efc1ef

SHA1
bf86c8a16d479469e67f1c45634b91a49ed5638a

SHA256
b86a486f98edda08a695b000ca1328887b48d5f037e1754314e0d9d871672b59

SHA512
230e1986e9049e1e3f7632f76c6813cf5a41634468e3d2b72a6e10e8c334b4ee25be22d48b262a3150f33233048b7882357360c74702aeed45b12dd0e9c3c132

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
4KB

MD5
6ff8947c760465747b30cdbd8f642836

SHA1
780b9c1d5eadc5180f7c4bcec2c665cff8f2e643

SHA256
42b2c50497d9b9552f258b48fe05325bd8bc5a6f2823d89d4e76cbc03442ab00

SHA512
bd4de517356874350231815cfe0fe216aed33fb8867233118d6c94e6bdec267bc6f9fa88c053e5739a321ffd078b0a4d87f1c1e330e3a786bc90d22b96edd8e6

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
4KB

MD5
b961c8a84b75d580b9c682ed298d8608

SHA1
dc145cea3ac5296ced15e46f911be7d0c535bf27

SHA256
82ec637266b72d88bc84415100e766a9ee8c9af8ad0fcbb2b0f8d03c245996f3

SHA512
51cb1e85b42cb58911b203175a891d00ab6c0ed4208cafe8a1e4ed4fb8918a649649754ac9f27b8241e66c16d14a6a7079bf43b93d5fc86ea399ca72e8cd76b5

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
56B

MD5
69c56e3d98acc64fd35ec6b2916db596

SHA1
cc9d47c9fed45c892578c04e080696ffc2ac0eab

SHA256
85b420b1faf6d7e70567eaf2b01eac6dcb78e02e2375956c317c8e98d6cbbad1

SHA512
234f0db4c217469ec585903915758c890b0040a97735574caa1d73cde68c0fe239b58ce60720a16ee136c14ef0977af894167d12488af5993cd7514d9d79ce8f

Download Submit
memory/3476-2140-0x0000000004FB0000-0x0000000005093000-memory.dmp

Filesize
908KB

Download
memory/3476-2125-0x0000000004FB0000-0x00000000050AF000-memory.dmp

Filesize
1020KB

Download
memory/3476-2116-0x0000000004FB0000-0x000000000513D000-memory.dmp

Filesize
1.6MB

Download
memory/3476-2149-0x0000000004FB0000-0x00000000050C5000-memory.dmp

Filesize
1.1MB

Download
memory/3524-6410-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6378-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6374-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6411-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6408-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6380-0x00007FFD28CC0000-0x00007FFD28CD0000-memory.dmp

Filesize
64KB

Download
memory/3524-6379-0x00007FFD28CC0000-0x00007FFD28CD0000-memory.dmp

Filesize
64KB

Download
memory/3524-6409-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6377-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6376-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3524-6375-0x00007FFD2B030000-0x00007FFD2B040000-memory.dmp

Filesize
64KB

Download
memory/3796-3062-0x0000000003F70000-0x0000000003FB5000-memory.dmp

Filesize
276KB

Download
memory/5388-5789-0x0000000008220000-0x0000000008265000-memory.dmp

Filesize
276KB

Download
memory/5808-4058-0x00000000083F0000-0x0000000008435000-memory.dmp

Filesize
276KB

Download
memory/6064-6327-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6344-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6350-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6349-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6345-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6346-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6348-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6347-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6343-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6342-0x0000000008540000-0x0000000008550000-memory.dmp

Filesize
64KB

Download
memory/6064-6329-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6328-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6323-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6324-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6325-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6326-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6322-0x000000000AED0000-0x000000000AEE0000-memory.dmp

Filesize
64KB

Download
memory/6064-6321-0x0000000008540000-0x0000000008550000-memory.dmp

Filesize
64KB

Download