fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e

Analysis

max time kernel
568s
max time network
505s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2023 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winamp_latest_full.exe
Size

12.4MB
MD5

39b72e2cbf2fb8da961538de3e892eba
SHA1

237ce8611cb8e2ede8a5d6b982597f7e93b2cd81
SHA256

fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e
SHA512

36e8b9d759d960390e8f1b4ac420d591204cb95a776be668db365c453cb702cadee9b34c03779044fdc04c2d2929ac542e01bba50094f8352e2724a082611b59
SSDEEP

393216:udNH1gz1+ZUUG9NWpHYV6ohIBfqHts7UU2wP3:udZk1vUG964V6ysUs7U/u3

Score

8^/10

discovery evasion

Malware Config

Signatures

Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

3928 netsh.exe
1980 netsh.exe
4560 netsh.exe
3268 netsh.exe
Executes dropped EXE 5 IoCs

Processes:

elevator.exewadxsetup.exedxsetup.exewinamp.exewinamp.exe

pid process

4768 elevator.exe
924 wadxsetup.exe
1416 dxsetup.exe
1112 winamp.exe
4708 winamp.exe

pid	process
3928	netsh.exe
1980	netsh.exe
4560	netsh.exe
3268	netsh.exe

pid	process
4768	elevator.exe
924	wadxsetup.exe
1416	dxsetup.exe
1112	winamp.exe
4708	winamp.exe

Loads dropped DLL 64 IoCs

Processes:

winamp_latest_full.exedxsetup.exerundll32.exewinamp.exe

pid	process
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
4616	winamp_latest_full.exe
1416	dxsetup.exe
1416	dxsetup.exe
1416	dxsetup.exe
1416	dxsetup.exe
2576	rundll32.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe
1112	winamp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

winamp.exe

description ioc process

File opened (read-only) \??\D: winamp.exe

description	ioc	process
File opened (read-only)	\??\D:	winamp.exe

Drops file in System32 directory 6 IoCs

Processes:

dxsetup.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\SETFAFA.tmp	dxsetup.exe
File created	C:\Windows\SysWOW64\SETFAFA.tmp	dxsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_31.dll	dxsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETFB67.tmp	dxsetup.exe
File created	C:\Windows\SysWOW64\SETFB67.tmp	dxsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_42.dll	dxsetup.exe

Drops file in Program Files directory 64 IoCs

Processes:

winamp_latest_full.exe

description	ioc	process
File created	C:\Program Files (x86)\Winamp\Plugins\AVS\Community Picks\Degnic - Fury (extreme remix) by fsk.avs	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\textures\facade01.jpg	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Shared\nde.dll	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Eo.S.+Phat Cool Bug v2 + (Krash's beat detection).milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar - Alpha Conflict.milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar - Harlequin's Liquid Dragon.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\window\songinfo.png	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\3dRaGoNs & Unchained - Dragon Science.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Phat_Eo.S. Eyes_spiral_mix.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Reenen - phoenix.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\wasabi\garbage\seekbar-button.png	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\button_eq.png	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\xml\player-elements.xml	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - kaleidoscope template [commented composite shader].milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\scripts\shadesize.maki	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\AVS\Community Picks\Degnic - Data flow.avs	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\ORB - Pastel Primer.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Shared\tataki.dll	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\System\aacdec.w5s	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\titlebar\titlebar.xml	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\about\nibbles\fixedsys.png	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\affected\martin - soma in pink.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Krash & Rovastar - Cerebral Demons - Phat + Eo.S. Killer Death Bunny Remix.milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Shifter & Eo.S+Phat - Fractical dancer (inside the neural net).milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - disco mix 4.milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\affected\Stahlregen & Eo.S + Geiss + ORB + Phat - Fruitsticks (Flexi-Tex Shader).milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\wasabi\xml\old.system-colors.xml	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\shifter - tumbling cubes (ripples) Phat_parallel_planes_mix.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Aderrasi - Hard Drink (Half-Infinitea).milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Aderrasi - Party Mutant.milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rozzor & Unchained - Scientifically Shapely.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\button_mute_bg.PNG	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Bento\window\aol_radio_alb_art.jpg	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Geiss - Fog Tunnel.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Studio Music and Unchained - Rapid Alteration.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\AVS\Winamp 5 Picks\Degnic-Adrealine rush.avs	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar - Dark Ritual (Star Of Destiny Mix).milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\gen_crasher.dll	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\wasabi\xml\old.system-elements.xml	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\xml\player-normal-sui.xml	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\AVS\Community Picks\el-vis - hubble002.avs	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Illusion & Unchained - New Strategy.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\affected\Goody + martin - crystal palace - Aqua Lumens.milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\textures\seaweed.jpg	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\winamp.exe	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Bento\xml\player-normal-mcv.xml	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\data\comp_ps.fx	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\visualization_overlay.png	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\scripts\eq.maki	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\scripts\suicore.maki	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\docs\milkdrop.html	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar + Loadus + Geiss - Tone-mapped FractalDrop 7c.milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\shifter - spincycle c.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\wasabi\xml\groups\window-embedded.xml	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Aderrasi - Brakefreak-bitcore tweak.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Eo.S. + Phat - chasers 19 Portal.milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\winamp\cover\notfound60.png	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar - Altars Of Harlequin's Madness (Dark Disorder Mix).milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\AVS\Winamp 5 Picks\justin - joy.avs	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar - 3am Somewhere.milk	winamp_latest_full.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\flexi - bouncing icecubes [good morning edit].milk	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Bento\window\menu_view.png	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\about\about_fg.jpg	winamp_latest_full.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi + Martin - astral projection.milk	winamp_latest_full.exe

Drops file in Windows directory 1 IoCs

Processes:

dxsetup.exe

description ioc process

File opened for modification C:\Windows\Logs\DirectX.log dxsetup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Logs\DirectX.log	dxsetup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c462aaff2c1743fe0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c462aaff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff000000000700010000680900c462aaff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff000000000700010000680919c462aaff000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c462aaff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies registry class 64 IoCs

Processes:

winamp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.PTM\shell\Play\DropTarget\Clsid = "{46986115-84D6-459c-8F95-52DD653E532E}"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.STM\shell\Enqueue\DropTarget	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.WEBM\DefaultIcon\ = "C:\\Program Files (x86)\\Winamp\\winamp.exe,1"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MPEG\shell	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MAT\DefaultIcon\ = "C:\\Program Files (x86)\\Winamp\\winamp.exe,1"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.DMF\shell\ListBookmark	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.DTM\DefaultIcon\ = "C:\\Program Files (x86)\\Winamp\\winamp.exe,1"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.OKT\shell\Play\DropTarget\Clsid = "{46986115-84D6-459c-8F95-52DD653E532E}"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.XMZ\DefaultIcon\ = "C:\\Program Files (x86)\\Winamp\\winamp.exe,1"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.XMZ\shell\open\command	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MP1\DefaultIcon\ = "C:\\Program Files (x86)\\Winamp\\winamp.exe,1"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MAT\shell\ = "Play"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.IMF\shell\ListBookmark	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.ICE\shell\open	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.SFX\shell\ListBookmark	winamp.exe
Key created	\REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000_Classes\.m3u	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.M2V\shell\open\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AMS\shell	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.STK\shell\open\command	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.ULT\shell\open	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MDR\shell\Play	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xpk	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MOD\shell\open	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.STM\shell\open\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.GDM\DefaultIcon	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.XPK\shell	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.PPM\shell\open\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.s3m	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.C67\shell\Enqueue\DropTarget\Clsid = "{77A366BA-2BE4-4a1e-9263-7734AA3E99A2}"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MTM\shell\open\command	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.FLAC\shell\open\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.XI\shell	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.IMF\shell\open	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.med\ = "Winamp.File.MED"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.PTM\shell\ListBookmark	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.WOW\shell\Play\ = "&Play in Winamp"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File\shell\ListBookmark\ = "Add to Winamp's &Bookmark list"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MP1\shell\open	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sf\ = "Winamp.File.SF"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AMS\shell\ListBookmark\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" /BOOKMARK \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.SFX\shell\open\command	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MDR\shell\ = "Play"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AMS\shell\open\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dsm\ = "Winamp.File.DSM"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.FMT\shell\Enqueue	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.J2B\shell\Enqueue\DropTarget\Clsid = "{77A366BA-2BE4-4a1e-9263-7734AA3E99A2}"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.PPM\shell\open\	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77A366BA-2BE4-4a1e-9263-7734AA3E99A2}	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.NSA\DefaultIcon	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.STP\shell\Play\command	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.STP\shell\open	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.OXM\shell\Enqueue\ = "&Enqueue in Winamp"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.S3Z\shell\Enqueue\ = "&Enqueue in Winamp"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.CAF\shell\Play\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rf64	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.C67\shell\ListBookmark	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MDR\shell\Enqueue\DropTarget	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MP2\shell\Play\command	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.OGG\shell	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.FLV\shell\Enqueue\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" /ADD \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.AU\shell\Play\DropTarget\Clsid = "{46986115-84D6-459c-8F95-52DD653E532E}"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.DMF\shell\ = "Play"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.S3Z\shell\ListBookmark\command	winamp.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

winamp.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	winamp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	winamp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

4516 ping.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

winamp.exe

pid process

4708 winamp.exe

pid	process
4516	ping.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

vssvc.exesrtasks.exeAUDIODG.EXE

description	pid	process
Token: SeBackupPrivilege	4668	vssvc.exe
Token: SeRestorePrivilege	4668	vssvc.exe
Token: SeAuditPrivilege	4668	vssvc.exe
Token: SeBackupPrivilege	4188	srtasks.exe
Token: SeRestorePrivilege	4188	srtasks.exe
Token: SeSecurityPrivilege	4188	srtasks.exe
Token: SeTakeOwnershipPrivilege	4188	srtasks.exe
Token: SeBackupPrivilege	4188	srtasks.exe
Token: SeRestorePrivilege	4188	srtasks.exe
Token: SeSecurityPrivilege	4188	srtasks.exe
Token: SeTakeOwnershipPrivilege	4188	srtasks.exe
Token: 33	2124	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2124	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

winamp.exe

pid process

4708 winamp.exe
4708 winamp.exe
4708 winamp.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

winamp.exe

pid process

4708 winamp.exe
4708 winamp.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

winamp.exe

pid	process
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe
4708	winamp.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

winamp_latest_full.exewadxsetup.exewinamp.exe

description	pid	process	target process
PID 4616 wrote to memory of 4768	4616	winamp_latest_full.exe	elevator.exe
PID 4616 wrote to memory of 4768	4616	winamp_latest_full.exe	elevator.exe
PID 4616 wrote to memory of 4768	4616	winamp_latest_full.exe	elevator.exe
PID 4616 wrote to memory of 3928	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 3928	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 3928	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 1980	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 1980	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 1980	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 4560	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 4560	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 4560	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 3268	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 3268	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 3268	4616	winamp_latest_full.exe	netsh.exe
PID 4616 wrote to memory of 4516	4616	winamp_latest_full.exe	ping.exe
PID 4616 wrote to memory of 4516	4616	winamp_latest_full.exe	ping.exe
PID 4616 wrote to memory of 4516	4616	winamp_latest_full.exe	ping.exe
PID 4616 wrote to memory of 924	4616	winamp_latest_full.exe	wadxsetup.exe
PID 4616 wrote to memory of 924	4616	winamp_latest_full.exe	wadxsetup.exe
PID 4616 wrote to memory of 924	4616	winamp_latest_full.exe	wadxsetup.exe
PID 924 wrote to memory of 1416	924	wadxsetup.exe	dxsetup.exe
PID 924 wrote to memory of 1416	924	wadxsetup.exe	dxsetup.exe
PID 924 wrote to memory of 1416	924	wadxsetup.exe	dxsetup.exe
PID 4616 wrote to memory of 2576	4616	winamp_latest_full.exe	rundll32.exe
PID 4616 wrote to memory of 2576	4616	winamp_latest_full.exe	rundll32.exe
PID 4616 wrote to memory of 2576	4616	winamp_latest_full.exe	rundll32.exe
PID 1112 wrote to memory of 4708	1112	winamp.exe	winamp.exe
PID 1112 wrote to memory of 4708	1112	winamp.exe	winamp.exe
PID 1112 wrote to memory of 4708	1112	winamp.exe	winamp.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\winamp_latest_full.exe
"C:\Users\Admin\AppData\Local\Temp\winamp_latest_full.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4616

C:\Program Files (x86)\Winamp\elevator.exe
"C:\Program Files (x86)\Winamp\elevator.exe" /RegServer
2⤵
- Executes dropped EXE
PID:4768

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files (x86)\Winamp\winamp.exe" profile=private,public protocol=TCP new action=allow enable=yes
2⤵
- Modifies Windows Firewall
PID:3928

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="Winamp" dir=in action=allow program="C:\Program Files (x86)\Winamp\winamp.exe" enable=yes profile=private,public protocol=TCP
2⤵
- Modifies Windows Firewall
PID:1980

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files (x86)\Winamp\winamp.exe" profile=private,public protocol=UDP new action=allow enable=yes
2⤵
- Modifies Windows Firewall
PID:4560

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="Winamp" dir=in action=allow program="C:\Program Files (x86)\Winamp\winamp.exe" enable=yes profile=private,public protocol=UDP
2⤵
- Modifies Windows Firewall
PID:3268

C:\Windows\SysWOW64\ping.exe
ping -n 1 -w 400 www.google.com
2⤵
- Runs ping.exe
PID:4516

C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\wadxsetup.exe
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\wadxsetup.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\dxsetup.exe
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\dxsetup.exe /silent
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:1416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\SHELLD~1.DLL,RunDll_ShellExecute "open" "C:\Program Files (x86)\Winamp\winamp.exe" "/NEW /REG=S" "C:\Program Files (x86)\Winamp" 1
2⤵
- Loads dropped DLL
PID:2576

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Program Files (x86)\Winamp\winamp.exe
"C:\Program Files (x86)\Winamp\winamp.exe" /NEW /REG=S
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1112

C:\Program Files (x86)\Winamp\winamp.exe
"C:\Program Files (x86)\Winamp\winamp.exe" /NEW C:\Users\Admin\AppData\Roaming\Winamp\winamp.m3u8
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3ec 0x414
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Winamp\Components\ssdp.w6c

Filesize
31KB

MD5
80e53207d1f5f684b098bf70b66c34b1

SHA1
848367ff79a68319c9211abfae289a3802a809f6

SHA256
dd55372e906699c3e35f02313736f74a13d1e526d0b9620cadb70d57e530af63

SHA512
cd7e0b59a2eb0ccf164e958e758d53646dd6a229a67cb37e2d524fb36d19116117b7390a368bc47043faf407d788e839aee20f501b7c90d367515acdf65690ac

Download Submit
C:\Program Files (x86)\Winamp\Components\ssdp.w6c

Filesize
31KB

MD5
80e53207d1f5f684b098bf70b66c34b1

SHA1
848367ff79a68319c9211abfae289a3802a809f6

SHA256
dd55372e906699c3e35f02313736f74a13d1e526d0b9620cadb70d57e530af63

SHA512
cd7e0b59a2eb0ccf164e958e758d53646dd6a229a67cb37e2d524fb36d19116117b7390a368bc47043faf407d788e839aee20f501b7c90d367515acdf65690ac

Download Submit
C:\Program Files (x86)\Winamp\Components\ssdp.w6c

Filesize
31KB

MD5
80e53207d1f5f684b098bf70b66c34b1

SHA1
848367ff79a68319c9211abfae289a3802a809f6

SHA256
dd55372e906699c3e35f02313736f74a13d1e526d0b9620cadb70d57e530af63

SHA512
cd7e0b59a2eb0ccf164e958e758d53646dd6a229a67cb37e2d524fb36d19116117b7390a368bc47043faf407d788e839aee20f501b7c90d367515acdf65690ac

Download Submit
C:\Program Files (x86)\Winamp\Elevator.exe

Filesize
97KB

MD5
59803a5bb88b88a6d83342eeb3816ad9

SHA1
cafa43cacd584deb0d54ac31ae9030f90455c6b7

SHA256
a8e9655510906994fdef3993bebabf0a5e0b6604f02c0ccc28fd31be3aa684bf

SHA512
85038570bb2fb39e7ee8994ccb3f8f9203c0d8360fea889d238c13b3b49a7ab85488edd01d3ec7e37288ffbd0db7e84cfe0353e199289a854311d27990cb9eea

Download Submit
C:\Program Files (x86)\Winamp\Plugins\gen_crasher.dll

Filesize
57KB

MD5
e52a7ef27aa85d2d763a47a0e3d0ec49

SHA1
918c0487e0798e9f16a2c8cab659b113eca57f65

SHA256
7c2d2c9db724b7ac4fa17b871c741182be0dab51f89b75a8d114d9d6d95b09fc

SHA512
7fd1bb7e2edb029b2853d64e5443213d0d8abb1aa97bf5c92ebde1ee3a42248867b998a89da657cd140fa68e98a1b961647362b049bac494f0a4032fe9024cc8

Download Submit
C:\Program Files (x86)\Winamp\Plugins\gen_crasher.dll

Filesize
57KB

MD5
e52a7ef27aa85d2d763a47a0e3d0ec49

SHA1
918c0487e0798e9f16a2c8cab659b113eca57f65

SHA256
7c2d2c9db724b7ac4fa17b871c741182be0dab51f89b75a8d114d9d6d95b09fc

SHA512
7fd1bb7e2edb029b2853d64e5443213d0d8abb1aa97bf5c92ebde1ee3a42248867b998a89da657cd140fa68e98a1b961647362b049bac494f0a4032fe9024cc8

Download Submit
C:\Program Files (x86)\Winamp\Plugins\gen_crasher.dll

Filesize
57KB

MD5
e52a7ef27aa85d2d763a47a0e3d0ec49

SHA1
918c0487e0798e9f16a2c8cab659b113eca57f65

SHA256
7c2d2c9db724b7ac4fa17b871c741182be0dab51f89b75a8d114d9d6d95b09fc

SHA512
7fd1bb7e2edb029b2853d64e5443213d0d8abb1aa97bf5c92ebde1ee3a42248867b998a89da657cd140fa68e98a1b961647362b049bac494f0a4032fe9024cc8

Download Submit
C:\Program Files (x86)\Winamp\Shared\ElevatorPS.dll

Filesize
23KB

MD5
7606a37c850c2ce121e74f09a131b9dc

SHA1
0c30b33ec6af5f9a0c32bb09d21d9739614ca863

SHA256
f3726029b19b5eb9e4a6ff2128bcdb945bfcc81c783cbfb6a087a973d9e002bb

SHA512
ed984e39cffac82d9f919ebd5d0dc05fcd3c487244d6a54964892d1be9670e5d5531ab6c0cab74ccf8bb0a9b59e8775f0aaedacc877d24cb70e51e33def30ae7

Download Submit
C:\Program Files (x86)\Winamp\Shared\ElevatorPS.dll

Filesize
23KB

MD5
7606a37c850c2ce121e74f09a131b9dc

SHA1
0c30b33ec6af5f9a0c32bb09d21d9739614ca863

SHA256
f3726029b19b5eb9e4a6ff2128bcdb945bfcc81c783cbfb6a087a973d9e002bb

SHA512
ed984e39cffac82d9f919ebd5d0dc05fcd3c487244d6a54964892d1be9670e5d5531ab6c0cab74ccf8bb0a9b59e8775f0aaedacc877d24cb70e51e33def30ae7

Download Submit
C:\Program Files (x86)\Winamp\Shared\jnetlib.dll

Filesize
2.4MB

MD5
0e1d9c1b1d067ca068a120258d56f10b

SHA1
3f2f1354261a9de037bd83021a6fe2be024f371c

SHA256
df0e962303ee3a276e342d2a8c022fa756db6b6c93f680171b165c22feb70521

SHA512
66be377de7eeeb09dd4197882aced2486d411082b428f91a074322bcaff61d10223e4d842367f9c42679c74e3601657e3d95b73d610d868c22b9272067e66c2b

Download Submit
C:\Program Files (x86)\Winamp\Shared\jnetlib.dll

Filesize
2.4MB

MD5
0e1d9c1b1d067ca068a120258d56f10b

SHA1
3f2f1354261a9de037bd83021a6fe2be024f371c

SHA256
df0e962303ee3a276e342d2a8c022fa756db6b6c93f680171b165c22feb70521

SHA512
66be377de7eeeb09dd4197882aced2486d411082b428f91a074322bcaff61d10223e4d842367f9c42679c74e3601657e3d95b73d610d868c22b9272067e66c2b

Download Submit
C:\Program Files (x86)\Winamp\Shared\jnetlib.dll

Filesize
2.4MB

MD5
0e1d9c1b1d067ca068a120258d56f10b

SHA1
3f2f1354261a9de037bd83021a6fe2be024f371c

SHA256
df0e962303ee3a276e342d2a8c022fa756db6b6c93f680171b165c22feb70521

SHA512
66be377de7eeeb09dd4197882aced2486d411082b428f91a074322bcaff61d10223e4d842367f9c42679c74e3601657e3d95b73d610d868c22b9272067e66c2b

Download Submit
C:\Program Files (x86)\Winamp\Shared\libmp4v2.dll

Filesize
196KB

MD5
94ac898b7a10067e78d714849b5742a5

SHA1
9f6a171c27f1bf34f6d005879891ebf67e6cb283

SHA256
0dd4c133afdfe6f2e6d5e00ef7fd5494da1eb7cf7e2c5d9832803e90af9d75e8

SHA512
87cc90a0144e534a601467c02865573fd537ecc05c9154a38eaf00d2b2e5ae605a420c08b41df8c8638041e2c364aeb7d566f3074717388d51d361e95911fb77

Download Submit
C:\Program Files (x86)\Winamp\Shared\libmp4v2.dll

Filesize
196KB

MD5
94ac898b7a10067e78d714849b5742a5

SHA1
9f6a171c27f1bf34f6d005879891ebf67e6cb283

SHA256
0dd4c133afdfe6f2e6d5e00ef7fd5494da1eb7cf7e2c5d9832803e90af9d75e8

SHA512
87cc90a0144e534a601467c02865573fd537ecc05c9154a38eaf00d2b2e5ae605a420c08b41df8c8638041e2c364aeb7d566f3074717388d51d361e95911fb77

Download Submit
C:\Program Files (x86)\Winamp\Shared\libmp4v2.dll

Filesize
196KB

MD5
94ac898b7a10067e78d714849b5742a5

SHA1
9f6a171c27f1bf34f6d005879891ebf67e6cb283

SHA256
0dd4c133afdfe6f2e6d5e00ef7fd5494da1eb7cf7e2c5d9832803e90af9d75e8

SHA512
87cc90a0144e534a601467c02865573fd537ecc05c9154a38eaf00d2b2e5ae605a420c08b41df8c8638041e2c364aeb7d566f3074717388d51d361e95911fb77

Download Submit
C:\Program Files (x86)\Winamp\Shared\nde.dll

Filesize
85KB

MD5
7ef49a648488189e84785031e5233980

SHA1
fcdb8d02a04a664afbc901aef516d4bde9cc48f3

SHA256
1f856e87de95f73f6e7848473c62cb9868ec70a0d01686f56a9bbedceb89170f

SHA512
98c379ec0e538e7d92c93d374b4b3f7da8c282a4b4865c82b1626abccadfb5d13b458d15af6260ec8d644e9d2a8ab596f270f274bfe61e289bd5a9e37e424b02

Download Submit
C:\Program Files (x86)\Winamp\Shared\nde.dll

Filesize
85KB

MD5
7ef49a648488189e84785031e5233980

SHA1
fcdb8d02a04a664afbc901aef516d4bde9cc48f3

SHA256
1f856e87de95f73f6e7848473c62cb9868ec70a0d01686f56a9bbedceb89170f

SHA512
98c379ec0e538e7d92c93d374b4b3f7da8c282a4b4865c82b1626abccadfb5d13b458d15af6260ec8d644e9d2a8ab596f270f274bfe61e289bd5a9e37e424b02

Download Submit
C:\Program Files (x86)\Winamp\Shared\nde.dll

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Program Files (x86)\Winamp\Shared\nsutil.dll

Filesize
420KB

MD5
0e87445c382776b590b6898ec3e4e0f4

SHA1
5770be505b48c73bd5fabd108c21c6728efb570e

SHA256
cd614597bd78bcfdb3d9d5dd1f7462a85d5a1f4b01ac479666d9b1516bccf137

SHA512
c9da42f43c922406f06b90763ad6302053e9a4d8eb00fb1c74f652aacc5a43eb9b1c713c8130b6c009222db4fce3ba662408749928316f1fe65dea847cff092f

Download Submit
C:\Program Files (x86)\Winamp\Shared\nsutil.dll

Filesize
420KB

MD5
0e87445c382776b590b6898ec3e4e0f4

SHA1
5770be505b48c73bd5fabd108c21c6728efb570e

SHA256
cd614597bd78bcfdb3d9d5dd1f7462a85d5a1f4b01ac479666d9b1516bccf137

SHA512
c9da42f43c922406f06b90763ad6302053e9a4d8eb00fb1c74f652aacc5a43eb9b1c713c8130b6c009222db4fce3ba662408749928316f1fe65dea847cff092f

Download Submit
C:\Program Files (x86)\Winamp\Shared\nsutil.dll

Filesize
420KB

MD5
0e87445c382776b590b6898ec3e4e0f4

SHA1
5770be505b48c73bd5fabd108c21c6728efb570e

SHA256
cd614597bd78bcfdb3d9d5dd1f7462a85d5a1f4b01ac479666d9b1516bccf137

SHA512
c9da42f43c922406f06b90763ad6302053e9a4d8eb00fb1c74f652aacc5a43eb9b1c713c8130b6c009222db4fce3ba662408749928316f1fe65dea847cff092f

Download Submit
C:\Program Files (x86)\Winamp\Shared\nxlite.dll

Filesize
78KB

MD5
0eb8f691e53a5ecf93b14d8d6c72e6ce

SHA1
2b40b27c1668791a146978e861005bc9095a66a1

SHA256
7cd7679b154f7d40f22d37b02e8aed2a694a2c23c997ba1cd1e4ead21164939e

SHA512
9efc89c2512e4bac51142ad3e34e10755ded7b055d93eb44a44abb7f4ef0822e4eab039237d7238cce007f56a447e1986de13febb0623839b7c065a4b1377367

Download Submit
C:\Program Files (x86)\Winamp\Shared\nxlite.dll

Filesize
78KB

MD5
0eb8f691e53a5ecf93b14d8d6c72e6ce

SHA1
2b40b27c1668791a146978e861005bc9095a66a1

SHA256
7cd7679b154f7d40f22d37b02e8aed2a694a2c23c997ba1cd1e4ead21164939e

SHA512
9efc89c2512e4bac51142ad3e34e10755ded7b055d93eb44a44abb7f4ef0822e4eab039237d7238cce007f56a447e1986de13febb0623839b7c065a4b1377367

Download Submit
C:\Program Files (x86)\Winamp\Shared\nxlite.dll

Filesize
78KB

MD5
0eb8f691e53a5ecf93b14d8d6c72e6ce

SHA1
2b40b27c1668791a146978e861005bc9095a66a1

SHA256
7cd7679b154f7d40f22d37b02e8aed2a694a2c23c997ba1cd1e4ead21164939e

SHA512
9efc89c2512e4bac51142ad3e34e10755ded7b055d93eb44a44abb7f4ef0822e4eab039237d7238cce007f56a447e1986de13febb0623839b7c065a4b1377367

Download Submit
C:\Program Files (x86)\Winamp\System\aacdec.w5s

Filesize
37KB

MD5
3f22364b04bdd95b5bb6193c993049ca

SHA1
fdf195aeb9c9b624f766cb9a11bc0d8e1f20d5d9

SHA256
772373cbb9e6da051368248bb8a73e11ae7aa232860861933b92e97d15c305ec

SHA512
04aceef8ad8fc0823183e9e187ab65f69c7a435bb6d69542cbb7e1208ec11ff8f1fff09ddd6e3f0d0a9246c8b42faba4b2f009bc4368742ef0b8b042bd6c1382

Download Submit
C:\Program Files (x86)\Winamp\System\aacdec.w5s

Filesize
37KB

MD5
3f22364b04bdd95b5bb6193c993049ca

SHA1
fdf195aeb9c9b624f766cb9a11bc0d8e1f20d5d9

SHA256
772373cbb9e6da051368248bb8a73e11ae7aa232860861933b92e97d15c305ec

SHA512
04aceef8ad8fc0823183e9e187ab65f69c7a435bb6d69542cbb7e1208ec11ff8f1fff09ddd6e3f0d0a9246c8b42faba4b2f009bc4368742ef0b8b042bd6c1382

Download Submit
C:\Program Files (x86)\Winamp\System\adpcm.w5s

Filesize
30KB

MD5
63fbcc000aa4d0d75c569e4279eb29bf

SHA1
4e5909b204e7b383981104bd2b2b4a68f392374c

SHA256
d454db3897b4b7e85110875999a6c4594e875b3b86644e71661884296cdc5217

SHA512
286a6c2a1566734ac9438656053b85bbfd1c4a842ff3fc70e58e2fe2a661de96c3ecdfc09908756125a24016c255ec97e821cfb77c029bb9379fc217d21c02c7

Download Submit
C:\Program Files (x86)\Winamp\System\adpcm.w5s

Filesize
30KB

MD5
63fbcc000aa4d0d75c569e4279eb29bf

SHA1
4e5909b204e7b383981104bd2b2b4a68f392374c

SHA256
d454db3897b4b7e85110875999a6c4594e875b3b86644e71661884296cdc5217

SHA512
286a6c2a1566734ac9438656053b85bbfd1c4a842ff3fc70e58e2fe2a661de96c3ecdfc09908756125a24016c255ec97e821cfb77c029bb9379fc217d21c02c7

Download Submit
C:\Program Files (x86)\Winamp\System\adpcm.w5s

Filesize
30KB

MD5
63fbcc000aa4d0d75c569e4279eb29bf

SHA1
4e5909b204e7b383981104bd2b2b4a68f392374c

SHA256
d454db3897b4b7e85110875999a6c4594e875b3b86644e71661884296cdc5217

SHA512
286a6c2a1566734ac9438656053b85bbfd1c4a842ff3fc70e58e2fe2a661de96c3ecdfc09908756125a24016c255ec97e821cfb77c029bb9379fc217d21c02c7

Download Submit
C:\Program Files (x86)\Winamp\System\alac.w5s

Filesize
36KB

MD5
9cd27176dfd77f682b074bf9dac1736a

SHA1
e82e2910c2b3451637a03d21ecb61f6f1de49559

SHA256
8df472ca07447a30326107dc21f5fd5448a62a71d5c53a6fc87cecf77fcc4e44

SHA512
c142e23739cc8797634072cd0912080a22c83ca0feddf7514ab2e031008c411de118ca8e1127601031b5ab8c5eb215f5a8fb5523a92498c727ed122601519372

Download Submit
C:\Program Files (x86)\Winamp\System\alac.w5s

Filesize
36KB

MD5
9cd27176dfd77f682b074bf9dac1736a

SHA1
e82e2910c2b3451637a03d21ecb61f6f1de49559

SHA256
8df472ca07447a30326107dc21f5fd5448a62a71d5c53a6fc87cecf77fcc4e44

SHA512
c142e23739cc8797634072cd0912080a22c83ca0feddf7514ab2e031008c411de118ca8e1127601031b5ab8c5eb215f5a8fb5523a92498c727ed122601519372

Download Submit
C:\Program Files (x86)\Winamp\System\albumart.w5s

Filesize
38KB

MD5
d7af4c04092842e5b4994ebed8bd05ca

SHA1
391add7a9bb2fe52da52e436b8f9c3c4546ab9d3

SHA256
c68698231754f25e069ca761d497b3c683f8166a81da076d33fc6d7489ac3769

SHA512
d02ca853abf9006c5760fc9e447633201c1d3e00b997aa75eaece259b42ff2dfa3cd4e63a87e4ecce97ccf45e2d2c0dff90d3f310d4e53de9d4d1cf32fa8b4ff

Download Submit
C:\Program Files (x86)\Winamp\System\albumart.w5s

Filesize
38KB

MD5
d7af4c04092842e5b4994ebed8bd05ca

SHA1
391add7a9bb2fe52da52e436b8f9c3c4546ab9d3

SHA256
c68698231754f25e069ca761d497b3c683f8166a81da076d33fc6d7489ac3769

SHA512
d02ca853abf9006c5760fc9e447633201c1d3e00b997aa75eaece259b42ff2dfa3cd4e63a87e4ecce97ccf45e2d2c0dff90d3f310d4e53de9d4d1cf32fa8b4ff

Download Submit
C:\Program Files (x86)\Winamp\System\albumart.w5s

Filesize
38KB

MD5
d7af4c04092842e5b4994ebed8bd05ca

SHA1
391add7a9bb2fe52da52e436b8f9c3c4546ab9d3

SHA256
c68698231754f25e069ca761d497b3c683f8166a81da076d33fc6d7489ac3769

SHA512
d02ca853abf9006c5760fc9e447633201c1d3e00b997aa75eaece259b42ff2dfa3cd4e63a87e4ecce97ccf45e2d2c0dff90d3f310d4e53de9d4d1cf32fa8b4ff

Download Submit
C:\Program Files (x86)\Winamp\System\bmp.w5s

Filesize
56KB

MD5
076b8084cb144b8e395dea3d3191a414

SHA1
72015b308c80a5955e68d256748af263c5edeecd

SHA256
91a1c75cd2a4cdc4a19f15e8061084ddbd9cf0fb2b03cad6d85b568254f58585

SHA512
7b960d176780e558e152c33a0897dd4f3aa5e3fe8fbfcc64eaf73785f53edcb96ff2143b2ca58499c98ac20f6c4484e6110b1880f2cf84cc5902a4607d505eea

Download Submit
C:\Program Files (x86)\Winamp\System\bmp.w5s

Filesize
56KB

MD5
076b8084cb144b8e395dea3d3191a414

SHA1
72015b308c80a5955e68d256748af263c5edeecd

SHA256
91a1c75cd2a4cdc4a19f15e8061084ddbd9cf0fb2b03cad6d85b568254f58585

SHA512
7b960d176780e558e152c33a0897dd4f3aa5e3fe8fbfcc64eaf73785f53edcb96ff2143b2ca58499c98ac20f6c4484e6110b1880f2cf84cc5902a4607d505eea

Download Submit
C:\Program Files (x86)\Winamp\System\h264.w5s

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Program Files (x86)\Winamp\System\wasabi2.w5s

Filesize
51KB

MD5
e64e27195d6c298276d518c3bdbfdc9e

SHA1
ecb372039808d0d4aad7a5594e71ccc36291f124

SHA256
2fcefbca651857ec1eddbc3e582bc5aec40277dd4c00118290ac934a4a6eb09c

SHA512
9139052d756c1553196c3d00fb534fd33fcdddde3e4e6292af9a6acc9eb2dc6fb48b47db2e3f25a59852ce68d1dbda05ffcabed777471ba9c2de8964156e8346

Download Submit
C:\Program Files (x86)\Winamp\System\wasabi2.w5s

Filesize
51KB

MD5
e64e27195d6c298276d518c3bdbfdc9e

SHA1
ecb372039808d0d4aad7a5594e71ccc36291f124

SHA256
2fcefbca651857ec1eddbc3e582bc5aec40277dd4c00118290ac934a4a6eb09c

SHA512
9139052d756c1553196c3d00fb534fd33fcdddde3e4e6292af9a6acc9eb2dc6fb48b47db2e3f25a59852ce68d1dbda05ffcabed777471ba9c2de8964156e8346

Download Submit
C:\Program Files (x86)\Winamp\elevator.exe

Filesize
97KB

MD5
59803a5bb88b88a6d83342eeb3816ad9

SHA1
cafa43cacd584deb0d54ac31ae9030f90455c6b7

SHA256
a8e9655510906994fdef3993bebabf0a5e0b6604f02c0ccc28fd31be3aa684bf

SHA512
85038570bb2fb39e7ee8994ccb3f8f9203c0d8360fea889d238c13b3b49a7ab85488edd01d3ec7e37288ffbd0db7e84cfe0353e199289a854311d27990cb9eea

Download Submit
C:\Program Files (x86)\Winamp\paths.ini

Filesize
30B

MD5
8ad85a252352aa655f18d1b9300667b1

SHA1
5d2939f3b6c29739303f2caa4560d1f5376309c6

SHA256
fb7293e289aa918d2cbc3c362cea48dd061b0e12616924460466f26df28ff05c

SHA512
aa3c14551846a2a89b7c4ecbb9ac63e3c83501de5e088634c77e92ffd068a0aa547ad5c0d06890b553469013ff0de0dfe2058de86677966ace9c4d0b8c7b5525

Download Submit
C:\Program Files (x86)\Winamp\winamp.exe

Filesize
2.3MB

MD5
ebebc6e8f41e6c04dd661a14761d75d9

SHA1
9762e726a682f54bd9606bf08867a6206a1a39f7

SHA256
addf561fcdc496c1318ddc3586352aa7f6c1feb684a9e8ffa285409beac5b446

SHA512
9493e6576fe94e4ee8aacbf10389acc21a0298eea07217c53fbfe6b87ba2dd010c9f0081c5574ac3e896720e7e9b4683adb2dcaba4231c6a9fbb738181081c3e

Download Submit
C:\Program Files (x86)\Winamp\winamp.exe

Filesize
2.3MB

MD5
ebebc6e8f41e6c04dd661a14761d75d9

SHA1
9762e726a682f54bd9606bf08867a6206a1a39f7

SHA256
addf561fcdc496c1318ddc3586352aa7f6c1feb684a9e8ffa285409beac5b446

SHA512
9493e6576fe94e4ee8aacbf10389acc21a0298eea07217c53fbfe6b87ba2dd010c9f0081c5574ac3e896720e7e9b4683adb2dcaba4231c6a9fbb738181081c3e

Download Submit
C:\Program Files (x86)\Winamp\winamp.exe

Filesize
2.3MB

MD5
ebebc6e8f41e6c04dd661a14761d75d9

SHA1
9762e726a682f54bd9606bf08867a6206a1a39f7

SHA256
addf561fcdc496c1318ddc3586352aa7f6c1feb684a9e8ffa285409beac5b446

SHA512
9493e6576fe94e4ee8aacbf10389acc21a0298eea07217c53fbfe6b87ba2dd010c9f0081c5574ac3e896720e7e9b4683adb2dcaba4231c6a9fbb738181081c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
3df5605f86a1de88d20b15f562c24f7a

SHA1
05569395d764e738b13719a682de5b24ad8aa68d

SHA256
36668fb0543b1e47eb01e09748291278b85f2325016ab5be4d2f58b9a1a5f6af

SHA512
a75f2587aabe755d939d85bae806e04dc61b572f350a3aa514921de6a0ed7dd6fc61b0937609fafd01a81ca113d6dfcc3124cfe78dd400f19544c060ad7bf347

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\AUG2009_d3dx9_42_x86.inf

Filesize
1KB

MD5
dff48361a5cb0dea034dc6f16de99477

SHA1
afa417acf7e9da37923255a623ef34c7f6446c80

SHA256
5989dc367a8f84815bcfa1c46ff756527c6250c62973220d1af354b70027eaf2

SHA512
750b69eee07e7d6e7fbdba722e2e1ce377729dca5fe52b4d57d23dd2b80b28b3af8403aa43c469a5042ad35eb09ba4dbefc40a014a137e1b5d87e0f2de203856

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\d3dx9_31.dll

Filesize
2.3MB

MD5
797e24743937d67d69f28f2cf5052ee8

SHA1
7d39afbf94675487a9ff7e41d2dbb8daedf7ad00

SHA256
e2065619fe6eb0034833b1dc0369deb4a6edc3110e38a1132eeafcf430c578a5

SHA512
8804d0d95688a932c7bf7e1a023179de8df3a5436e356b36d803cb9781f3a378adb9fe69d03b28362755b808cbeb2cc718ab920672270de0b954996996328f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\d3dx9_42.dll

Filesize
1.8MB

MD5
c6a44fc3cf2f5801561804272217b14d

SHA1
a173e7007e0f522d47eb97068df0ca43563b22bc

SHA256
f8b9cfab7fffbc8f98e41aa439d72921dc180634a1febca2a9d41a0df35d3472

SHA512
2371844bc86cdce2d1933625b921b982c4d1b84a39698b51180b09a2d45732407d721fa01d294ca92a88777607a1bb00283f6bcdd4231137a388216d0b09dd5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\dxdllreg_x86.inf

Filesize
724B

MD5
8272579b6d88f2ee435aeea19ec7603d

SHA1
6d141721b4b3a50612b4068670d9d10c1a08b4ac

SHA256
54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40

SHA512
9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\dxupdate.dll

Filesize
169KB

MD5
f851454a783aed04c3fae0ca3552fb29

SHA1
357907f085ba99a612dadd307a5d9f84eebd63fa

SHA256
4910d5e9970407c6f4db57c04a07655f01ef00bbf213e1e71a5bd9bc4a6a1c20

SHA512
2d66577cf76c6ff6ff6e3e410748af5db2801c4d370ec8865339e97235976629405a7c56ecc6e912c6307c3442a88fcc056c4c38e218d03cc4b11d045265890a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\dxupdate.dll

Filesize
169KB

MD5
f851454a783aed04c3fae0ca3552fb29

SHA1
357907f085ba99a612dadd307a5d9f84eebd63fa

SHA256
4910d5e9970407c6f4db57c04a07655f01ef00bbf213e1e71a5bd9bc4a6a1c20

SHA512
2d66577cf76c6ff6ff6e3e410748af5db2801c4d370ec8865339e97235976629405a7c56ecc6e912c6307c3442a88fcc056c4c38e218d03cc4b11d045265890a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\dxupdate.dll

Filesize
169KB

MD5
f851454a783aed04c3fae0ca3552fb29

SHA1
357907f085ba99a612dadd307a5d9f84eebd63fa

SHA256
4910d5e9970407c6f4db57c04a07655f01ef00bbf213e1e71a5bd9bc4a6a1c20

SHA512
2d66577cf76c6ff6ff6e3e410748af5db2801c4d370ec8865339e97235976629405a7c56ecc6e912c6307c3442a88fcc056c4c38e218d03cc4b11d045265890a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\dxupdate.inf

Filesize
11KB

MD5
b741088e800dcefccce8444d8db84c62

SHA1
23447e13185645454a7b0c0e83ac8949e8ba339c

SHA256
fa2880f64c17254de87dd088261f9f25e7552551c6360857ac6682ffab58dadf

SHA512
991bd0efd2aae72b8ef73bb26418de65cfb604c0e09560470048af34d192cc4b1c25faf951d1b3dc2897c3aad0c2c32da965f57a65691b51e741f6d323219cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DXF81B.tmp\oct2006_d3dx9_31_x86.inf

Filesize
1KB

MD5
8f7aa1f0f2389f3cac574652f5d6672d

SHA1
921f2161cf46c6314a330ff52c83f8a3f1058f0d

SHA256
a1c61096019a6ae1a9f31e3fe67aa2bb7e9e451967959d7088344f3f20ab572e

SHA512
a85c03ccaa27adf3c75287529f18e84f526cf91785e0f4281db0eb86feba78522603e21def19bd2a33e03ceaedd9109b8af1dbda4a3fe93fe6eb95366b6df747

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\Dialer.dll

Filesize
3KB

MD5
adea8024c99d7802fa3c9e5d34877aad

SHA1
4e015a5be3e668aa3e9758370413f2bb8ec5ad1a

SHA256
242b6aeb759e31b64e014e3df6b5c478fb309d56b4df8cdb59b2cd03bfa77db2

SHA512
717a9f08842e96e9395fe8fff19138d7e599e3dd4f44b7b55d9be86211f20cd89a1d315df1f241afc52456da738623401ee721b17e9fd5949fe1decfc1b2819d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\SHELLD~1.DLL

Filesize
4KB

MD5
9c266c2dc7eca5bcab2d8df4990e0c1f

SHA1
662da3d9ca18aacdbaef884065fbfffdfacfabfa

SHA256
ea7800b89e49e7d7214c1405b4906f366096dfadff28d0732acb90ab2e9a99bd

SHA512
e9318db79b02df6b3b72ed16c5d70e4b46bab71f31544ce0323cd6dae739be1948a9d3a468977d703576d7f33580e3be5d1d1ace1fb29cee9dfe325c6e828139

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\ShellDispatch.dll

Filesize
4KB

MD5
9c266c2dc7eca5bcab2d8df4990e0c1f

SHA1
662da3d9ca18aacdbaef884065fbfffdfacfabfa

SHA256
ea7800b89e49e7d7214c1405b4906f366096dfadff28d0732acb90ab2e9a99bd

SHA512
e9318db79b02df6b3b72ed16c5d70e4b46bab71f31544ce0323cd6dae739be1948a9d3a468977d703576d7f33580e3be5d1d1ace1fb29cee9dfe325c6e828139

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\execDos.dll

Filesize
5KB

MD5
0deb397ca1e716bb7b15e1754e52b2ac

SHA1
fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

SHA256
720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

SHA512
507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\execDos.dll

Filesize
5KB

MD5
0deb397ca1e716bb7b15e1754e52b2ac

SHA1
fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

SHA256
720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

SHA512
507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\install.ini

Filesize
26B

MD5
385081d5feee87a4ed1a6e5dcee85f36

SHA1
8517162855b477e5498e95ff2e82584ef06d5c6d

SHA256
bdc6fb93206c1e7a590f2d4e97d0dab7d3badaf8b4e1a7b8487e9cf59f05eddc

SHA512
52bcb1cdae8abbe4b14ff85b57e03426d61e5cb25b1535a827af526ec66c00ae0a327b187cd10279cf18c379c912d3e478ef9966bb497a8b626824fe32d1093f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\install.ini

Filesize
1KB

MD5
c19ee2c5b690b399abcc33529b678166

SHA1
5a5eaa90d2c5aa30df12e5e06f5f4aca67c3e503

SHA256
3939b2c681bbd46f6966cd80fbf77d2497db1b320cd25a0f03eaaed980ea2d8a

SHA512
338c75ca320b69680ef1e2e7103b0d3625f44f412ac78b5b6771811e13f30aeff3dd2afc5e8a7f2df8cd8be74140305c7f4710134b068f3cc790043048cd5999

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\modern-wizard.bmp

Filesize
150KB

MD5
2d63e33fa1cf672338a22c88fa45e6a0

SHA1
86c510009d6c71d05eb2707fe6a10039df525192

SHA256
7ae875cfcb6e3b1f4a06460fbda99d8014dc4674ee256b0b79ec656777c7e292

SHA512
d42a7401c1d0d77d517d2f8086286bd6cf487cf5400cd8b8d720bcaf15149727751677f444fd9a8e340072deabad51347956894c1c034dd81df793b3b8087252

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\nsExec.dll

Filesize
7KB

MD5
675c4948e1efc929edcabfe67148eddd

SHA1
f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

SHA256
1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

SHA512
61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\nsis_winamp.dll

Filesize
4KB

MD5
1e1ded1cf1c69852f2074693459fb3b5

SHA1
81b165cae4d38a98760131989fdd8aed2c918679

SHA256
5946278545abbd0b0f5188752fe095e200c85abe0783632a00726d090c0753ec

SHA512
a6f9a43d4432658c3504629e9209ad350af69eff542d139e0ccfe0dbf8662f15034edd3cf8b56d606a740b66c8221cafad999088a4e64a4c9c9fb47793a19f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\nsisdl.dll

Filesize
15KB

MD5
ee68463fed225c5c98d800bdbd205598

SHA1
306364af624de3028e2078c4d8c234fa497bd723

SHA256
419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

SHA512
b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\wadxsetup.exe

Filesize
2.1MB

MD5
4e4682f1e7a6b6846e0f99612fc41d06

SHA1
28536e23ef7ad8049993b8466a102c325056d501

SHA256
3cc08f9d13e787779195fa04e0fc940247ff8db29f7a34108ab16f2f6c02d452

SHA512
56db7c621e893742581c92941fc65b028014b24267c824767cfb1e95a396cb6370ea269411c247b87a8c2bdebc42d572a0b1b29982a118fccd184621664a3ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoC4BE.tmp\wadxsetup.exe

Filesize
2.1MB

MD5
4e4682f1e7a6b6846e0f99612fc41d06

SHA1
28536e23ef7ad8049993b8466a102c325056d501

SHA256
3cc08f9d13e787779195fa04e0fc940247ff8db29f7a34108ab16f2f6c02d452

SHA512
56db7c621e893742581c92941fc65b028014b24267c824767cfb1e95a396cb6370ea269411c247b87a8c2bdebc42d572a0b1b29982a118fccd184621664a3ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\D3DX9_~1\Aug2009_d3dx9_42_x86.cab

Filesize
711KB

MD5
bea370e85329d63aed0e601bd1cce9cf

SHA1
be796b6c3cff05abfcb20e1ef010d8399e38ebfd

SHA256
50428a21e1e1f647586c59b9b3825812355cae5ff99d9c95c346823289691025

SHA512
5ea524c20e79938ac8b591f7e3a79684296a9cdf821eb07bac6c369a4e784ed23e072d18aecad2e1812c5deb49206b45bae4130efdb95b28fdc13a07c9a09314

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\D3DX9_~1\Oct2006_d3dx9_31_x86.cab

Filesize
1.1MB

MD5
1d624c9b848f0a9756ca681d018d1520

SHA1
e66a8258696cd513475cba595e954c67901aa736

SHA256
35ec07756bdd05aa196f06350b51e3d958d39e342169a1b9168be04548ad02e7

SHA512
cd4b8d661222b4143caa8d71a2ee3461a3b69647050d994ca5ddfd75f3559da3c0971534bc6eec008325b09de47647bfb3f0ae578303ae793816ea504f015568

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\D3DX9_~1\dxdllreg_x86.cab

Filesize
43KB

MD5
fcfaf7bb73cc636fb619289bfb0058ce

SHA1
2f1fb2a0efbfc9aad4100e1ab0c038db523f1384

SHA256
e3812531b6a056ec274af869d222d86d5e95e720d14d59778972c79a8444708c

SHA512
91e129fdae9732a1615b2a4f43f2d1dbdff83c4c6ddbed0c91f68419a55c2afc3cdd7fee4626e0579e1394f0f57e88eda047352e7025f2b875434e6cba8b3c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\D3DX9_~1\dxupdate.cab

Filesize
93KB

MD5
e52ed09fbdfbb180315362c1341e0664

SHA1
2c9975074a4d83a7909761281dcd8aff614370fd

SHA256
dd2a20aedc84ab4844c69d4fd144a2eb661f7597faa0fa25269cb69d1b867f9f

SHA512
97f50a297bd7291906e2dca1ff8db3d6ea539480d656d1f82e378661da77ac645d5d94af3d584bcdfb65eef7fbc3b77c7d27ca870226d74eeceb4e0ceb248353

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\DSETUP.dll

Filesize
91KB

MD5
4d5f3f32d95af43d59e63575c7a6a05f

SHA1
d8afc8796675598d777db498e541e713250fd8b9

SHA256
2d44d36146a3982087bcdcb923bfd9213846917eea99f1e709d156ca99a68753

SHA512
668be7dded74e1ea8d089629b5a355da64017c4a599ef826bc9c852adcbb7ed7344d550af639e7fa2dac3d06ce6c1aaa930f6bbd1698073d48e14710f193db69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\DSETUP32.DLL

Filesize
1.6MB

MD5
b8edfadd157dd8279ab65a0cee08d688

SHA1
6bbc3ed8e6a2bb652720d986903d0d6b7614bf07

SHA256
db85fffec4c78d3796c2a07824fd94f7ebc58d70a4fc4a18099655f016c2bbae

SHA512
78b96577cf25b9475fb2d8bbb097ea4af39027992da6f6b7859d4b2aaa6de2434868c456bdcb940754925842f7573b42db675efdf9a2b242b32f05c1b7b46b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\DXSETUP.exe

Filesize
513KB

MD5
9e970eb020ec22032dbbd0bd8c2c659f

SHA1
90f13de2a28ab89b835ceb8cbd352adfd5ae3c95

SHA256
9c9335d2b4aaeea8e780eae30959825aa3412b15257f931d17ad8a78fccde128

SHA512
3067c51ed5adfca30a79f2c8ba3b27beac378009048b89f70e2834337fcdb4033e22d0aec8857ff9fcc0fb349ff58620f9ea5ca9acabe9512f89963c2d4b4a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\dsetup.dll

Filesize
91KB

MD5
4d5f3f32d95af43d59e63575c7a6a05f

SHA1
d8afc8796675598d777db498e541e713250fd8b9

SHA256
2d44d36146a3982087bcdcb923bfd9213846917eea99f1e709d156ca99a68753

SHA512
668be7dded74e1ea8d089629b5a355da64017c4a599ef826bc9c852adcbb7ed7344d550af639e7fa2dac3d06ce6c1aaa930f6bbd1698073d48e14710f193db69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\dsetup32.dll

Filesize
1.6MB

MD5
b8edfadd157dd8279ab65a0cee08d688

SHA1
6bbc3ed8e6a2bb652720d986903d0d6b7614bf07

SHA256
db85fffec4c78d3796c2a07824fd94f7ebc58d70a4fc4a18099655f016c2bbae

SHA512
78b96577cf25b9475fb2d8bbb097ea4af39027992da6f6b7859d4b2aaa6de2434868c456bdcb940754925842f7573b42db675efdf9a2b242b32f05c1b7b46b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst8EC5.tmp\d3dx9_31_42_x86\dxsetup.exe

Filesize
513KB

MD5
9e970eb020ec22032dbbd0bd8c2c659f

SHA1
90f13de2a28ab89b835ceb8cbd352adfd5ae3c95

SHA256
9c9335d2b4aaeea8e780eae30959825aa3412b15257f931d17ad8a78fccde128

SHA512
3067c51ed5adfca30a79f2c8ba3b27beac378009048b89f70e2834337fcdb4033e22d0aec8857ff9fcc0fb349ff58620f9ea5ca9acabe9512f89963c2d4b4a89

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\feedback.ini

Filesize
884B

MD5
34596887db65b4d559bd92adbbd58eb3

SHA1
a610a496b41bc38bdb43e04b64c1e8ee2703fb8d

SHA256
b481b979a63b97651e2231b684e8d98f7c8a8e77163beeea49710a90da03c566

SHA512
115cee2deece2c0a5e83a68e14252272c9bdc2b8102fa33d21d56dd3db0bdf764b093fd4faca1afafcc3c92f8df065bd782c4d7b97c43a92b43b3761be3aa6dd

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
893f2569e001555fe1d4be265383a7cc

SHA1
16a2cd7a1e642c85539e0ac3b831006c4b85469a

SHA256
c47b0996767cb76a2f37f46d8b01cc092693c1af0de5ada52dfddf22c93a0a26

SHA512
1c8ff7de27acb657fb7ca029ad1d55ec494e8601943220d48428b5633274a6d65f5b5c510468cac1ec03cfc1e7fa4ef265cf9e39c75693e68d2945809e95f8c5

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
7037ddb870899408bba28b37eb32cacc

SHA1
1ed6cc99bbc6c65018b7f3c534ded93f07c272ad

SHA256
86684e20584fb4203a904257d6923957658a78216f2988e957f9bd4e917ddd4a

SHA512
7389e27a3c6c8257648a6cf20065e7dcd0a53b05e658d17ed071c702afd0e55fc93184fd751a0be944001b1ee4cdd081e52ee6c80ba6fd7a31cd869d485f8f20

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
189fcd5e25b5306777911f8f21c1c06b

SHA1
6b0f8a58ca903fb4cc6f49751c2056d557063d1f

SHA256
9baf9bfa639e6bbdde091e7bce8982b02d8697e5331fda72a07f7bc3a90b4288

SHA512
f0e3bc263b480873f566832c4c5ca44d02d9ea01ac877a91dc3ea8f6f4619034cfcefc0642a21b7c66b7d05fb83757d85d4085e27f139202e14bc95508b587ca

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
93cf40a435e39fda4dc4c93049a1a8ab

SHA1
d3aea0b2e4cbb6fe5b517900d15f86a13b344c88

SHA256
9b372b57d7e6661102b6e3d86145827ce1f16207da92c248865a5196cd0cf53d

SHA512
53490ee5a69404996281e9ee001d7a1d3d1c7ac7f4dc46ae15ce2ccc5f347f54725144ba829ad59ae01cc7a78c88fc60fa1dcabc5ea4d54b29eac966fffb4d0d

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
79a917c70759e8dc82bae56fdceb71f5

SHA1
70d87613295f36e58a7eee2c358c57ecf9111a38

SHA256
5824a486db73bf20f718d12379927589ceaee493021477d46319ec91a812c361

SHA512
603e6135d6b5a1e5f9f9394c4b9e14d2cf5578385d7c9adb7fe8380bc9153af2784f02fbe41f18854f55ddf78af22198967f694d06a0c90236f0901c25801663

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini

Filesize
1KB

MD5
b5d6d7a5de7e67d53eec7768846ad879

SHA1
b0be6407c38ad919318b4443d25d95c322f44631

SHA256
4b66ae51cf4a45369fa783871350616129d153e8377149283e34551c56f2a881

SHA512
68572f2c3e687ad3c311d98b5508b3214c3d46762d57c704c0170d2de30ec0a712fd67b55fdc654f8fe7e5657eb5bd038602e5e720229d7648316f20eaad06f3

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.n3w00001264

Filesize
466B

MD5
763526d5efa737d367b94e2eb13645c4

SHA1
5242d8ce2aa3dc59acd896a0a1de7bff3d9fe263

SHA256
253b66efe7fca452eecb4fecb2e237b0d3439d97ef404a0adb5f7fd84e3285f7

SHA512
b8dfc033f076a990acc52a90aed9430da761267340ccd20b82343f944b63873cadc2a1c4d241e049d8cd8585dee792fde5ef80d46390afdce69a064fd03b2a00

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.o1d00001264

Filesize
8B

MD5
76a66845f666c52790c3442f7e1a491a

SHA1
e392a609d9dc81fab060d8aece449fe616a40053

SHA256
101f682d9c519400a4d36b6a09cf0dd39a9faab6353b3ce0eb2f071860b6d05a

SHA512
71a6ab36ebfb6ff89ec6fbedfd1982fe0fb7e8c76981d24467eb73a924dc96cc4a0483381beead6517f829fa8babead0176a8df229072040564e708d99b4c783

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.o1d00001264

Filesize
466B

MD5
e6c817569301896912f64c487188722f

SHA1
4e681092008956b0dbe6e4f04b872d9dc3b3269a

SHA256
c73eeab81b0a78ae7bc95fa9db965328c0f2d5f3d5dad738464a495de82afe71

SHA512
a5f4c1f7acaa630a1fdf14b7c9f45e85475c988cdb6ed42285f0cd50c9fc1ca441ab05af75a136f8ef8d2ffa82d8530694629f6b391cff0d43ccd9bec611ab3f

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.o1d00001264

Filesize
466B

MD5
ec98751b140ec21b2485dc017980fc1b

SHA1
2fba3849888a44191f92b70ca5db419204cd8b12

SHA256
6e72410854236131a8600385d2160bf2c0134ecda149240cfc85d37d7fc94386

SHA512
c9fb494875d050353ae137782e31c42fe87b5d7c6ca86b775d9ac5d021a168cfd23d9e44f24172f4b7ed5550ce30be16e293152a4d202716eef1bc983956d2e8

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.o1d00001264

Filesize
650B

MD5
a903bdfb34496a37e884dd8ee7185c34

SHA1
4d78b707d2be8da71df52cdf724631e58a5a8550

SHA256
1c77d11e316c5c5a9b7883f628dfcfd76d7e6f281b4c89af5c4989912ba1a541

SHA512
783dce56429f2cf9a015ae518635f4fbc2defdf7b395da84e0e066904c24a8e7494a4d723db5cb2cb053915fb3b8b6974fea5adab55350498b73b58e76ea0f90

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.dat.o1d00001264

Filesize
838B

MD5
f23987d6141477a2beb8de2d83dabba9

SHA1
08b16e2374999f510771b2e2b16292575858f749

SHA256
0d7d6cd2985daf13305f00ea3d06cf539772bde0aa3e83c5bd010ff19d82ac74

SHA512
94b195e537ae65141abbf6dde621ca3e6b3e1114d5e8a6affa7fdaef46021987eb3f5646402f0df1b53e002019bc541dc13a0b836132f10dc21d6a5e1d08efdc

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.idx

Filesize
68B

MD5
d39305c16a773b222871032c4148600e

SHA1
196b2a21dabfd3d001e2c79f3fdc7c411c4ca261

SHA256
01786514a6a5bb357099b7c11c23615c0e8e6e07aced1f3764f034b6a6be8d29

SHA512
bc16b755eb56da66ff8290d1498c9ebbe7a29e27c50a4326cf3cd9018d20c13bccb4d23e63429e07ac33e323ec19e11a69ad2e25c1b5a4a67341ea2019862093

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.idx

Filesize
84B

MD5
a8f2604d213243234a46f0665e9a67e5

SHA1
61681c4b01a890ffd2a94b4a2c234d2cb75f78d0

SHA256
25694984833b6ca4d4ae4bd6552681969e58cd33c606d2d323e755ca55f61743

SHA512
bcdd1ff971dfa4980df5ac6a48250bc4c76a502a43c7dae7af87d63660929dd00cb6f6c18b0ef9dba009da7428b453c9a6c03066be7b8c79febfa95ab459f439

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.idx

Filesize
100B

MD5
3d93c3cb1d8a029aaa4fa3e6b9d617b2

SHA1
2b3c58cc9f0296089adee00316bd57db55137755

SHA256
3b77cc55f259f4db89e317c9bcd04a02c2aecd274237e84408eb82dfd7f68b5e

SHA512
a8ab25aef484e658b15e09f1fe1681ab4d5d992599bee21bf66093a48620417567f3cb69d278998fa4d381d4f1e0a2187255fb8fc826af491a81c84281e1d64c

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\recent.idx.o1d00001264

Filesize
32B

MD5
137faa0c3baa69f733eaadb966b64ade

SHA1
a55982685efc19bb0afffa2eb1f3750241480eb8

SHA256
9cc291dcb5847e7f0e6d4bf322164461c6607da934ce9d376c0e15f7ddd33181

SHA512
b6286a581aa3d1add62836804a1fc79a2399fd6fa7144945b47f2ff8c0ebe88af3f289bee95db0cae1aa7c532b487a4bb6a9e65710c581afa2b7f13989885d78

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metD613.vmd

Filesize
910B

MD5
fa6b6eaa81a2662b8c45b126727ea832

SHA1
6087f9505d21819ed2f656517a0a13664aeead2b

SHA256
370be262ff415bed2a40f450f69dfce660e3e635af0924dca0c1f118e489c046

SHA512
f26688d6236021172c0f2d001e5636f018fef9ba7c7fadf688bd78fb1f9633c766cdf9ff2581997bc7af8a5ffd92da19cba699a46a64a555ccc0e7e57bd7b3c1

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metE5E5.vmd

Filesize
174B

MD5
9936bebab9c4e0e2aac7dceffc42dbac

SHA1
c1d2b8ceed49c904db7f174e06cc4e8ef851a87b

SHA256
ee730918e759544d7d087fe0b2e0aee12145ec36ecd4f4aced4336d85503a124

SHA512
16a5da57970c1d9b0e00bd8ac21ad53260b48db7b7b8bdb1953c625e8b6a9a132afa53fcb835163b73fe6a5dae40aa5ddffda9a11f42e8942c07b180363f2ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metE5E5.vmd

Filesize
378B

MD5
cee34ec499ffa0d63136e0d515255f02

SHA1
1e2cc9256a698fcf7ad8c7e4737757f0f01e5afa

SHA256
0cb5f1e37305e87180403dc0f09b1a419125048cb61440931adda39d7aa4c51f

SHA512
87a0548a42d2ccf94b66144664c3488d9a953342c60f15811f1f8c4b58af0c0b4d7b4d09be104eb88a85e67befdbe1122a5fa274dbbd8e54a6c66ea2ea2c1970

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metF5B7.vmd

Filesize
126B

MD5
2cdaffaec77db6248825896e5c424893

SHA1
fc8df8ddc7811bfcf8f426dce0316c7eb6366b69

SHA256
6217223a02d019b85e566e2804ae6ae4dd3643c95578279a27909c9eedbdb961

SHA512
387e12cab715c8d9530b21725808c91bface84949f03d17312890464ec53ffbd79ce3a83685e0897e208a2e26e85c8296b848d91b0677df1bac446c229cfe05e

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\views\metF5B7.vmd

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Winamp.ini

Filesize
237B

MD5
422639bbd97cac8a4d2a2c5d55bb1722

SHA1
f7d5ada78a83c462804aa6061ef2b19f7f549278

SHA256
d947679d0adf6b2416544b416002f217b7e6ccbdcd28245dd6b4b0cee06f233e

SHA512
c8ac6b9bae1ea10717a1f174ece8499d74db5bc0de309b3889507a93eb61389bacb4098cecf6bf43c89c8459d1f16c2d07f8ad6fa16a65aea615cd2976dc8e9e

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\Winamp.q1

Filesize
4KB

MD5
d24f1b829d1bd197e157b12d19c220e9

SHA1
555274f63e5b6ddbbd548179754fd0b2cbddf888

SHA256
58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8

SHA512
55c5c6bc1c466eebde84b98e024d774711bc1f1e32b28842d77eaea93dc030878e74012ea48179925313490b7c77d07383213ebb63d691228d2333e4217b33fc

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\demo.mp3

Filesize
38KB

MD5
b1f7fda2468b603efd7909cdb7324a6a

SHA1
1928495b4eba3ae755d67ab8a0fcd8b2c7db7243

SHA256
0be37a368b416b6bed460ca2ea7a98de99be91d7c00132c07dcf0cf1b43155d6

SHA512
eed2839917fb036e4e129abd0bf5f190f0f0978a3e9b1a06035e0009fd47ef97cb01886d1db61b64cd14156eefac2ed29b0dbea17083532445a18bbc58669cdb

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
57B

MD5
86648cf329bfffe3b80e5e142f118b1f

SHA1
237f591c4f9ae6a64e879843f2bfb7d69f160b34

SHA256
27c2cfd1b6d2a603447a99dc52005f8e8b85327f070ad96839ad9385a9c0a31a

SHA512
9b6c306f6dbf8f6df22db430c4abde6a2cd694fe2a3666975fbadc298a4abaaf00e7924646f92d50eb990081435b78487427fe7bfd66305994cc2e4225137cbe

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
277B

MD5
5063d154a9c2092f575d1d67bff9c2f5

SHA1
9cc0d916fb1229325e63769806b12ac4f57921d9

SHA256
1fefef8d30d4b5a98ef7d3740e0da2e460940a3f0e33f9023ef964ea16614fd2

SHA512
6ae68348336e5ae0590c6e7691715b47b075a3da7a2b356f7919b221cfcd44241cc9b50f564a0ac6f18b3f2eb697953b94de6802f8909172e2329e73e896a0ba

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
292B

MD5
a4b6f0d5771299a9cf3aa80fae25288e

SHA1
ed0aa42de78b8574d58a633eb366833ad18d5100

SHA256
859006cd28ab085f79f0415f34ae94c1ad1b5e38ab315d16aa6d7520960e658a

SHA512
3d902f53d01398964035231bf915e97a21216c85acbb4388ff676b006545a0526d36f2bd23d190d7c6c1f1df837d921287198340fc6f918e9ccf6c751c5875a2

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
300B

MD5
0244d44194e43b977975f1ca5b83b01b

SHA1
6688bcf21bd670a32ae356f51a77903e7d97071e

SHA256
c7d9e899e9f8e3e28ec4b5be469733025987d5143f7d8373f797b4b13af9e2da

SHA512
492b24fc234421be1fe0faefd31f9ba377cf5e996c2063df3393c7fe3d1d2382af2cefd3309b9c1077bc2ad273538a3f02dcc19fc32e4c7ca54b9b03cc0f79a5

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
312B

MD5
3f3f3413bd68ee57eac0b7852fd79ced

SHA1
cfdea5c1a8fa17a1f6c60d0d4c11954b0a475b81

SHA256
bc0cdc3b3c9b1ebf34fb0111eddf306ad81db34cb41d75f6abf677fc53546a55

SHA512
893460aaeee2d63dfc74e7a3ddb9e79b6d6e8f945f08b5f8254aa24dea0bb18c44f05a5d98931ef019bb98a6ec66d82898e8b763f1a89ca7c74725a0eb62e669

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
1KB

MD5
cdd2855798e0cb5851883506808f76cb

SHA1
00c39b8ab793e2626200997c423c0a9444737e12

SHA256
023f874cc1404bf3d30803cbde0d69d7c6bc47f60e75e5d1708c2ef35dcffbf9

SHA512
ecc510eeaa100aa21fd6b74a3b9b9542272909f7f92f5c025876370edd4e0e00ad9756ec2c7b59a9a79745b27ab7fa19dc7e89c698db4caea74351567c17e777

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
1KB

MD5
f29124048bc9c1248b56fcd63d1963d7

SHA1
b8c9d12a0051741589d87ff0fff0a93d1feb1310

SHA256
1ac8cb3c0244eb8440c7601516f33b19725d52e6e2158f6ccf7652dcd82af713

SHA512
4d2b45c88fb286ee647a17f7a60abc885a991685685015416cb984485304dd94078034867514f9f534a88f4f9f7424e39f7fbef4ba02d27e6a7b68dce4b82634

Download Submit
C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini

Filesize
1KB

MD5
ccf4b1434a81fd082e04095cf2d5cdb6

SHA1
b84cee0d31e157a42ee48a166e48f149f92bcaef

SHA256
a566ff5fb324ee3b9dc868c5001079364cbe8564a50d443c1f8bbd18db8b1354

SHA512
36c57711e8d1d6dbd128c9a89d5ba68a22fd4cfb857ee0c0f806e6eca1bec48b5b0e292892ad05783aa89e5fab25695b0db3bd82c806c04346737904e566f656

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
9KB

MD5
be8abfc2c08402024e3a8ce65242ea8a

SHA1
45f97d1cccc794899c08f4bda3e2fdae9d99722f

SHA256
c061dffd0bad2b1e8a038524c65e55c14770d3b10bf3e8a4cb30453c2389e3dd

SHA512
3bc5a7e6d279109b6a82e97a7352dad3604a776d93024b45532d1f6dfce0247a8ef2dc0176295c82231327b9cc624958aaa46b583c34afe82b3fd3b0da446bbd

Download Submit
memory/1112-3355-0x0000000005570000-0x0000000005590000-memory.dmp

Filesize
128KB

Download
memory/1112-3346-0x0000000005500000-0x000000000551F000-memory.dmp

Filesize
124KB

Download
memory/1112-3695-0x0000000005910000-0x000000000593B000-memory.dmp

Filesize
172KB

Download
memory/1112-3697-0x0000000005900000-0x000000000590D000-memory.dmp

Filesize
52KB

Download
memory/1112-3698-0x00000000059B0000-0x0000000005A2F000-memory.dmp

Filesize
508KB

Download
memory/1112-3700-0x0000000005950000-0x000000000595D000-memory.dmp

Filesize
52KB

Download
memory/1112-3701-0x0000000005950000-0x0000000005991000-memory.dmp

Filesize
260KB

Download
memory/1112-3702-0x0000000005950000-0x000000000597F000-memory.dmp

Filesize
188KB

Download
memory/1112-3703-0x0000000005950000-0x0000000005963000-memory.dmp

Filesize
76KB

Download
memory/1112-3704-0x0000000005950000-0x0000000005964000-memory.dmp

Filesize
80KB

Download
memory/1112-3705-0x0000000005A30000-0x0000000005ABA000-memory.dmp

Filesize
552KB

Download
memory/1112-3707-0x0000000005950000-0x000000000597A000-memory.dmp

Filesize
168KB

Download
memory/1112-3709-0x0000000005950000-0x000000000599E000-memory.dmp

Filesize
312KB

Download
memory/1112-3711-0x0000000005A30000-0x0000000005A82000-memory.dmp

Filesize
328KB

Download
memory/1112-3713-0x0000000005950000-0x000000000595C000-memory.dmp

Filesize
48KB

Download
memory/1112-3714-0x0000000005950000-0x000000000595D000-memory.dmp

Filesize
52KB

Download
memory/1112-3715-0x0000000005950000-0x0000000005978000-memory.dmp

Filesize
160KB

Download
memory/1112-3388-0x0000000005820000-0x000000000584F000-memory.dmp

Filesize
188KB

Download
memory/1112-3384-0x00000000055E0000-0x0000000005801000-memory.dmp

Filesize
2.1MB

Download
memory/1112-3357-0x00000000055A0000-0x00000000055C0000-memory.dmp

Filesize
128KB

Download
memory/1112-3270-0x0000000004ED0000-0x0000000004EDE000-memory.dmp

Filesize
56KB

Download
memory/1112-3271-0x0000000004F30000-0x0000000004F6F000-memory.dmp

Filesize
252KB

Download
memory/1112-3350-0x0000000005530000-0x0000000005554000-memory.dmp

Filesize
144KB

Download
memory/1112-3269-0x0000000004EB0000-0x0000000004EBD000-memory.dmp

Filesize
52KB

Download
memory/1112-3267-0x0000000004E90000-0x0000000004E9F000-memory.dmp

Filesize
60KB

Download
memory/1112-3446-0x0000000005880000-0x0000000005895000-memory.dmp

Filesize
84KB

Download
memory/1112-3264-0x0000000004E70000-0x0000000004E7B000-memory.dmp

Filesize
44KB

Download
memory/1112-3254-0x0000000004DF0000-0x0000000004E22000-memory.dmp

Filesize
200KB

Download
memory/1112-3344-0x00000000054D0000-0x00000000054E2000-memory.dmp

Filesize
72KB

Download
memory/1112-3153-0x00000000044D0000-0x000000000453A000-memory.dmp

Filesize
424KB

Download
memory/1112-3340-0x0000000005470000-0x00000000054B8000-memory.dmp

Filesize
288KB

Download
memory/1112-3327-0x0000000005420000-0x000000000543A000-memory.dmp

Filesize
104KB

Download
memory/1112-3325-0x0000000005400000-0x000000000540F000-memory.dmp

Filesize
60KB

Download
memory/1112-3321-0x00000000053B0000-0x00000000053D2000-memory.dmp

Filesize
136KB

Download
memory/1112-3319-0x0000000005370000-0x0000000005396000-memory.dmp

Filesize
152KB

Download
memory/1112-3285-0x00000000051E0000-0x0000000005205000-memory.dmp

Filesize
148KB

Download
memory/1112-3284-0x0000000005160000-0x000000000518C000-memory.dmp

Filesize
176KB

Download
memory/1112-3280-0x00000000050D0000-0x00000000050E2000-memory.dmp

Filesize
72KB

Download
memory/1112-3281-0x0000000005100000-0x000000000510F000-memory.dmp

Filesize
60KB

Download
memory/1112-3124-0x00000000044B0000-0x00000000044C7000-memory.dmp

Filesize
92KB

Download
memory/1112-3272-0x0000000004FA0000-0x0000000004FF6000-memory.dmp

Filesize
344KB

Download
memory/1112-3274-0x0000000005030000-0x0000000005051000-memory.dmp

Filesize
132KB

Download
memory/1112-3277-0x0000000005070000-0x000000000509A000-memory.dmp

Filesize
168KB

Download
memory/1112-3282-0x0000000005120000-0x000000000514F000-memory.dmp

Filesize
188KB

Download
memory/4708-4730-0x0000000007FD0000-0x0000000008010000-memory.dmp

Filesize
256KB

Download
memory/4708-4924-0x0000000007FD0000-0x0000000008010000-memory.dmp

Filesize
256KB

Download
memory/4708-4926-0x0000000007FD0000-0x0000000008010000-memory.dmp

Filesize
256KB

Download
memory/4708-4925-0x0000000007FD0000-0x0000000008010000-memory.dmp

Filesize
256KB

Download
memory/4708-4927-0x0000000007FD0000-0x0000000008010000-memory.dmp

Filesize
256KB

Download
memory/4708-4703-0x0000000007FD0000-0x0000000008010000-memory.dmp

Filesize
256KB

Download
memory/4708-4705-0x0000000007FD0000-0x0000000008010000-memory.dmp

Filesize
256KB

Download