d7e594d72b44527056efc6e867ca0c0484c2c4e7c4091c108e9f5a1c1a20a630

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BetterSoundCloud.0.6.0.Setup.exe
Size 116.0MB
Sample260503-24gp1adv2p
SHA256 d7e594d72b44527056efc6e867ca0c0484c2c4e7c4091c108e9f5a1c1a20a630
MD5 e5cb3232bb0c0c487ca35d28d15d9260
SHA1 01e9bf82b44e2071e78c7c2cddaffad38def263e
SHA512 145e6597260f8150bcb0870b4ccf9e5748a81b59652188f96b34b5d6b3545242d3b94aab9e819fd7ee534cd03598bf6d2ac45cdbf8cd26fae15e993406b7487d
SSDEEP 3145728:9KLKwk8PnbbJH2Ry0T+tpnvnI1wiRz4OMwuAaE9Qjq:M5k8PbJkyXpvIiW1MRAaEQq
TLSH
T1A7483390EF68416CE937693B19E7E3246182B633DB9B8967266403C17B026D3F7FC950
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
230	5212	powershell.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	bettersoundcloud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	Update.exe

Executes dropped EXE 18 IoCs

pid	Process
4184	Update.exe
392	Squirrel.exe
2760	bettersoundcloud.exe
3864	bettersoundcloud.exe
2384	bettersoundcloud.exe
4732	bettersoundcloud.exe
4200	bettersoundcloud.exe
2484	bettersoundcloud.exe
1464	bettersoundcloud.exe
4540	bettersoundcloud.exe
1036	bettersoundcloud.exe
4092	bettersoundcloud.exe
660	bettersoundcloud.exe
2296	bettersoundcloud.exe
3504	bettersoundcloud.exe
3256	bettersoundcloud.exe
2520	rename.exe
2384	rename.exe

Loads dropped DLL 24 IoCs

pid	Process
2760	bettersoundcloud.exe
3864	bettersoundcloud.exe
2384	bettersoundcloud.exe
4732	bettersoundcloud.exe
3864	bettersoundcloud.exe
3864	bettersoundcloud.exe
3864	bettersoundcloud.exe
3864	bettersoundcloud.exe
3864	bettersoundcloud.exe
4200	bettersoundcloud.exe
2484	bettersoundcloud.exe
1464	bettersoundcloud.exe
4540	bettersoundcloud.exe
1036	bettersoundcloud.exe
4092	bettersoundcloud.exe
660	bettersoundcloud.exe
4092	bettersoundcloud.exe
4092	bettersoundcloud.exe
4092	bettersoundcloud.exe
4092	bettersoundcloud.exe
4092	bettersoundcloud.exe
2296	bettersoundcloud.exe
3504	bettersoundcloud.exe
3256	bettersoundcloud.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 40 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
32	raw.githubusercontent.com
36	raw.githubusercontent.com
132	raw.githubusercontent.com
141	raw.githubusercontent.com
27	raw.githubusercontent.com
40	raw.githubusercontent.com
125	raw.githubusercontent.com
129	raw.githubusercontent.com
144	raw.githubusercontent.com
145	raw.githubusercontent.com
127	raw.githubusercontent.com
152	raw.githubusercontent.com
154	raw.githubusercontent.com
34	raw.githubusercontent.com
39	raw.githubusercontent.com
146	raw.githubusercontent.com
155	raw.githubusercontent.com
142	raw.githubusercontent.com
143	raw.githubusercontent.com
38	raw.githubusercontent.com
35	raw.githubusercontent.com
37	raw.githubusercontent.com
28	raw.githubusercontent.com
130	raw.githubusercontent.com
148	raw.githubusercontent.com
150	raw.githubusercontent.com
22	raw.githubusercontent.com
26	raw.githubusercontent.com
31	raw.githubusercontent.com
41	raw.githubusercontent.com
126	raw.githubusercontent.com
131	raw.githubusercontent.com
138	raw.githubusercontent.com
149	raw.githubusercontent.com
33	raw.githubusercontent.com
128	raw.githubusercontent.com
147	raw.githubusercontent.com
151	raw.githubusercontent.com
153	raw.githubusercontent.com

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	rename.exe
\??\VBoxMiniRdrDN	rename.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BetterSoundCloud.0.6.0.Setup.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	rename.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rename.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	rename.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{2593DEA1-2FF9-4111-9697-E2E08E211697}	bettersoundcloud.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4184	Update.exe
4184	Update.exe
5212	powershell.exe
5212	powershell.exe
5212	powershell.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeShutdownPrivilege	2760	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	2760	bettersoundcloud.exe
Token: SeDebugPrivilege	4184	Update.exe
Token: SeShutdownPrivilege	1036	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	1036	bettersoundcloud.exe
Token: SeShutdownPrivilege	1036	bettersoundcloud.exe
Token: SeCreatePagefilePrivilege	1036	bettersoundcloud.exe
Token: SeDebugPrivilege	4980	firefox.exe
Token: SeDebugPrivilege	4980	firefox.exe
Token: SeDebugPrivilege	5212	powershell.exe
Token: SeSystemEnvironmentPrivilege	2520	rename.exe
Token: SeSystemEnvironmentPrivilege	536	rename.exe
Token: SeDebugPrivilege	4980	firefox.exe
Token: SeDebugPrivilege	4980	firefox.exe
Token: SeDebugPrivilege	4980	firefox.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
4184	Update.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
2760	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe
1036	bettersoundcloud.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4184	1240	BetterSoundCloud.0.6.0.Setup.exe	84
PID 4184 wrote to memory of 392	4184	Update.exe	85
PID 4184 wrote to memory of 2760	4184	Update.exe	86
PID 2760 wrote to memory of 3864	2760	bettersoundcloud.exe	87
PID 2760 wrote to memory of 3864	2760	bettersoundcloud.exe	87
PID 2760 wrote to memory of 2384	2760	bettersoundcloud.exe	88
PID 2760 wrote to memory of 4732	2760	bettersoundcloud.exe	89
PID 2760 wrote to memory of 2484	2760	bettersoundcloud.exe	93
PID 2760 wrote to memory of 4200	2760	bettersoundcloud.exe	94
PID 2760 wrote to memory of 1464	2760	bettersoundcloud.exe	97
PID 2760 wrote to memory of 1464	2760	bettersoundcloud.exe	97
PID 2760 wrote to memory of 4540	2760	bettersoundcloud.exe	98
PID 4184 wrote to memory of 1036	4184	Update.exe	102
PID 1036 wrote to memory of 4092	1036	bettersoundcloud.exe	103
PID 1036 wrote to memory of 4092	1036	bettersoundcloud.exe	103
PID 1036 wrote to memory of 660	1036	bettersoundcloud.exe	104
PID 1036 wrote to memory of 2296	1036	bettersoundcloud.exe	105
PID 1036 wrote to memory of 3504	1036	bettersoundcloud.exe	106
PID 1036 wrote to memory of 3256	1036	bettersoundcloud.exe	107
PID 1488 wrote to memory of 4980	1488	firefox.exe	110
PID 1488 wrote to memory of 4980	1488	firefox.exe	110
PID 4980 wrote to memory of 3948	4980	firefox.exe	111
PID 4980 wrote to memory of 3948	4980	firefox.exe	111
PID 4980 wrote to memory of 3948	4980	firefox.exe	111
PID 4980 wrote to memory of 3316	4980	firefox.exe	112
PID 4980 wrote to memory of 3316	4980	firefox.exe	112
PID 4980 wrote to memory of 3316	4980	firefox.exe	112
PID 4980 wrote to memory of 3316	4980	firefox.exe	112
PID 4980 wrote to memory of 2576	4980	firefox.exe	113
PID 4980 wrote to memory of 2576	4980	firefox.exe	113
PID 4980 wrote to memory of 2576	4980	firefox.exe	113
PID 4980 wrote to memory of 2576	4980	firefox.exe	113
PID 4980 wrote to memory of 4728	4980	firefox.exe	114
PID 4980 wrote to memory of 4728	4980	firefox.exe	114
PID 4980 wrote to memory of 4728	4980	firefox.exe	114
PID 4980 wrote to memory of 1992	4980	firefox.exe	115
PID 4980 wrote to memory of 1992	4980	firefox.exe	115
PID 4980 wrote to memory of 1992	4980	firefox.exe	115
PID 4980 wrote to memory of 1992	4980	firefox.exe	115
PID 4980 wrote to memory of 5384	4980	firefox.exe	116
PID 4980 wrote to memory of 5384	4980	firefox.exe	116
PID 4980 wrote to memory of 5384	4980	firefox.exe	116
PID 4980 wrote to memory of 5384	4980	firefox.exe	116
PID 4980 wrote to memory of 5428	4980	firefox.exe	117
PID 4980 wrote to memory of 5428	4980	firefox.exe	117
PID 4980 wrote to memory of 5428	4980	firefox.exe	117
PID 4980 wrote to memory of 5428	4980	firefox.exe	117
PID 4980 wrote to memory of 5448	4980	firefox.exe	118
PID 4980 wrote to memory of 5448	4980	firefox.exe	118
PID 4980 wrote to memory of 5448	4980	firefox.exe	118
PID 4980 wrote to memory of 5448	4980	firefox.exe	118
PID 4980 wrote to memory of 5472	4980	firefox.exe	119
PID 4980 wrote to memory of 5472	4980	firefox.exe	119
PID 4980 wrote to memory of 5472	4980	firefox.exe	119
PID 4980 wrote to memory of 5472	4980	firefox.exe	119
PID 4980 wrote to memory of 660	4980	firefox.exe	122
PID 4980 wrote to memory of 660	4980	firefox.exe	122
PID 4980 wrote to memory of 660	4980	firefox.exe	122
PID 4980 wrote to memory of 660	4980	firefox.exe	122
PID 5212 wrote to memory of 3544	5212	powershell.exe	131
PID 3544 wrote to memory of 2520	3544	cmd.exe	133
PID 5212 wrote to memory of 1880	5212	powershell.exe	138
PID 1880 wrote to memory of 2384	1880	cmd.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BetterSoundCloud.0.6.0.Setup.exe
"C:\Users\Admin\AppData\Local\Temp\BetterSoundCloud.0.6.0.Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\Squirrel.exe
    "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:392
- - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
    "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --squirrel-install 0.6.0
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1768,i,2855950916859063400,1503788684638706585,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3864
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --field-trial-handle=2220,i,2855950916859063400,1503788684638706585,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2384
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --app-user-model-id=com.squirrel.bettersoundcloud.bettersoundcloud --app-path="C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2540,i,2855950916859063400,1503788684638706585,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4732
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --app-user-model-id=com.squirrel.bettersoundcloud.bettersoundcloud --app-path="C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3536,i,2855950916859063400,1503788684638706585,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2484
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --app-user-model-id=com.squirrel.bettersoundcloud.bettersoundcloud --app-path="C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3548,i,2855950916859063400,1503788684638706585,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4200
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --field-trial-handle=3784,i,2855950916859063400,1503788684638706585,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1464
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --field-trial-handle=3920,i,2855950916859063400,1503788684638706585,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4540
- - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
    "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --squirrel-firstrun
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1784,i,12569988884013869018,15076486510899152850,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4092
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --field-trial-handle=2232,i,12569988884013869018,15076486510899152850,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:660
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --app-user-model-id=com.squirrel.bettersoundcloud.bettersoundcloud --app-path="C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2552,i,12569988884013869018,15076486510899152850,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2296
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --app-user-model-id=com.squirrel.bettersoundcloud.bettersoundcloud --app-path="C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2756,i,12569988884013869018,15076486510899152850,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3504
  - - C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe
      "C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\bettersoundcloud.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bettersoundcloud" --app-user-model-id=com.squirrel.bettersoundcloud.bettersoundcloud --app-path="C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features --disable-blink-features --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2636,i,12569988884013869018,15076486510899152850,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3256

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x45c
1⤵
PID:3288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {0026bf3f-9d63-4642-a49f-50ed2d4e797c} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {f6c29b68-98c1-4ac3-9ced-d070ff4b23c5} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 27276 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {fee25aac-3210-4af7-8250-f7e7b5f27577} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27276 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {ef7c53d6-5b88-4552-90c9-5ee0cc9536a7} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3096 -prefsLen 34775 -prefMapHandle 1552 -prefMapSize 270279 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3180 -initialChannelId {6efcb620-1198-49d3-9eef-6b64174b33db} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4976 -prefsLen 35012 -prefMapHandle 4980 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {a7cf364e-1918-4e32-b2d4-4a661c184912} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32900 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {2abbe97c-a0c7-4938-863b-1a0a6816bd59} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32900 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {e048d2f2-462a-4cc8-ba3a-306c995266eb} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32900 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {3f2b4c45-a01e-41f1-bda5-3eeeaa1f2b8e} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6272 -prefsLen 33031 -prefMapHandle 6276 -prefMapSize 270279 -jsInitHandle 6280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6248 -initialChannelId {24ca1100-7a7d-43cf-b177-846fdea9f2e4} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C start "" "rename.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Local\Temp\b1cvpxxj.0zh\rename.exe
    "rename.exe"
    3⤵
    - Executes dropped EXE
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C start "" "rename.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\xdg3zxbu.ceg\rename.exe
    "rename.exe"
    3⤵
    - Executes dropped EXE
    PID:2384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\Temp1_b1cvpxxj.0zh.zip\rename.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_b1cvpxxj.0zh.zip\rename.exe"
1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\14tbp3gd.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 0c049f9681fe31b8f2f754f30ff88b47c53adaff7e21d696785d41a9cf88e14b
MD5 b3c6302ae8eb0b9561c41ee2c7a77474
SHA1 df196ca6d53555f8df8d831ff5e956c5112bce17
SHA512 eeb2b52a8b2e217bccc4e3786e02f80bac4f8536e4b0bb61e7e8be763559af25faa1474700ab88f168b2a6955411171b466a4643fd11533f667bb56af77ba136
SSDEEP 384:HHMO0iO024Y8Fuhw+5EL1pPsac4j0lpDII+78H8z:nrZY8FuK+5EB9sac4ID8L3
TLSH
T197527E7E6F1138B91A27D1D4D8AA5218CE08E6BFEFD2D05216443C45C680778B8F54DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 87B
SHA256 b58da9b1afec02c568be727bd449038fc600c0a7ffd3663d61a5cf0eb1bed7b9
MD5 2d2a8a85904d30155aaf487f03625452
SHA1 6f65493864cc67aea0d22d4f5eeb69d7f55a6140
SHA512 b0f48fcdeaed59e1b1b71856477354ce083e33d4d2849b3723b62212fc1c66dc4a0b8c1c7d53f280e4fc3027e6f7fa719625ea4ce51b7377c792de501b4383ba
TLSH
T143B01285814E638D9C82896020890719C611242803D2B401794D01020915A0B6069448
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
MD5 a560bad9e373ea5223792d60bede2b13
SHA1 82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa
SHA512 58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c
SSDEEP 24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T15A956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 43KB
SHA256 ce636d201ef86ffbf4ee8c8762b4d9dc255be9d5f490d0a22e36fe0c938f7244
MD5 b5a42ecde0b058b3c4e661e0ec84400b
SHA1 7e2bfc653c5bc6997553c150a0823daae372cd99
SHA512 b7f4a7bddb226066f7edf23dfb9bee658c30ae03dfe727ec739f51fd98c63831f732343c14a6ca080f31baed38bf9064cdd57c9d1daaf4c42c029fe83d846dc0
SSDEEP 768:5XxIn344C+JtOb7Q+8Phv9YaZuJ+Hz7X9Dbzjy2CXdSksvlxkZPbM/zEffvTeq6e:5XxIn344C+Jty7Q+8Phv9YaZuJ+Hz7Xk
TLSH
T106136B3EC2949279B43716F72A1B4EE26B5667B4221152421BFC70D332BCAEE334641F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f1f744d-6c1b-4ac6-801c-49fa6cae4cc9.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\4f1f744d-6c1b-4ac6-801c-49fa6cae4cc9.tmp.ico
Size 66KB
SHA256 7795e07a26e0405ad54e519c8e3df3c35eb09c46834d1cd899e9ca933da0b0a1
MD5 40c2474a60c41dfba50c330cca8ba737
SHA1 9e5e80a6ccb5e0b36bfdf4ba12868c5546fe665b
SHA512 65546e8d12a10ce2a17a095d8ae2e41610b42ebd772ae5e21207004f9dd046fdff10985d8e8674449563b8c860eb7cb095c9469e3a10a6925db3663f1d372193
SSDEEP 384:7EedWIvbzdzixOYfKTxpfAhJxNlmSGwf1LO1NQ4MfQSTHHKCK3xFBWGrrDyw:72WdODmxw6BDUHHKCK3xHWGX3
TLSH
T16E63E7C160C765ACFAF53A77B80A4747C2477B4B3A25F40A205EAEE5F5A9183F8305B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vsaomy0m.efr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vsaomy0m.efr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rename.exe

Path C:\Users\Admin\AppData\Local\Temp\xdg3zxbu.ceg\rename.exe
Size 5.8MB
SHA256 b9d52bd04f3f44ef1ee80b4df883933c24429b74435dd27729d17b4263e43ec0
MD5 5848b02726b58909299f0fe0cb9d57ba
SHA1 4501c8e6abdb9fc19001ce28a3ab903bab2dbc1f
SHA512 54376ed0b93058dfc4b5919ba8bbc85bb0956f4c6a09500780e17b2479777d41315cbd41d8027193ae6b442a360e7f8340cced9e02bb61fad1e2b8c582a4b177
SSDEEP 98304:RQrxiMaBCGKBT1DMzZnlJPiIhxmoX2MgUr:6paxaRDMzJ3JTsMRr
TLSH
T16956C01AB7A501F8C1A7D9B8CA175D13EAB2780503369AEB17E0D9591F23AF05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\chrome_100_percent.pak
Size 147KB
SHA256 14a6a393c60f62df9bc1036e98346cd557e0ae73e8c7552d163fa64da77804d7
MD5 3c72d78266a90ed10dc0b0da7fdc6790
SHA1 6690eb15b179c8790e13956527ebbf3d274eef9b
SHA512 b1babf1c37b566a5f0e5f84156f7ab59872690ba0bdd51850525f86769bfebc245f83988a3508945cf7617d73cd25e8469228974dd2c38415388b6a378552420
SSDEEP 3072:Mz8JCGIdkwTPa/XKjKkxP1L2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:Mz81Idk8a4Kkx5K18Gb0OV8ld0GecQ35
TLSH
T126E3E1D7B3F4ED7DCAA756F7A2260071ECF3462C0A92124B178AD4352A66748DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\chrome_200_percent.pak
Size 222KB
SHA256 20c93f2cfd69f3249cdfd46f317b37a9432ecc0de73323d24ecf65ce0f3c1bb6
MD5 3969308aae1dc1c2105bbd25901bcd01
SHA1 a32f3c8341944da75e3eed5ef30602a98ec75b48
SHA512 f81ed1890b46f7d9f6096b9ef5daab5b21788952efb5c4dcd6b8fd43e4673a91607c748f31434c84a180d943928d83928037058493e7e9b48c3de1fc8025df7f
SSDEEP 6144:HDQYajN6svyABnI86uKkxugx5GMRejnbdZnVE6YoppO4:sfjN6svyABTKkxa6edhVELoXO4
TLSH
T1F424F1C7A3F89D7DC9730AB3522601F1ECB211394AB6521F53DB9C357996AC988C9383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\ffmpeg.dll
Size 2.8MB
SHA256 cd0ccc24489532a6c6e977ea4d25250d9850a395b51c46f90b47ed21ef8044ba
MD5 60bc255d5ddd8fc9c8be4c82108a2c8b
SHA1 ad1a0606f27d95608e02d6ad0c40b342008d8f24
SHA512 fc50c39cdcf60a622cd4b63490c9ef2b4e3897acc05b25e900bff5d351431628e8141048995deb28de270b002d67a3976a4b528a5b50b5d1cac6683f48f1fb38
SSDEEP 49152:bshioTdyDPLVt7Spx275ydSNTGuNt+X6Cf2B+J6/VTTfV:bseVtsx29ywBGuB/T
TLSH
T1D9D5BF03E6CA50D9D029D071979F9223F671344A8F2566EF16D01A213F6BFD82E3E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\icudtl.dat
Size 10.0MB
SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
MD5 ffd67c1e24cb35dc109a24024b1ba7ec
SHA1 99f545bc396878c7a53e98a79017d9531af7c1f5
SHA512 e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79
SSDEEP 196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
TLSH
T160B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\libEGL.dll
Size 473KB
SHA256 ad75ac7d0fe26ee9665c075e705d290233732feb897173597a18887b3d1cad7b
MD5 998ccce35f45d91eda0fbf2272923b03
SHA1 9c99a7a8e4dec171cc0499e229730a241c164fbf
SHA512 b5cf010ccfe4083d83e5c3c8df144bbf30eef991ac2f91f081562cf7e2b4182447cc4f86508fbd1ec229a6a34ab1907c861276776d8f657f557cea2ff7b3003e
SSDEEP 6144:KL1WWZ6zNA2dOUq3lfxGtcLDMx28ARKNrdZHXOb/sk4siui:uWQwZWlwtcLDm+KN7HXOb/sk40
TLSH
T1E3A49D1577D444B8E06AD1708A534653EB76B4920B65FBDF02A0D2392F7BBF89B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\libGLESv2.dll
Size 8.0MB
SHA256 586a04652de1a392e8f0c4cc69ece9b7370be4953b9fa4019d09207578324e42
MD5 06d7890e8f5423bf90a02137af53d95b
SHA1 980f746f895bef998bb78d7adaccddfab6a9aa5b
SHA512 bad64ac5761e2db7a9453b731c10ba13409aa8793c7e82d56c48c6231f923debb960f89d92eb69ca2914283b85d4102e8e1ec38cb7bf3d1009fc390b45ccd605
SSDEEP 98304:s6VTc3DGigGJ7rDYaLjrBccGmTlc5eWXLXC3PIvd:s6VTc3DGLo7B7DGmJWTmQvd
TLSH
T1ED867B03F69580D9C00DD2B8975B9627FB3178890734B6CF269417252F77BE0AB7AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\locales\en-US.pak
Size 467KB
SHA256 55fd1b71a47b6d4a81240240fd24e12c3dd7b986924ecc11afd7d21e7717a49f
MD5 0ea050358326e9ba2fd06751a7b2bad2
SHA1 3610b9d4c370af456bf8d1447417ba5194fb6a85
SHA512 d10d047be9629608f89afbbc115ece521af4ea1a7529832943b67441bff2fcd698feefe6df6296c306b399c55acf84dfa0734447f5f64063f2e1ecebbbc8edf3
SSDEEP 6144:5sNJk9kFTDBop3rfxEKF8HWMP9epQBDRfaYNr2B55Mxwngpt/hLFwB:AobfxElWMaQBDBm5qx/FwB
TLSH
T140A43B1FF744126A069352A27F0995B2FF36D06CA35112563CBD802C33B6B66C3B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources.pak
Size 5.4MB
SHA256 da22c6359eb8d7205d8401bb6a5cd2b2bf2ed9487953038232baa6ad8a5e9319
MD5 8e873d75db7796e02430109a6945b9ba
SHA1 75c1513cc317619e04aa99e0a8dd66164892a77e
SHA512 38a0696a4a6ff0c484ded95f552d89d6bf6324f1759f5c76f32f86cebd1637c25dc87d89c9b3627dd95627ac13c21872d07e045bfa4d576c72b0b8d47798166d
SSDEEP 98304:MfNMZLKTPeIoXG13rkt4G3KJSml2rwrxySNYtu397pE2RSvc:2MZLKT1gG1O3KJSmQkrxOwkvc
TLSH
T19846339AB7691D3BC8AD437B446846331AB9D93A0610B857318CE0B47E233DC5BC95BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\resources\app.asar
Size 17.3MB
SHA256 84ddb28a62786fbb24e4e846e2e12376efafe7e6b37b124f10b953c31b62168b
MD5 2a0c3ab6ea351b7325f2bfbd9c852dd9
SHA1 db106143cc67e5be194a2a0446a5e1306fb00bbe
SHA512 fa8b407b10e3d10122f38acacbf8d0e6ae256338baa9c9ea735cfbb3d809926a622c274d23f350544c4618f3b5141afeb02154055aa78122cb3fe8d5de0ef8aa
SSDEEP 196608:eDDmVJU/KdD14UXf/3TPO8EQhCI45hkeSHgGSnN34Icty9g6nwg55dqbSPzZodGI:eqMKL4UXf/3TxH4M4WIPjnP54Mod1
TLSH
T1C3079D0200E3953BB15717BF5BAF4195BB20501F2E88E9107CCCA768AF4BF39E5B2956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\v8_context_snapshot.bin
Size 650KB
SHA256 096fc3f5002f5032d5c350200d4948851647262fa44f0a7c3770477f9ce620ce
MD5 eaf279610dee0e18089fd16e4467b440
SHA1 caae7ebe351e27d81a6861710d1faba418ba785c
SHA512 355a1d0a82a81d46858a9df7c334b91db869d5c0539451351d188aecd785a4c3d5ac29fa347d6f87c2d0e770f039475fe2fd718b4ce6fb9ea5cf05f1cfcc7973
SSDEEP 6144:2BUhye6gCsgwqexre4awBTGWDgH1Q1dhgXFUhxRg/4RpZqCaBygPEkknFmJA:2BUhye6gCoLGWD9q1xNCaBVEznFmJA
TLSH
T1B2E4C767F394DF2AE7C95E70AEF7DB923234B089AE0A651B3196532D3179B240F4424C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\vk_swiftshader.dll
Size 5.2MB
SHA256 809f1914bee43aeb4bc45259893cbd50bdb4c2c54f4381e9ead2cffc048268f6
MD5 a4badb3b16df7c363d00e8b54658a6d2
SHA1 b1ed12455ba568baf79cdf7c6df3f89ea668c8d3
SHA512 b86f786b1103f7b3d806646a9377664f1e162e4593cdba83ef3b96d37485957ad846ec65477f88c1cf641bcbeb1f47cd133ddc4512f12b0c739918dce4888b84
SSDEEP 49152:2zUoIIe7mNwWpKerrWAvCyY5SdIo5pniLcm64OgwNDzE9veYxbPo1AZbO5dy/sT7:XXIe7eMINDQY9mYb72DL
TLSH
T159463803F2858099F05DD1B9875BA623F632BC805B62B6DF52A01F192E77FE06B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\bettersoundcloud\app-0.6.0\vulkan-1.dll
Size 874KB
SHA256 81f7ed468a8cb5d8847c111ffed008fea78a517c49e6753aae3ae3ab6f4d8127
MD5 ae0ba3c0e27b4c141bb7d8d826ab1417
SHA1 903f8a739b03ef53455edfd30b9b6c83732ae645
SHA512 4e4a33463064be6d930950e318535f9f1334f9114ed06dde200851e4dfe9d202f4438e9eed26088edd9c46e741fee64df43311fbf914ae3454166b9ef6ee59f5
SSDEEP 24576:SxWVt4kcAbGmpfQTLr6Z5W1DYsHq6g3P0zAk7/BoJaK:P2LMGOf4Lr6Z5W1DYsHq6g3P0zAk7+
TLSH
T175156C22A6A4856DD47A8034C9C24603C9F274921726F9CF03A85718BF6BFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 5e4bf5552a9bcb0c257af50de8d8349e690a7faef971906afd4e97a46db41f03
MD5 5b035758cb235af6474f16c6d8c0338a
SHA1 b666010fedea7b3cace817009b8eda683d59ae91
SHA512 b8faf830ea1e89060974492935b7c4f7af8182669203a37f612bd6e6c93250518db11e891109cfc931d306ad9983bba052def3b11a230c44442ee9e7d4895cfc
SSDEEP 768:YqLnSyeo81mGcmhumKYRZqMIfmsb/b4b5bYqhJE:RnSyeoYpm
TLSH
T10AD21144EB2E553FD41912BBDCA50B002F79B88A59192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 84aaa439a3f4952d78a91f86e40d732f7985058040789fb0c998fbd1d289bff9
MD5 8bd1fa7abb92629ae9540152fcac1c51
SHA1 4022d671f0ed56b5436f8b00424abb741cb723c9
SHA512 8a2bcf6cfb7c514359f7f64cde33c570c39f1846db865b6a54631622997717c0c76375451bbe083dbe553a1af8b40ff42644f3391c4add8c43cf230e6c30c481
SSDEEP 768:jqbhJEAnSyeo81mGcmhumKYRZqMIfmsb/b4b5bY:ynSyeoYpm
TLSH
T1E0D20144EB2E553FD41912BBDCA50B002F79B88A59192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 dce00d65c9dcc946cd8067972c91f8ee6e9a340c02b8a70638e5739cbbbd7353
MD5 bc208a00dcc6e3d4de48f623b753ae6f
SHA1 6fe4ac19ff3b5a9b230852f6c3637ff3d7e79c59
SHA512 458bc2702d855d465b32eca200a01efa99c27d5ccd3c97ff2908796f75dfaf4f78f2538f696fab250bafaea1f75377dd02d036fed1d1228e57a73e10dd90f1d5
SSDEEP 768:nnSyeo81mGcmhumKYRZqMIfmsb/b4b5bYwIM7hJE/:nnSyeoYpmH
TLSH
T179D21244EB2E953FD41912BBDCA50B001F78B88A59192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ad3bbe6c992c66e5b6ff6d25e91fcd85f06f367298102c5f400639caa76ae37f
MD5 3e6492b1de71d00778e591ddac219087
SHA1 17ff513aa146c95f62ba8b4bf6908c1706d14a5c
SHA512 66ebf65f783281014e6d0ccf8d3d167b0057136caccd6f89e6a14660df027de6db9b7c3543a0b733871dd57ebb24190964f481873426ff72ee85f29376322551
TLSH
T15021484C3DF94D6E98EAFA9CB486438E53464E0644871C430D12DE8DCED5AD9326A639
MD5 SHA1 SHA512 TLSH

Submit Download

47dd7f1c-2f87-436b-8bb7-df57a7d4ec0f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\47dd7f1c-2f87-436b-8bb7-df57a7d4ec0f
Size 2KB
SHA256 cafd6d940f1840a6f0706a8b785b6041913b9b3c7d583af658219841da9d4cd2
MD5 f0d77374528b537e0e3b8096f9220b7a
SHA1 cff461726c5b40c309a3857a3f930bf95b719290
SHA512 08246797a43db7562d6a75167d3af5cff52596846bc90ba122cd38340608110443dc7ab88dec5cb3ae3613c5f6c2ed8b04ad082a7a0a1aea7d68becef53f8221
TLSH
T1C341449C35784D7A9CD6F19DD482338E53A48A4350C62D636F41DF4C8C926EA736E427
MD5 SHA1 SHA512 TLSH

Submit Download

5c35df52-47e9-4535-9578-7d7449520d6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\5c35df52-47e9-4535-9578-7d7449520d6f
Size 871B
SHA256 d90b83390b9c4f3426652fa30de89cf0aa797b84e120e2ab9f57f88c936c92bc
MD5 592713891501fd9cee7a5c1636c3707b
SHA1 0469577ab403524c227e8f4de6201bae72a36ca6
SHA512 f65002f6ff8cea13f25f1d70eeeca52582f415101e760f4fc825734d0d224e5118c09ba8c690bee341142539bfa1b8fa6efdc247912eaaad0561aa61c03e798f
TLSH
T15611CC91863079B6CD78E29BC5913B068BF86613C0C605143EB50A180EAA12EE3AA647
MD5 SHA1 SHA512 TLSH

Submit Download

77bee6fa-a377-41b0-81ee-774a849cb2e1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\77bee6fa-a377-41b0-81ee-774a849cb2e1
Size 886B
SHA256 e902e749ac86cbe82aeef15093539a772731d2620e4516d79b34a496e4af8869
MD5 4118cde65880b0521f64e58c3f4253ef
SHA1 dfb37f5f4c4829626a4e94bc513b429b26c81dc5
SHA512 28189f986dbfcf203caaa45f44c0e67c35070745c62cb6e45fc186637136ba2b775fe33c76ce769ec83966dd51386cd077f0ddba6c59a0aeb78079e31f3980e1
TLSH
T1341123A18630B9B2CC38E2D792D4B7438BE47423C0C70A247F605B1C4DAB12EE39E607
MD5 SHA1 SHA512 TLSH

Submit Download

9837e724-2855-420c-927c-8160b4162482

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\9837e724-2855-420c-927c-8160b4162482
Size 235B
SHA256 f404cdfb788b39065f7d3d31c9c64a18eb7ce9c9052c6dbd46a09e67b75ee6c2
MD5 07a2677fb5024b82cddc30f801c1b58f
SHA1 433852d29bd11b304b94716180b6eefeab940c8c
SHA512 81c56aa08e270455b8764669c35a32a8c870f4989f615a8dee4526a0b01ca1ddfc358d0aa2d00ec2c1ae725921f3fc45f3679d2fa44a50abbe34c105ba22ad3a
TLSH
T115D09780E4A8BB6D08005F06F0A22AC232898C3310A6B8608698423C99FDECC429281A
MD5 SHA1 SHA512 TLSH

Submit Download

f8a3ac99-d771-47f9-9e5a-850d32b3188c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\f8a3ac99-d771-47f9-9e5a-850d32b3188c
Size 235B
SHA256 aee380d33be40bd680f29e933cedfbcf6d0fc09be08a84777629c0e40e4ec431
MD5 9a64a6d3f9edb44b93b7c06452600e1d
SHA1 c711fad7da1df2039d8d46eabccce7fc10db7e94
SHA512 b600300bb8fdc9723fbac2eb6e0f326913ac4ef8d951dc8e77b9d6cb2e4758568155cf8eb692997db3fe55433fcdd2f082ce3bbfb437ae99bba292bd8e36a87f
TLSH
T18DD097C01888735C48240F03F0FC68C630884C37247C5C20C9A006B59ABEACC422186A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\extensions.json
Size 16KB
SHA256 982e40f1240bc1103a5d8d7743e63a591ef3823c5ecbd16ef211af2e7442c2d9
MD5 e92417b448bca689effbc55814766cd9
SHA1 0d0a141ea952394c4b19638a05a2719bbcfe2c72
SHA512 6fd149fafa67eb1a9c45856501dc846345bb33031e157a1257783a5fa83e758fffe1c4763408ea6b2d446a44a8b038b299295b634fab3abef84fe8ff26f5d5cb
SSDEEP 384:FZkI4vXUmldvS8dhWH94zH96oVL4HNL4P8L4H+L4HCL4HLw4hr:cI4fRfXXG4x6+4t4u4k4Q4k41
TLSH
T15572421545049E78298F979AAA36BE02C37D473B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs-1.js
Size 8KB
SHA256 ea2c2b2beaa94a66157f946aa47040c8b9047e7d1253717faff97798f382b23c
MD5 7d4b77c6e8921a1f0d4d183411b72149
SHA1 35d11c026051da8f63b8996586f48f4d5d44ef0a
SHA512 25517a4a27cf3e07b0061007c746481f0cb8f7189bb8599616e35cdb64a6a076537643d5c65f38f4c675881e8202a2239599f11070cebfc81b050bf46d4f0544
SSDEEP 96:xHJsxTU9qGqvfKPvObzSIwSSl8pdv9jdnnq3RWR36WG92PBw8884R18L4cnAyAGS:M5RvfKPvOwSSGrY8RpI2Bw88p5
TLSH
T19B020F785508CF3F78F27ABCAC298A715962013BB6BF68D710B984C5015CF3441E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 143b24c4928b1ee95092c4da735b2da06d20863e6f993c5a581f6f1cbfb8e807
MD5 cf97f187596720a2b414011a749b2a9a
SHA1 501bde0cd5f1e42f893a2a8822deb7ccb5233404
SHA512 679f6e70eaf81683ac0e33fc79d46adfe9faacb6b326fee9f0409b717b797f4796ed8c42717bc927b9710e528715500539e13a7c6aacbf4cfd5a1af5b1a40cbb
SSDEEP 96:xHJsUTU9qGqvfClKjwnj21zSp9UKSSl8pdv9jMnq3RHKG924Bw88n8L4cnA8b1:MwRvfCl36o9UKSSGz9KItBw88ap
TLSH
T14EE10E7891088B7F74B6776CAC648931AAB2013BB7BF68D750BA84C5050CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
Size 6KB
SHA256 74f071e61d79ea46ee44523c3fee37a460862b75c4f1f69856028d918b53c0ae
MD5 f6c3f52f7d1e3c7c7196c5b254db68eb
SHA1 1c9c867ff090f3eb8a53279a1876e6d17827d795
SHA512 1411352516f02e3496b9c74e502e96619447ddb9b0c21bd848ad51227102bb9a99ff62fac2e5cc1252f9a6fecb9a59d2ff3ff54976041a9b79af6dfab543c0a5
SSDEEP 96:xHJsUTU9qGqvfClPv1zSIwSSl8pdv9jdnnq3RHKG924Bw88n8L4cnA8bAGS:MwRvfClPvVwSSGrY9KItBw88ai
TLSH
T102E11F7891088B7F78B677ACAC6889315AB2013BB7BF68D750B544C4014CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b8e4239e68ae0faaf0edf90cd99268c49524ed64bcc6dd1a879bef5c55be808f
MD5 f857fd40edcd4d15d1e77e97aac76534
SHA1 9d5c86af34bfc75cc76d733adbce1684796712c7
SHA512 c750b827ad29041b7fa8a665fe985533d5e7b65019423f8fd4630a89e45f4d0bd78b75226c9a30a9df116fc90fb1ebe8130fca56d91d964b223e50c97fef414c
TLSH
T10821B8C5FD372CE26913D189D5C99FA5D1E74072819DB8F0E544D9004698B6B33EE305
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 319bc122d866c69243e6f2023186d642abb0253d10e44e7c8fd4042cff9591e2
MD5 2e4110f0dcfad40e2421f2c2f0f31e05
SHA1 373f32426b2369b37ffe79504d7806b770995910
SHA512 2a3ec4619ae8cd58d58e1cda27bff274c544903d1579b61bf74b085da83be14ca6fa825bbab3fbae4ae174bb134f79fb3d1efa453d0b55af3007bdadc83dcfa6
TLSH
T15C21A743E86F2EF27A31E061D58E8FF5D64A303184E644F0D1994C1A92DD96E678A325
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 c48a0a28dedef05ecd444727f883ad392728310ee03a52488c77682790deeaf6
MD5 6ba1482eb92240ecc38774d534db0d96
SHA1 4c7f294a29fe5948cdf5d72aa1872dc92cc9f106
SHA512 dfdc12338ba9a2323925a7fd98a001192a9036c9497b25acaa7a0616e7cac0c6e4cd0f561783e3281b027d29c83d38c095319f3d76faf9d17b661ba7c69a777c
SSDEEP 24576:6ICBG55bynv4Ff3uyu6FuvCJnUx8cQ2rzvVb:6JECv4Ff37u6svu3cRPvV
TLSH
T16FF52BF82092A357F3418033A64593EB21EFD00C6467DE044BA956F895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Cache\Cache_Data\data_0
Size 44KB
SHA256 461e7b37e57164f685085f0a7940bad050c5daf17d515781aef5177a51f4219f
MD5 2be0461bab7f70412124bf13a61fae4a
SHA1 39f13f97afe7da772033953fbc87bdb73a5ee025
SHA512 ca587225e9711f8727909e0b471f3c0dc9693361031938bfe588a130cdd505308cb18dd18fa532526f3ff182dcd316f60b6e73c922f1fd459c05aad1c12d6c5b
SSDEEP 96:OM5KHvJZhyhYSGcN38fdi9Q/mfHTWEciyUh9:OwKPxyhGWediOmTWEV
TLSH
T1E513ECFE40D0BF96E1D6603E84B7237DAFBAC469C3436A0B823DB4515D22B49024F968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Cache\Cache_Data\data_1
Size 264KB
SHA256 eeb030cef19af248a923a5e97b68dca8da55f9a667df27c7edf5a6a76adc0cad
MD5 d9b353803793f827fa8c0edfaa535759
SHA1 2111b72ebe2a6b657701aae41e9ab7b8cf2b0def
SHA512 809c5d34527fd6936587544f1decbbd1ff7b06df4fcfd7cb8759f3fd70e2eed86e3643805a7872d07de9a7e62556e2b67e738ca79cc2b0a261efee2917076547
SSDEEP 768:uLJP2+IOuzMne4nBPlVx30ptUNuxf0UymWgD+If0JT9HbSDJ:fOuoeEOEmDCxE
TLSH
T1ED4418FB2281962CF74D11B4C15222FCEAB7609C5EB7C2998573981B6D22FD33304EA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 03f091181778b36de198b3d10a7f780ffef178f61e2e311068255d96557cba6b
MD5 7200b3869b67c807d09e0a55635a450d
SHA1 e7e5d8491cbf05e1538843a53b08a654d817359d
SHA512 9a9c139d2d48e8129262e247a27a51f5b2c1c515fd6dd7e5aa3164445ce2cfaefab9d6fb214906cd5e14f7d81e451f7f7350685f3a5a93e8a5eaa75066a230b2
TLSH
T1AF01A96013F3EB16F31040731B24337DAF70E900A08F432928AA53182F959AC894E09B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c290.TMP

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Code Cache\js\index-dir\the-real-index~RFe58c290.TMP
Size 744B
SHA256 e0dd9e6eaf9ac1e637b1110644e12c106d6abec1389d3cea68efadb6694d371b
MD5 787dff36cc8f7066fa48780d59e5dc8b
SHA1 2e1367f8ddb59e180b3d39b6f450949c6696904a
SHA512 f4d4627fa76416974f976a74f94bcf878a5e571448fafb226d4052783ffdea061b72ac5ae310b8c366e96d6db5fa3a0365baa360d8b2a3da050c2f2f945fbcd3
TLSH
T19901446027F3EB16F31540735B2473BE9F70ED40A09F432928AA53596F918AC998E19B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 a8587b6fdb8166b47727efe8db19621e146a9f4a7cee719f2b9b1391331971d1
MD5 448ed2794c382879d13ba11a820af635
SHA1 780af6d1c4e061c17b63034d79d4eff926fa7d5c
SHA512 73ec9067bb8a07731e194b4c972f7e442e3c0dad0abb0d0095aa5a794e324c2f85fb4d9511eb5242eb61bf4c293da1d70332afa1740aedc4471e09617e5b464c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\DawnGraphiteCache\index
Size 256KB
SHA256 5e297f39fadbff4b7e039502f3eb33ea1b91a0d21e8485eada94a6e9865e2b3a
MD5 b08f24658b9d26f45f0492b80c1fd7ac
SHA1 0b9b8cc41b84b79cd5152846f376f4296aed9fe8
SHA512 2bd251d2321e49a0f447ae0417b685ffcd89ae1e2b080863fe8a60fe3893330951725e0f76aee27c676e173b6d4c5ba71d6e88ce46d4ef9f75f1f5639e76c888
SSDEEP 3:LstlNllkll/la:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Local State
Size 434B
SHA256 93af07b0ef16620fd8bff0c2d59c4b894bea7699e10042f986750611c0f9c622
MD5 8eaaeb3f38be874328088740eb9c10a6
SHA1 b40cca1293922a55be7fc9ad7724652a694a1ee9
SHA512 4c06145980091b56db737f7c68e09f39c183259383c2a9dd5de23c34694998827f8cc547a3d3896013ba66b16d9014c352d0ee11772e0acdf25d38e66ea4406c
TLSH
T17DE0A3731BF959A8362E76B52117B2021C3050A7914B0625E87D0384B1755D5130BC65
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Local Storage\leveldb\000003.log
Size 5KB
SHA256 c5a0f1c4d0735602e5335ee132819c67c5cad0da61d851759687c789dd8e2c75
MD5 b314db2f84c920aa89b1a9ee1371f638
SHA1 eeacd9d5a04c61d4ca7cac5a8a53c52c43e7884b
SHA512 880bbb9185f8aa0662b755663d42d07a6494d42177e92c0d53ea2be5f84fd69681e4ac639ded0ebdd44cfd3bd3a31ea34c2c45b52981d2d8ca9b34145f174698
SSDEEP 96:qp0pvdDzdplP9PgPRlOOqHIkJznktf+zH6B9VdvHvH7fkef/S3H7z:mavdDzdplFYZl7qHvJTktf+76BxHP7fG
TLSH
T126B10DB7046AC7EEFB0F57B2D197A71D9E4B582B899CF6ADE2432A040340DB34505ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Local Storage\leveldb\LOG
Size 263B
SHA256 c4435676b3fb9d5710c696fff40ff9c37d496488dc1f08680ea93e0f01971406
MD5 a5f6b824bb6b6615cb07a10b058431f9
SHA1 f157ab6feb88c5a5dd26041b2b0a67407eda34e1
SHA512 b56dbb1fc1d9e6cc21a5f117a67e50cdf4996fd3a7dc301bc356ab21efda2f6e1c0aa529b220cd5e25a84ac4f9c12042865d4233f0c39293921758131f05280e
TLSH
T1BAD0C22284AD831CA64340FF9729B70AC7B1B109AA8833C95F52E24A708A94EC5018C2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Network\Network Persistent State
Size 186B
SHA256 72a92d0187a7590068bae24f185f37da0c93956b865f1783f21cbe9e5922e666
MD5 b395f22841c9352ec1ab1cda27d9a863
SHA1 cc5366c7d6fd76b8c1d02494d4072829fc3ae025
SHA512 ba585e7c33f8d69af266f18c3e454939951b32ffcafd20d28b218de47bb31cb30b2d350d3198fe851cdce066369749c3d298f1486383ea47de9d79f34e0e51a2
TLSH
T118C022AA823029FE074683F009146A13C6FE0002030C9CAA8224372843624AD040088B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Network\TransportSecurity
Size 1KB
SHA256 10bd28ae75afd9c12eb317690b538b182ff9768349519babdb27b6d387994681
MD5 3435bc5914459553881da764154bc1d1
SHA1 12c40cb19b3bbc3c07a8b8e6e203efc61bae05b3
SHA512 79ce03ba8affdaea0c3e1d46e1ab70db1ac93df042b503da033beb6c16fccaea10a52b4f9f1a2dac06d0e88c1da61d4b2b22fc8c98d9793dfd68b03692ad2406
TLSH
T165315D56CA6FF82B507C0C676D44BC553DBEE4314191BDF8CB6AD16C60C18F70609822
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Preferences
Size 226B
SHA256 5dc92826a5ef438af2793872aacc2ca317eff2bea74635943b651aeb8aebffec
MD5 a4a807d0b92bce181d20641719464332
SHA1 ffc5fe38c23d65ae5571a3cf922049c0463e49ea
SHA512 ff8f62d5cae47583d94f8703e143551335b479d56054b060b86426b184f56928548da8998c8348bf717150d9803997cedf6e8d154273e48080b5d35a515e5238
TLSH
T1EBD02221556824B7862FEE3241CF3C566DF202200D0BAEC1CAE43AA478A362C094B92B
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Service Worker\Database\000003.log
Size 332B
SHA256 2a6dff135c3f4ca1e8125930d431845ffe5700cc93639993fe5ff36c82bd06f8
MD5 c0cf0d18bb6b093b4ec17d79d2b8102e
SHA1 c23d549aa82896a46c4908575a9b6ee8d7c7582f
SHA512 d042e33d70ef1d5f31ad6d2184d8e8ed6058f591a956d8c8d95317a928fa993885082a8d71b568514cbeb31d8db55e16d49bb8d1927a6256bc92419193c12ebb
TLSH
T123E0C2CB4A24172BF49602F7A88673016BB0C00887DF9B97C60FE0328AD8B8834145C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Service Worker\Database\LOG
Size 269B
SHA256 ada0973c57686926bb8ae07a525ca1ff26025e86a492025af0078f777152525f
MD5 76eb64b7ba3e7e6332f6cab280080269
SHA1 1151e38b78f05669643f9584814b1bbe753cc7a7
SHA512 fdfcc5f57ba38ae3e7e8453b02d717605d449d67bb259aafa1fdaa751599d3910d09d7544d99cbc409ed2ce11c12b37f9fe139a325464db68dbe3ade9c332b52
TLSH
T155D02B0142E8C3ACB40341F307366356C7A97006D6DC320B5F62D64A308EE0DF422800
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\bettersoundcloud\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/536-1211-0x0000021697720000-0x0000021697721000-memory.dmp

Download

memory/2520-1191-0x000001DD9D260000-0x000001DD9D261000-memory.dmp

Download

memory/2520-1190-0x000001DD9D260000-0x000001DD9D261000-memory.dmp

Download

memory/4184-470-0x000000002C730000-0x000000002C738000-memory.dmp

Download

memory/4184-389-0x000000002C760000-0x000000002C780000-memory.dmp

Download

memory/4184-7-0x0000000000370000-0x0000000000546000-memory.dmp

Download

memory/4184-114-0x0000000020890000-0x000000002089E000-memory.dmp

Download

memory/4184-113-0x00000000208C0000-0x00000000208F8000-memory.dmp

Download

memory/5212-1170-0x000001B3BAD60000-0x000001B3BADA4000-memory.dmp

Download

memory/5212-1179-0x000001B3BAEB0000-0x000001B3BAEC2000-memory.dmp

Download

memory/5212-1180-0x000001B3BADE0000-0x000001B3BADEA000-memory.dmp

Download

memory/5212-1175-0x000001B3BAE00000-0x000001B3BAE14000-memory.dmp

Download

memory/5212-1174-0x000001B3BADB0000-0x000001B3BADD6000-memory.dmp

Download

memory/5212-1173-0x000001B3BB080000-0x000001B3BB242000-memory.dmp

Download

memory/5212-1194-0x000001B3A2510000-0x000001B3A2518000-memory.dmp

Download

memory/5212-1171-0x000001B3BAE30000-0x000001B3BAEA6000-memory.dmp

Download

memory/5212-1162-0x000001B3BA8A0000-0x000001B3BA8C2000-memory.dmp

Download