hxxps://www[.]foobar2000[.]org/downloads/foobar2000-x64_v2[.]25[.]10[.]exe

Analysis

user interaction
yes
max time kernel
32s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.foobar2000.org/downloads/foobar2000-x64_v2.25.10.exe
Sample260702-flayvaby4y

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	4416	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
1252	foobar2000-x64_v2.25.10.exe
1456	foobar2000.exe
4976	foobar2000 Shell Associations Updater.exe
3256	foobar2000.exe

Loads dropped DLL 52 IoCs

pid	Process
1252	foobar2000-x64_v2.25.10.exe
1252	foobar2000-x64_v2.25.10.exe
1252	foobar2000-x64_v2.25.10.exe
1252	foobar2000-x64_v2.25.10.exe
1220	regsvr32.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
1456	foobar2000.exe
4976	foobar2000 Shell Associations Updater.exe
4976	foobar2000 Shell Associations Updater.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe
3256	foobar2000.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	foobar2000.exe
File opened for modification	C:\Users\Public\desktop.ini	foobar2000.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	foobar2000.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-synch-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\asx.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Pastel Green.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\components\foo_dsp_eq.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\uninstall.exe	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-libraryloader-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\fpl.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\ogg.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\opus.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Separate Album & Artist Columns.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\components\foo_freedb2.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\sqlite3.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\msvcp140_atomic_wait.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-localization-l1-2-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-crt-heap-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\m3u.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\doc\license.html	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Blue.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\PP-UWP-Interop.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\ucrtbase.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\shn.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\wv.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Default Playlist.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Slim View + Tabs.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\vcruntime140_threads.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-datetime-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-profile-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-sysinfo-l1-2-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\cda.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Faded.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\avformat-fb2k-62.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\vcruntime140_1.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-processthreads-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-crt-math-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Album List + Properties (tabbed).fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\components\foo_out_upnp.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-crt-string-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\tta.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Album List + Visualisation (alternate).fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Black.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\mp4.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\doc\titleformat_help.css	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\avutil-fb2k-60.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-interlocked-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-util-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-crt-locale-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\ofr.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Forum.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Visualisation + Cover Art + Tabs.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\components\foo_input_std.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-processenvironment-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-rtlsupport-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\mp2.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\spx.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Album List + Visualisation.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\components\foo_converter.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-errorhandling-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-crt-runtime-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\icons\ape.ico	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\themes\Yellow.fth	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-crt-environment-l1-1-0.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\foobar2000.exe	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\vccorlib140.dll	foobar2000-x64_v2.25.10.exe
File created	C:\Program Files\foobar2000\runtime\api-ms-win-core-timezone-l1-1-0.dll	foobar2000-x64_v2.25.10.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\foobar2000-x64_v2.25.10.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3752	msedge.exe
4416	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-19	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-20	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274418386798424"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.AIFC\shell\open\command\ = "\"C:\\Program Files\\foobar2000\\foobar2000.exe\" \"%1\""	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.OPUS\shell	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.drf	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\foobar2000.exe\shell\open	foobar2000-x64_v2.25.10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.OPUS\DefaultIcon	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.TAK\shell\enqueue\ = "Enqueue in foobar2000"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M4R\shell\enqueue\command\ = "\"C:\\Program Files\\foobar2000\\foobar2000.exe\" /add \"%1\""	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.OGG\ = "Ogg, Ogg FLAC, Speex"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.APL\shell\open\command\ = "\"C:\\Program Files\\foobar2000\\foobar2000.exe\" \"%1\""	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M3U\shell\enqueue	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M4B\shell\enqueue\command	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WAVE\shell	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.scp	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M3U\DefaultIcon	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.MKA\shell	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.OGA\shell\enqueue	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.W64\DefaultIcon	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WAVE\shell\open\command\DelegateExecute = "{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.gltf	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WVX\shell\open\command	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.m1v	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.MP3\shell\open\command\DelegateExecute = "{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.OGX\DefaultIcon	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WAVE\shell\ = "open"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WAVE\shell\enqueue\ = "Enqueue in foobar2000"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.EAC3\shell\open\ = "Open in foobar2000"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M3U8\shell\enqueue	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.AFC\DefaultIcon\ = "C:\\Program Files\\foobar2000\\icons\\generic.ico"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.AIFF\shell	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.MKA\shell\enqueue\command	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.SVX	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WV\shell\enqueue\command\ = "\"C:\\Program Files\\foobar2000\\foobar2000.exe\" /add \"%1\""	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.bmp	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.AIF\shell\enqueue\command	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.MAC\shell\open\command	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\foobar2000.exe\shell\enqueue\command	foobar2000-x64_v2.25.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.DTSWAV\shell\enqueue\ = "Enqueue in foobar2000"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WAX	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WMA\DefaultIcon	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Fb2kShellExt.Fb2kContextMenu.1\CLSID\ = "{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.AIFC\shell\enqueue\command\DelegateExecute = "{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.APE\shell\enqueue\ = "Enqueue in foobar2000"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M3U\shell\open\MultiSelectModel = "Player"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M4A\shell\open\ = "Open in foobar2000"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WMA\shell\enqueue\ = "Enqueue in foobar2000"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.CUE\shell	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.W64\shell\enqueue	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WV\shell\enqueue\ = "Enqueue in foobar2000"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.WV\shell\open\command\ = "\"C:\\Program Files\\foobar2000\\foobar2000.exe\" \"%1\""	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.M4B\shell\open\ = "Open in foobar2000"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.OGG\shell\enqueue\ = "Enqueue in foobar2000"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.SND\shell\enqueue\MultiSelectModel = "Player"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.xvid	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.ASX	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.MP+	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.CUE\shell\enqueue	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.MPC\ = "Musepack"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.MPP\shell\open\command\DelegateExecute = "{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}"	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.OGX\ = "Ogg"	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.dng	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.8SVX\shell\enqueue	foobar2000 Shell Associations Updater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.AU\shell\enqueue\command	foobar2000 Shell Associations Updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\foobar2000.CUE\ = "Cue sheet"	foobar2000 Shell Associations Updater.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\foobar2000-x64_v2.25.10.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3256	foobar2000.exe
3652	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 5532	3652	msedge.exe	80
PID 3652 wrote to memory of 4416	3652	msedge.exe	81
PID 3652 wrote to memory of 3600	3652	msedge.exe	82
PID 3652 wrote to memory of 3600	3652	msedge.exe	82
PID 3652 wrote to memory of 3600	3652	msedge.exe	82
PID 3652 wrote to memory of 1104	3652	msedge.exe	84
PID 3652 wrote to memory of 1104	3652	msedge.exe	84
PID 3652 wrote to memory of 3136	3652	msedge.exe	85
PID 3652 wrote to memory of 3136	3652	msedge.exe	85
PID 3652 wrote to memory of 3136	3652	msedge.exe	85
PID 3652 wrote to memory of 5684	3652	msedge.exe	86
PID 3652 wrote to memory of 5684	3652	msedge.exe	86
PID 3652 wrote to memory of 5684	3652	msedge.exe	86
PID 3652 wrote to memory of 2624	3652	msedge.exe	88
PID 3652 wrote to memory of 5948	3652	msedge.exe	89
PID 3652 wrote to memory of 2624	3652	msedge.exe	88
PID 3652 wrote to memory of 5948	3652	msedge.exe	89
PID 3652 wrote to memory of 1592	3652	msedge.exe	90
PID 3652 wrote to memory of 1592	3652	msedge.exe	90
PID 3652 wrote to memory of 2164	3652	msedge.exe	91
PID 3652 wrote to memory of 2164	3652	msedge.exe	91
PID 3652 wrote to memory of 2164	3652	msedge.exe	91
PID 3652 wrote to memory of 3144	3652	msedge.exe	92
PID 3652 wrote to memory of 2888	3652	msedge.exe	94
PID 3652 wrote to memory of 5180	3652	msedge.exe	96
PID 3144 wrote to memory of 3308	3144	msedge.exe	97
PID 1252 wrote to memory of 1220	1252	foobar2000-x64_v2.25.10.exe	102
PID 1252 wrote to memory of 1456	1252	foobar2000-x64_v2.25.10.exe	103
PID 1252 wrote to memory of 4976	1252	foobar2000-x64_v2.25.10.exe	104
PID 1252 wrote to memory of 3256	1252	foobar2000-x64_v2.25.10.exe	106
PID 3652 wrote to memory of 3868	3652	msedge.exe	109
PID 3652 wrote to memory of 5956	3652	msedge.exe	110
PID 3652 wrote to memory of 4276	3652	msedge.exe	111
PID 3652 wrote to memory of 3520	3652	msedge.exe	112
PID 3520 wrote to memory of 5164	3520	msedge.exe	113
PID 3520 wrote to memory of 3752	3520	msedge.exe	114
PID 3520 wrote to memory of 3616	3520	msedge.exe	115
PID 3520 wrote to memory of 3616	3520	msedge.exe	115
PID 3520 wrote to memory of 3616	3520	msedge.exe	115
PID 3520 wrote to memory of 3576	3520	msedge.exe	117
PID 3520 wrote to memory of 3576	3520	msedge.exe	117
PID 3520 wrote to memory of 1476	3520	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.foobar2000.org/downloads/foobar2000-x64_v2.25.10.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9e2a4c188,0x7ff9e2a4c194,0x7ff9e2a4c1a0
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,6372107918557811706,11348293538176291833,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,3715938932431746843,14368586437365450838,262144 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,18380235650628142846,9081333344026795374,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,1627577857254248829,4453891270586827153,2097152 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,12416202353365176417,13382166736328880964,2097152 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,7035726252533120905,2220314003038969030,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,5365757720647072466,8506745264311071739,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,14721432370576487832,18138358220514578639,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5588,i,18301847680547477783,15121038233526394041,2097152 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,3801828481795767665,13190880952815666594,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,827344633211803544,5486158498339304367,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,827344633211803544,5486158498339304367,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,271735130944169200,4889967849914033711,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,5891551493280115420,7671923655133724153,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8214122736964880243,1807426171389006828,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6248128472290143370,5400760199373325812,524288 --field-trial-handle=1980,i,5797488765553287840,9071398084038971340,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9e2a4c188,0x7ff9e2a4c194,0x7ff9e2a4c1a0
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,5228532685220744106,10374952903363105175,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,2196405724187440797,15690074494061612550,262144 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:2
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,11529954241678521014,1554969675351857833,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,16108415202021843987,17644186222625589321,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,16108415202021843987,17644186222625589321,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,1553079386261560311,16280991126382640589,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,6230663267618922694,41982330336326014,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,15998856831906901118,9982213419354885064,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,13855003218028635850,16624059171817931221,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,6623419712685963475,13572818519449847360,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,14557895632473019437,10332661795644477692,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,12176139053174789163,2782460770773055052,524288 --field-trial-handle=2052,i,1488501009945325352,6132201361131211624,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
    3⤵
    PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2204

C:\Users\Admin\Downloads\foobar2000-x64_v2.25.10.exe
"C:\Users\Admin\Downloads\foobar2000-x64_v2.25.10.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\foobar2000\Fb2kShellExt.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:1220
- C:\Program Files\foobar2000\foobar2000.exe
  "C:\Program Files\foobar2000\foobar2000.exe" /install /quiet /exportshelldata "C:\Users\Admin\AppData\Local\Temp\fb2kshelldata.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1456
- C:\Program Files\foobar2000\foobar2000 Shell Associations Updater.exe
  "C:\Program Files\foobar2000\foobar2000 Shell Associations Updater.exe" "C:\Users\Admin\AppData\Local\Temp\fb2kshelldata.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4976
- C:\Program Files\foobar2000\foobar2000.exe
  "C:\Program Files\foobar2000\foobar2000.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious use of FindShellTrayWindow
  PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fb2kShellExt.dll

Path C:\Program Files\foobar2000\Fb2kShellExt.dll
Size 185KB
SHA256 64ab25774fa6e675b6e55188358263a44dede7a60b9354890045735df5553fe4
MD5 c383f4f31c2d136e9e9b42cb61afa649
SHA1 1a58e2cafbb68c9ad9b8c229958ec86304281db1
SHA512 78ead951f9d337fbf63f6bc561aee06299c54170b3ccc3c902855761d0fd38c46536ef6548021bf240123d6be8a917f9695f54e69e4cfe81af6e3bd28ed0bb53
SSDEEP 3072:1pgEHmy7v36j9t6m/1dFvFv6iKyM2O4TJqoja8VtgKOZVRrNEpmem:Lgqf6Zt6m/1dF9qyM2OkJtk3rNkj
TLSH
T1FB046B4773A840B7E17B8135C9974A42FB76B8025F609B5F13A0436E2F73391BE2A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files\foobar2000\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avcodec-fb2k-62.dll

Path C:\Program Files\foobar2000\avcodec-fb2k-62.dll
Size 1.3MB
SHA256 2ee5dd3eec66584d7cb6b71d9bc116d6c634d51decd79789c88d22284e90c288
MD5 4fe0eb9fcb3187efc54dd7e37ccb466e
SHA1 059b1ec141fc269e41f2355e4b6f29ad9b3bb3ff
SHA512 c0a7aa2daedc813bf4000807c54a04c4743e652ba87de5be6d62e7c7a3d12f80c3c5cfdef0729423077cb0ed23658f662857fa171882787cd518860cdbf70126
SSDEEP 24576:aYUTGyUv24oGVktCQS5/zgTiCCFXx7FBog:aYUTGyG24o9tS57g+C6B7zog
TLSH
T17255BF45B6B11AC8CF6B907992A3BB07E675391507400DEBBA98766C3E63FD00E3B705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avformat-fb2k-62.dll

Path C:\Program Files\foobar2000\avformat-fb2k-62.dll
Size 311KB
SHA256 5944bcc7217c874d8c704b9a1a15c62187ca56c7ba7c4f50e04f04a84d79b3d8
MD5 df09197bd8fd338e4ce9c1e291a32b08
SHA1 6f875d2c9c564fc6a682465e797e396811e6d7e9
SHA512 baaf4cc27b6015c9e43395fcbb043e418dc58e2d151ca64639790f5d974154fedb029f219ac788c082e1b6ef1e08a2b48e771bc3554d2be2bbb6a228efeb3f17
SSDEEP 3072:lTJBIWE43Cfp9MWGfJmY7q+09LBRUi2bgIGjfUg7gcPMUE9C:hHE4goQ+8LjDT7vPM5
TLSH
T164646C5AF3A41099D5A3C03C86978A07F7F175151320ABDF4BA042A93F13FE5AA3B764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-fb2k-60.dll

Path C:\Program Files\foobar2000\avutil-fb2k-60.dll
Size 1.2MB
SHA256 3901384e4dace4511e742dc1ddd5850bbc8810ee23e4b93a795f1dc4aa521c6a
MD5 04bbe454f829ff9f09f000bc590803dd
SHA1 452f47cbfe1575f24752cf3b43e97ee807ce0954
SHA512 b0a2d038322fa3663f77b19fb7929c7f5ed2ef4b060838287f2307efb490cf7218cfad5163c86a35ddd55fa0dab837151f8fed90affe0e6a8f14fdcd5f572366
SSDEEP 12288:uQYF5D7jjgjmCxmdDbrA3QtFs1Rz1V0JTbt461O:ZY30lxmg3QtFs1p1V6b
TLSH
T162458E459BE0046AC86A5038C2A75A4FF2623412C750B6EF76F249543F23FD26D7BB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_converter.dll

Path C:\Program Files\foobar2000\components\foo_converter.dll
Size 871KB
SHA256 eb048fce312df06e2591716a473c7994316305ecd9351eb79876d9b638dab609
MD5 1ccccb7debe26266ffec82ce0c35d0a1
SHA1 82b3d4f038b86cbbbd0127386353e0e64c06b9d1
SHA512 2cad0c9070d9ffb3ae5fc0ab5eeb613448dd75becf98ae65e61641d4cd34b3ee35ef46a8a4266de7b461962d2eb8f1d372e742cdc581357c379cdcfc6173be58
SSDEEP 12288:JKNpXkWlqwcmmKmYjHrv1aZRDtbiJhxjIPB5aZyyQWVcvC:gDlqDmtmLdbkvjIPHaZyW
TLSH
T128156D5BA7A80095E0A7D279CA67C816FAF178460365D7CF06A1876E7F27BF0493E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_dsp_eq.dll

Path C:\Program Files\foobar2000\components\foo_dsp_eq.dll
Size 306KB
SHA256 a4ef5f67adb71b07078b27419a503104ac86a69539f7096fe421053042acc7c0
MD5 ad05e0f4b3664fbfc9ec7534b321e664
SHA1 df3a2ec0b0a8ecea1b1abdc174677413a2ecba54
SHA512 b8169898a5f2e834951d99a78d19affd90d7e6c4aa7d54c2ed9ff5a88d0f86b1bc4934930b16c628a7403c09a042448349f0770ebf87509c9c0d330dab8c31a7
SSDEEP 6144:rX3Ul+DA3cYyDuCUX1re9g42+8DV4xdMNs/1:Y6Du5rp4sDV4d
TLSH
T1E7649E5AB45744CAD421517985BF6A0EFB717889032486FB03A14B7E2F2FFE16D7B220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_dsp_std.dll

Path C:\Program Files\foobar2000\components\foo_dsp_std.dll
Size 273KB
SHA256 734088d5638a037cd372de2166dab817b15e61950d61f76ab1816afb82a7c67a
MD5 aedbfee47c6f8a12cfec9952b06579f2
SHA1 9572d207660c136ec296c0a0bf37ef4158c2bb3c
SHA512 7b0ab16617511e45568149110165d3a72f9313b8dc48f4d2471a7547181c5ae25fda9a9bd3f74a3f98dc229078a0ff716051697bfafc9ebe585e78afc02c72fa
SSDEEP 3072:dkwkJbNgvZRmIB7tlq8h84EsX+sc9IqkiDt8AlVDgwyg/GKVf/D1+VY2+Q0C8:t4OBQIB7tlxEsusVqkiDP//GKV3DkV8
TLSH
T16E548E9AB815048DD967907886BB7D06F7717889032046EF12924BBE4F2FFD16D7B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_fileops.dll

Path C:\Program Files\foobar2000\components\foo_fileops.dll
Size 555KB
SHA256 37d3cfb5dbca416cea7f21299a97f8b84a02c6bc8bc6dc5e9fda9b16eabd744f
MD5 f87995d85de025b777a4390ee62f9b49
SHA1 0c5540e2e4e6d5cdcd9f76bf6d6ec942e3668a36
SHA512 5babeff86e1cff8e94a6ec5f78adfbcf0b70f1661bac81435603a27d9e8fd3efabe4a0bcf51f0602d61312377c51993615593c1b650e3aa3422b3140cb84cb33
SSDEEP 6144:OGP0rJlEfqCfO5oCbxmPWX5RNIqN4ghRjV3wFKcDI/20T0thpPf9mugcimlYtv2:OG89lvtm011N3Xctzatv2
TLSH
T1DDC43B5B62A80395E1ABD17CC667CD07EBB178490311D7CB06A187AA6F67BF05A3F310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_freedb2.dll

Path C:\Program Files\foobar2000\components\foo_freedb2.dll
Size 305KB
SHA256 63a1c2a47ee4a67a723f6c228f11281c397593d7598a5d58d6550f631126a7c4
MD5 66000a902fd479f095439ebd49b0a38d
SHA1 d42f5c18bdeea30f7b946d788962098a61e4e0f9
SHA512 61d1691bfd43930b9f5064fcf3f7ca46c883521a13b7bc37e279fe92b06db22b948a9e8fd5f4a510d0a090702fc3dff1d62760565748a6d12a8d0feae9bd36c3
SSDEEP 6144:AaPUMa8EeuyRRPK/M+R69YQEjLuJi5pQ5:CyRRSgYvuJi05
TLSH
T17C643A5F72A80C95E967C17AC657C90AE7B278460361D6CF12A1476B6F27BF0B93E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_input_std.dll

Path C:\Program Files\foobar2000\components\foo_input_std.dll
Size 2.4MB
SHA256 46a4b9c4515fae55add895e12d30602f73944959f0e0f7acf7122e6562b51651
MD5 d6c09a4918d77ddcf000af24a3e7eb4c
SHA1 1d6171bfdf7e846aa8d07db65711a433f856f82c
SHA512 4698446fe5eaa5424be2caa7b92eaff698fe859dc862553ae1c6163ec4403403c06c67e398ee539cc3818aa5248e5243029075f7616dd24fb9f364df7b8e5870
SSDEEP 49152:h8PQEOc+ORbs6m+nibwMpU5ppoDvYPeNzZB7tW:hfR8qp0puAuC
TLSH
T136C56C5BB6A440D8D1A6C179892BA50BDBB1344A0320A7CF139186F66F27FF19E7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_out_upnp.dll

Path C:\Program Files\foobar2000\components\foo_out_upnp.dll
Size 982KB
SHA256 f2331c006742a46c671917f6067b7f4f331a687703f5df327fd2d78ae80df105
MD5 c863b5f3e8dd4ca9594a3026136612c7
SHA1 b5f6c31db811edfcb666a95df3d360f80426e6c1
SHA512 7a6b721dd00cd10e245846061ef4a9de4f0bad8a0b558adf2ed5e329def2b69378c2f5d43f295c30a964d204fcf3aa9bb87a5c15beb4892e9d04e9a1ad399e67
SSDEEP 12288:WOcI4tJo2X9oH7ht4fKuluwsL9PCQXvPCk27QZVg:9cIWJo2XINt4fKyIL9CQz2sv
TLSH
T10B256C4FA6A801E9D1ABD1BCD3579902E67174460375DAEF03E086762F57BE1AE3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_ui_std.dll

Path C:\Program Files\foobar2000\components\foo_ui_std.dll
Size 2.3MB
SHA256 60fb1ce2d59dee87d4c3ec044addb6f0995f456e0260faee152e7b342a782d6e
MD5 a799a99e165529bc21fca3f1ad4fd6d2
SHA1 6bc339c5f2f4a21841a5791e540711d031c6b017
SHA512 bb6340e24f931ede0a90b8a9ee85fe5bebbbd97dd6cf776cae7bcc8e2602502fa47e6dd6d3919eefca6f42b9d2ba8e3833ba82032a6c80b8db245a492e6f4544
SSDEEP 49152:L5VPLwDK59yETI6vHAUx5G+Gonp/9V+xAkpr/kN/sl/:7Hvgm9zVn+l/
TLSH
T14CB56C5B62A800D5D1A5C17DC667DD0BEBF1784A0321E3CF069182AA6F67BF09E7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foo_unpack.dll

Path C:\Program Files\foobar2000\components\foo_unpack.dll
Size 605KB
SHA256 227c80995a9bc2e45f29bd4365bb06dd435bd868a419ad16c9c89d0899a78798
MD5 f47852379e2408e0669fec8050017dd3
SHA1 c17fc54b2ff84e047d0d830ce17148ee6f5f6cc4
SHA512 739eb0be12e0beea4f7554527c605f477e7da4c5c0bbd39024a8ce08e61b09c58e4cfc6ae995e10cd9f54e72282f05cc43a5ff45bb440f2e9e0dcb2154d8c17c
SSDEEP 12288:gF12GzIzrrA1o8JSSltKjnOgfrkZqLxFn8Gs1:gFlzKrrAHjt4rfoZqbn8x1
TLSH
T151D47E5AA2A801A9D5B7C034C6578A17F7B278851324E7DF12A1866B6F17FF05F3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foobar2000.exe

Path C:\Program Files\foobar2000\foobar2000.exe
Size 4.6MB
SHA256 653cc120c146aaae9e6db9b6f19e5a1588407b8940bc1521f0ced739ff8924b0
MD5 d09fa88c0fbbb35a4d81158b4489318f
SHA1 2afc74cbb2821cd1de07bc800758337ff7f8bc83
SHA512 151c1a2b0744bb7f431a9b7d7ef2d2fddcce399f0f5a9977177733854c198437a00cdae32c117e4a024089d90e9ec567c8cc184c2dbf999f235fd71901df3c52
SSDEEP 49152:l6z078tV6/8175Hr0TU3gzWZb3p3SAMOU4W36dSWXy/yvdZqPQYQBlRAO8ITwTgu:NED71bZIQBBFcT3H5suDU4
TLSH
T10E266C5B62B800E4D1A6C17DCA6B9416EAB13C8A0731D7DF069197A65F37AF09E3F310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\foobar2000\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Program Files\foobar2000\msvcp140_atomic_wait.dll
Size 49KB
SHA256 640b2aefced484d0368eea5bdd06addd0658a3a70a49256e560d6923b404a479
MD5 44aec42494531580bca182b0e2fb19c2
SHA1 a85a6a4de6656e5969fa4ab15f2230dfe2839e75
SHA512 d8afb5bbb1394fd14c3ec8ecdd4c02e1c6f23031b15173b1448dfd4915c392bb8512cd41eccb449db19969397a09046d27d54db704c8122ff62c12ff5a89c9d6
SSDEEP 768:ayMsqh8UGchsJr3KbYA5XeDmqw4DYPW9zr0JD0io9z7p1uF:W+UjCKb/5XeCqgazrURgz91G
TLSH
T19C337DDDA7684083E5678634C1A4E517FA7AB7E20710D6EF4352F0890FA37D1AE34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.dll

Path C:\Program Files\foobar2000\shared.dll
Size 151KB
SHA256 161075c7ec94909e8b342c0d5b2101cc34a3afcb94cd597af8f22116cd6fb9d7
MD5 5e32404833629f860588500c8ae8a5d3
SHA1 56ef1306c8c631079cbed374039e2a64143d678f
SHA512 6467b49c0ce44b677fee134dd25cad3d2cfe2d8cb38bfaef1a666afa29cd41663f257b164ce90ba1368f699ac46a3f543b96691cea4be7835927ee7930c178bf
SSDEEP 3072:zUBc4A+MUDO4o0tv97lZhUwHzAFMP8PCp8:gBrO4o0X7lFEPv
TLSH
T11CE36C8A76380169D5A7D13D81A6A506FAB67885132097DF01E0C3BE2F17BE0BE3B345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Program Files\foobar2000\sqlite3.dll
Size 1.0MB
SHA256 26517154d85ff4ee74281ffb76afbe9a3dc05b5cfc82b2486e721993a39c8d60
MD5 3f47be41d3976e65290b8793fd50c2a8
SHA1 a185328085cd9c19196f9cf9454d806ded7f1cbd
SHA512 72729c6e48f26c72b8fe534d47907e6e6e99087f5cb32ef2848ebf03f3bba12e9a1eb0f65ceb38c6444a04988bfa4f2b4898ceb02785ca69f93ba0876e09bceb
SSDEEP 24576:GU0W0zApIgcZ9q1CSReg8Ea/VqbZ50a40:0z3g2u2gDa/VwEa5
TLSH
T1F0359E47B2B900BCD457C1B88A5B5607EAB2780513749BDB54A0866EBF33FE1167E338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\foobar2000\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Program Files\foobar2000\zlib1.dll
Size 93KB
SHA256 5f4e700b729dbd3945bc208400d492f293fb121736981bff341c9b5ca9c8ef01
MD5 ecc9dbdb472f8e7deb3f22c935b2d607
SHA1 5c04a8c5fc2183364492f2bcf65498776462d440
SHA512 c449f9995ba26a05bd6964e0573ea2428def9ad20b79faa4d375ff14134702407583dad6568881aa86c94be76922c52034d90f45bf26ad78a67a398df0f26e6b
SSDEEP 1536:OvLu561Kr1549auPA0PtX6G+sglyeJwpuq8G03FUs5aIOkmFkCBARPblj:N56YxYP1eJwpA3jokbXPbx
TLSH
T10A936B466AB41176D6B78178EDE34BAED730B01403641BDF9684A3651F23EE01F3A3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 052d068556442d6dea8027b3ea9b47cbc780dff0564ddbb1ced08f56a40a0997
MD5 34d0dc7e7b2fa41a04072d49fac21c96
SHA1 a7995a76b896945df070a3a9690eb6d786b10618
SHA512 12201cd368c293b2ffe1d8eac67c0ddab3c033a9b459916114d76d544c0fd85614686a3a177447eb910a0ae36f9ac30c24aed3f464494e33728d23a963d718f6
TLSH
T178D0236476397CD3C238357691A08703B25555732657D1416140C40C9D7DCC3EBD59D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68695459356b4f9c9569be0f8c9bbf4f49e46094f5fbf91a473470d942ba1777
MD5 68e7bb20b113373337143241dbe6dd56
SHA1 95d02cbeda55a0bb0f5fffbc761f08f25494600e
SHA512 643b88720ad312c64bb4b2fa68f96c61d6f09759ca09aca0a1fbcad655b8d4a3bb8512d4d37d0a30ac4d3e67b50d5259f032e6646e09689aa94af0804a1d2ee7
TLSH
T1D2D0A9A8763A6803D6242936A1908B03B2A65820786AE44260F4D24C5E3E9D2DBD9082
MD5 SHA1 SHA512 TLSH

Submit Download

742f5baf-b89d-4f5b-b4bf-73e7faff1027.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\742f5baf-b89d-4f5b-b4bf-73e7faff1027.tmp
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1224dc6b58828f930a2abc603fe27d517f67aed32caf03fd7fbb93cb7d970d6b
MD5 80b72678666b66aa5b920bedd746dc76
SHA1 88f3beedb932eda65337837427b9aac3582ffca6
SHA512 d04be07ac9aab918cd15cd31bfb61d78c1c02b60c4b3f36d9d528f0d73034210aa3500b39dda5875708b91f20ad515f4e1d4e4e64bf7a291ca7d9832b57247db
TLSH
T16FE02BAACD719C2724FD0B2AA0664A8AEB5013671780955F7A3E860C8FF573A0686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 be6a75ad29d13068782b022ca9698766fe7f109f05689be97a88fa65393c004c
MD5 8e81830386d433280ee25ced08d8fc31
SHA1 398eba38f96fb8c97c1973bf95f986a54524eede
SHA512 0945bce71c44478e2c2467b16e6a802a136d4889ffe2e0a91840ea89319b90451c45fb2f3484a6f4271420ba4cc581f5a1f4dc2c6b7a7196cbea53f0248bff47
SSDEEP 3:MsEllllkEthXllkl2zEkluL5ll:/M/xT02znE
TLSH
T1E94404047FC41715C50010344013C7500370D5140555575334510D13DCC55400C00110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 aa9ce664ebfa129d00a8df912c60d112fc85ffa83ed32cac27d820838dee70d1
MD5 71b5b4f86be99f15b6b929da7d556a87
SHA1 c7e2e366c1d315814e0682b616b10aeffd38109f
SHA512 fcca943c25f6345a4cadc4a9133a787fcd5a174f199c2e2dd4f1af4e25af07192f84b72f15feb62a05e3f4a6ac47c00c127c7b10152facbcd9ef205f8cec9fc9
TLSH
T1AD31A2F783F4856ECA1196F0AA18BE2FCE1D0511432C7D9AC5E4AF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 c1b1ae96640ad9763ec7ca59336b7e65c20709b38c6ba9393d45b1d3b86b5f72
MD5 31bcfdd53cc3ad74c80c85d0e05771fa
SHA1 cc052c5ddc1b50868f83a3bbe9f41fa347843ed6
SHA512 c2af5176b84046ec7f97ddd7cb1d08df45091e52dfcad88c988084b0f72deb5a523f6462aa9327f0c2ac18b9f709486b10ae651c4a998ad212e716670adf81b8
TLSH
T1AAC0225284F8E4F7203484390980A884BF35C430114094A2C9A4837CA1910BBAA0103D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 92d2ea16769a9b65dc85a4d817cfed197250b145fdff3f5f7301d65b7f3db8db
MD5 16d9f0575a0a7818ce2f736a7e99d63d
SHA1 3c0e0c5fc336e5f3c8de7ab22e91846a8da86700
SHA512 68f11edb18fa48542838bf26fcf4553fc492b1e564a86fdf0b37be4daa50e2ed926b3bcb531b30c187505d82d95139eb6294bc27e2efe9657d671cbfbf939289
SSDEEP 192:sxZ/RsyMqZjK1Ml8PCow/fas4WpVJ2pvE0CXU6zodpW/W6+WNGY0d4HZRmIgbW5J:sxZ/bIw/fas4WvJ260LBW/bG50c6j
TLSH
T15F62F6166A289D7B8CCBD20DFA557F53D6F9052392905E44A9FC8B0C01E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1bdf73afc34296f2ecf543dc57fbe11f904b4be35448f003ac36fd321cc8cd01
MD5 66061d74e38ba3d040658ea4ce77d934
SHA1 5b0e35e4676ebc9394edd5cae26a7123ca92b85b
SHA512 361acfc23f5408a07349fa910dafa5f47a9fa166f2fab0d0c998a04eb1fe7e974eacc0599a7f8f7068d109a1e266f3242fba425f0e3da0319f10f0dd6a357ebc
SSDEEP 192:sxZ/RsyMqZjK1Ml8Mow/fas8N2pPxE0CXU6zodpW/W6+WNGY0d3cZCsIgj5J:sxZ/bQw/fas8N2N60LBW/bG5uJjj
TLSH
T19E62F816AA349D7BCCCBD209FA557F53D6F9112392904E44A9FC8B0C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 42d13ca9041707eebe04538b8e290fe248831d18059cd05daee5661e84d5c9cf
MD5 f8108b283ccbadf2b3edf0e9976792db
SHA1 25150f43dae9c16b0a9da37605ebc0ab26591148
SHA512 eb74c15c888c69e7d64d98ba3ebee9b2739cb61197514fedfc56748d7fd7a8930fd52a402c563b3dbb6bcc84bd8a5569ab73a2ce969009c2a7881e49c62d8eac
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72zH9:AFBHhTofhno2mBea2zH9
TLSH
T1D6B28E52717B12123C3E290CA7A59B371E8272A33458A97F7BB900B64E67E115DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f08b58ef2871133006a16af07ccd51b37bdc46770e83982f1bb59847b3ccbbff
MD5 81e3970af8c299a1711bc7e71803c94f
SHA1 4ab47f19d064c59b74dc59b5d55d6931b1429a98
SHA512 d9ebc4f05ada2d4eaab263bf54f866193d17c7e3f5b8b156041071293cc153fdeb3fbd6fcc6c47d98a388eb6da0f6e87c284e426a29644341f4e4126435f09ae
SSDEEP 384:n5HiF9CcmyWCs38N98TUNTUlIxBydUYijGfb7oodhLCiWhhkP+lFYS/VNHy/7IgS:YFccps3awgKpophhkoFYS/P
TLSH
T1F0C24A32ECA4CEABFCD64FD9E64A7A02DDE04163868C9AD4DAC81D5D00DB1AD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d9a0ce3eded8155124b86dfeaed75450b6b8fe331de8d61fbf615549d53f9b4e
MD5 d9195afaae2971a4176b86158ba9ada0
SHA1 df5e53de6cc3b839c14d523d1e9d6e6f29f5de5b
SHA512 e7d6d24f9228a73afe1863def8b7940ada0d29d60003ac27d7eb89405a6aff7046098e4c16eb8545004ebc42dbdb8191846e0982fd2d84917c7dc5e666f40f0a
SSDEEP 384:n5TiFHtNn/s3n9So8NZ8TUNTUlIRtygwBjGfb7oodhLCiThKl8BhBTPLBliHw8Hc:oFHj+9vKwgsAowhKl8BvTPaHwJn
TLSH
T12BD23A72EC54CEABADE74EC9B35A7607DEE041A3968C5ED4D6C81E5C00DB19C530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 07782a96610f7b12535173c403cdc4478151016066486e463f4e4e77a3a6da85
MD5 14ea893f4103440dff0c6859efbb4fa9
SHA1 eb6142deb0402bd15fab141abb0a188236bfac2a
SHA512 bb478cbddd09515e5274f52f76f80ebe795878aa8f892b8b87914e3760351681d53ce40483ac8c21828612588216079dfc85b4089352e99ddf78a7c91e2d150b
SSDEEP 384:n5TiF9CcmyWCs38NZ8TUNTUlIRiyYwBjGfb7oodhLCishDDHy/7IgK:oFccps3Kwg/Aolhd
TLSH
T167B22932EC64CEA7ECE65E99F35A7603DEE44163868C9AD4DACC1E5C01DB19D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3b4a4da0897537a978ae09facf298d843c4e48aec112830cb68e38e404d1454b
MD5 8b54ce62c13d6912586e885ccec8de64
SHA1 1190e8a7cc99cc86b7a521a7311b1d84d75783d9
SHA512 d4f580ff39352d91f2b495557c085bb61b342b6c435b5c8da107425bfaee78f63aae3a20f9f26415a8a2c26dde6259ee5092941416536d6a2b7386ac071313cb
SSDEEP 768:UFMj+9QKwgbAozjnG1K7k3q48grc2Kl8BvTPaHwJn:O9QSnG1K7k3DTrc2Kl0WHw5
TLSH
T142F21979DC54CD7F98EE7B88A74E7A2698E40173C5A899D8D7C80F4C80B659CF30B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0a34d0342c936002999e7c96420ea315b431333fe99bd3da36352e8a539f7a88
MD5 8eb438caf549bec87be93d9e8fd414b1
SHA1 6f98989e7a5e66bfed67d3d15a9c23b560be7a08
SHA512 6e4884d52b5b82fa1ee7e07e103ff44d0b9aa0e53fc0dfe029a55120bc4fd875c7682aac0b1381f6c5807bca5363388a53182b1f10aff8e874999bbe65a9f62b
SSDEEP 384:n5HiF9CcmyWCs38N28TUNTUlIxBydv/oQajGfb7oodhL4AhkP+lFYS/VNHy/7IgS:cFccps3VwgWrxo/AhkoFYS/P
TLSH
T1C9B24B36ECA8DEB7FCE64F99E74E7A06DEE00163859859D4DAC80D5D00DB19D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73c08027-b898-4bc0-9cfd-4bd3799caa42.tmp

Path C:\Users\Admin\AppData\Local\Temp\73c08027-b898-4bc0-9cfd-4bd3799caa42.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0d2a9f5-b78e-4fdf-a811-cd127c1e10cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\f0d2a9f5-b78e-4fdf-a811-cd127c1e10cd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

SysCompImg.dll

Path C:\Users\Admin\AppData\Local\Temp\nss17AC.tmp\SysCompImg.dll
Size 5KB
SHA256 4d220ca99aa1723ac18b7138bc74149b605b9b43fa3c455c76bb62715b031572
MD5 eb06ec2292a803b4832eab49c7782f53
SHA1 1cc65cab61670b7a19837e56f3c0936365b937b4
SHA512 a02164c3424e97fb04a550085d590b8fbd6553bb63a6edc8cb9aaa0716968425ad10ffc488e229713e489df1012322e3ed87901c6f6bddbccb3a010a3f19aed4
SSDEEP 48:i9n0z+uPvTDK0RH1Qu9mZVk8+iME1ypjnEf3ukVLwIn5T8kvTQp9NMBFtYQwkR8:KqL9VpkVk8+im7kVLwIikLQrCBI
TLSH
T1B2B1A8E5F338C2EDE3D9C3BC929E4D66D575388D52E3150AD600DB0E29113C2E279A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss17AC.tmp\System.dll
Size 11KB
SHA256 ea1525eb2bc61c4582c2979332a187b1de73c57fc1396263da523fe6e522a8d0
MD5 70a4bea4e32b94ad8ec0e1811e1caf4a
SHA1 7b0100829527e793cfddc2cbe7513707539ae835
SHA512 3b2f80897e34b5e424e30fb831832f4add6df8e5cfcefdeda3b41df9d3a291fcbbc075c90c4311dba28e59b701fab6ca98fdc84d548ca4f0a17136f88cd1944e
SSDEEP 192:EP4/8fyi+M7PifUcjSWhYMg11id93ewS9Ye5d6quPr4s0tiz:EP4/mkSPKUM5u11Uu61z4s04
TLSH
T17B326D19DF7221EFD5134ABCC391E406D335F5A82AE0A28FC6D18D57AF136F12E6064A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nss17AC.tmp\UAC.dll
Size 19KB
SHA256 6975d25c8df210ec5ef8cb446f395406388d1da7b66deaef53daa0828437c41c
MD5 a1662bd08b214585b88f3f7ddcff473d
SHA1 e7d629266bc018d3b896b1617789676d9a104d0a
SHA512 50d6230b2114a59a25561bcdc218365b2e473cd1c1c8af1bd226baaec87476099c3b21ed535c6a0003eae2ea95906284eb5906dc1b1728a310f504dd44a9abc7
SSDEEP 384:opWLEAuYxxWA5seNsWC5a3zWB6GW5VvoRnYwGqVksQj:IWLEAXr5sebKajHvCnoAc
TLSH
T1AE9229A4628801EFEC269A35D7B66647DEB178205F7581CF4120D29A1F337F2713DB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

header.png

Path C:\Users\Admin\AppData\Local\Temp\nss17AC.tmp\header.png
Size 17KB
SHA256 651e2ea311f373da23e5f15f06ddbe5e12da7c3a66223ac8018ae391651c5dbf
MD5 c3d3ae0e5e29d73f03a6bc837b881fb4
SHA1 deb498a41aa18ed7b43631918a031be44e85d4a8
SHA512 fe3ebfbde71778c13b9e79101965c7057f259d34602483f0c76cd49c019a88e78007cbe3a376cf8fc66da41fecb9a452324981b7c3417ebdf02741ab491b1df4
SSDEEP 384:qAErmKmeXM1/FMt4CRDuZmEgRhpAJrBzhtUsJhGlCe7/:amKmSNuCtu0AJrBrUsJhz2/
TLSH
T15772D0D38C42784DB2C2F68C155304DCB1E4908367B8B59F9A6DDB67E560E08BDC8615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nss17AC.tmp\nsDialogs.dll
Size 10KB
SHA256 ae5f11268f0bfb49d5ac4e7e59cb6206fa805284d4eaa6990788e5a38177a28d
MD5 d9c2631b7f8105083c8f669c0c568414
SHA1 aae05b29b486528db0641fec7cab579a7b0eb555
SHA512 7ad4750f3b352f1a3d5e3a4d19fc27fc8b5e64c031668e80fbd41c97f4f648c41df73b2a3365f0ab191a5a9242eeafa739af093c1a6cc217b61be9cb1be69123
SSDEEP 192:mxFyrQ6SfSsX2H8PdM5+rN8ge5+Iznez0:mxqpSfdq5QN8F5Ne
TLSH
T17F220B46AEA4D1FDC822D232E4F76F27CB7970155642960E4730D946BF23397392C6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wizard.png

Path C:\Users\Admin\AppData\Local\Temp\nss17AC.tmp\wizard.png
Size 36KB
SHA256 4d4099ecdb2fa456fe76eadd0d987a860e22292afa4aa93142ccb7da733735d1
MD5 0eedab76343af5151b193ea94160c7d6
SHA1 73196f07c7796cf666b2e8a30472b9aa87abe0da
SHA512 f7cacd5dbe11ad727baddb1d48b2ce0c527245b5b054f739212eb693d121f29433c4755413eb6eb64668b69dd5e83b61df016ef209420f99954207730c26ad02
SSDEEP 768:9w3ImIPhpyqqtNPmCVGnLWZPnvJV68UTYT4MpM7MMTgM6Mf/o8q2Bz:+IPLyZtmQ7ZXJVZQo4MpM7MMMG1Rz
TLSH
T1CE03F1E247419478118FE30ADD513E704E536DAD7067BB666242EBB312F066D38EACE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3520_1601242404\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05b36ec5-1cd7-49aa-aaf1-c89d6fbeee0d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3520_313645482\05b36ec5-1cd7-49aa-aaf1-c89d6fbeee0d.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foobar2000-x64_v2.25.10.exe.crdownload

Path C:\Users\Admin\Downloads\foobar2000-x64_v2.25.10.exe.crdownload
Size 7.3MB
SHA256 530e6c9db829874bc250af038c1d07f8b42fef61c5dd99f7edcde6393a93ee23
MD5 0117097c9360021f5bd39570a09bf4c0
SHA1 abfd9fbe2aad817feee7a6068919df9827f7478f
SHA512 1ad378a3e1e9787b90af7202dfc1fb437e9ce4e9b4c02a953a2c6601c3c074b2f1eece064bcb9a7eaf8bc12261c9f24fd80a3ad38d0f190517c23d35b7da64cd
SSDEEP 196608:VxABjudITndMBtNtPcGgBfrE1Pmi+F17:V6AIT+jt0rEki+f7
TLSH
T1B67633BDBB238346DB05853C8096E9BC9556FC960604339F67C1B9EC66B33F4A10E399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

foobar2000-x64_v2.25.10.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\foobar2000-x64_v2.25.10.exe:Zone.Identifier
Size 100B
SHA256 11ec18b521d3b786f20b9cbdca0eb7a23903e97950e12297dd3655f314257de5
MD5 fa8823bbe6cc88e8dac7a353342d710f
SHA1 005b036a6a216063e2ed852b6713588ee1a8785b
SHA512 3d9b4ed73f52991ea9c3195d1b207f62e6314a2133a921a225e72010d0e557573ef1a9e4383639471b6c5107dde852d9881452c0e86158b0bd494933f8bced5d
TLSH
T1F7B01207B4D0843023AC70845EFCCF1C701F310448848540DC604CDBD5E40CCD151003
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2888-207-0x00000234BAF90000-0x00000234BBF90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads