fbc4061465690da603a34ef658fd6800756c11ad67511316a456d28d22b70508

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SodaMusic.exe
Size 153.0MB
Sample260705-3lencsb19n
SHA256 fbc4061465690da603a34ef658fd6800756c11ad67511316a456d28d22b70508
MD5 eb4aaed842d9af36288ab0b16b3b21d1
SHA1 afaf0ec79b1132be6828cb223a24199646984488
SHA512 3676000dcf20a7dfac8e234701c3bee6d2d56bb7596f7ff8e5b336602c9632ccd816d38c317b74a5dcafadcdf6db444331e51c17603f099d71b183fa67cb4768
SSDEEP 1572864:gqi9oCWYyZSH7d0wPaj/HzvgIJ6NTypba/44VDYeIYtsTiFffUBabwhweVxOtwVZ:AoBsa6JypbAI88hhcf0
TLSH
T1CE789D13E29A10D9E05CD1B58B578633EE72BC460B38B6DF265427162F77EE42B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.SodaMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SodaMusic.exe --auto-startup"	SodaMusic.exe

Modifies Windows Firewall 2 TTPs 12 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4048	netsh.exe
1796	netsh.exe
1956	netsh.exe
1560	netsh.exe
4812	netsh.exe
2544	netsh.exe
3980	netsh.exe
3256	netsh.exe
3676	netsh.exe
5144	netsh.exe
4388	netsh.exe
5384	netsh.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	SodaMusic.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe

Executes dropped EXE 7 IoCs

pid	Process
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
5204	elevation_service.exe
756	elevation_service.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
5676	elevation_service.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
2084	elevation_service.exe

Loads dropped DLL 64 IoCs

pid	Process
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DF691195-F933-489C-86F2-497BF7FC923F}\AppID = "{DF691195-F933-489C-86F2-497BF7FC923F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win32	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\Version = "1.0"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ = "Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win32	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win64	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{DF691195-F933-489C-86F2-497BF7FC923F}	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DF691195-F933-489C-86F2-497BF7FC923F}\LocalService = "AppShellElevationService"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\ = "TypeLib for Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win64	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Soda Music\\3.5.2\\elevation_service.exe"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Soda Music\\3.5.2\\elevation_service.exe"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DF691195-F933-489C-86F2-497BF7FC923F}\AppID = "{DF691195-F933-489C-86F2-497BF7FC923F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DF691195-F933-489C-86F2-497BF7FC923F}\AppID = "{DF691195-F933-489C-86F2-497BF7FC923F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\Version = "1.0"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\ = "{31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DF691195-F933-489C-86F2-497BF7FC923F}\LocalService = "AppShellElevationService"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ = "Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\Version = "1.0"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\ = "TypeLib for Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\Version = "1.0"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Soda Music\\3.5.2\\elevation_service.exe"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DF691195-F933-489C-86F2-497BF7FC923F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win32	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\ = "{31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ = "Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Soda Music\\3.5.2\\elevation_service.exe"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Soda Music\\3.5.2\\elevation_service.exe"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DF691195-F933-489C-86F2-497BF7FC923F}	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ = "Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DF691195-F933-489C-86F2-497BF7FC923F}\LocalService = "AppShellElevationService"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	elevation_service.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeSecurityPrivilege	4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	1756	SodaMusic.exe
Token: SeCreatePagefilePrivilege	1756	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeSecurityPrivilege	1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	5364	SodaMusic.exe
Token: SeCreatePagefilePrivilege	5364	SodaMusic.exe
Token: SeShutdownPrivilege	3368	SodaMusic.exe
Token: SeCreatePagefilePrivilege	3368	SodaMusic.exe
Token: SeShutdownPrivilege	3368	SodaMusic.exe
Token: SeCreatePagefilePrivilege	3368	SodaMusic.exe
Token: SeShutdownPrivilege	3368	SodaMusic.exe
Token: SeCreatePagefilePrivilege	3368	SodaMusic.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1756	SodaMusic.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
1756	SodaMusic.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
1756	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
5364	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe
3368	SodaMusic.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4008	1756	SodaMusic.exe	85
PID 1756 wrote to memory of 4760	1756	SodaMusic.exe	86
PID 1756 wrote to memory of 4104	1756	SodaMusic.exe	87
PID 1756 wrote to memory of 3320	1756	SodaMusic.exe	88
PID 1756 wrote to memory of 4828	1756	SodaMusic.exe	91
PID 4828 wrote to memory of 5144	4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe	92
PID 4828 wrote to memory of 4388	4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe	94
PID 4828 wrote to memory of 5204	4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe	96
PID 4828 wrote to memory of 5384	4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe	99
PID 4828 wrote to memory of 4048	4828	SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe	102
PID 1756 wrote to memory of 5112	1756	SodaMusic.exe	104
PID 5112 wrote to memory of 5364	5112	SodaMusic.exe	105
PID 5364 wrote to memory of 5760	5364	SodaMusic.exe	106
PID 5364 wrote to memory of 216	5364	SodaMusic.exe	107
PID 5364 wrote to memory of 2468	5364	SodaMusic.exe	108
PID 5364 wrote to memory of 3364	5364	SodaMusic.exe	109
PID 5364 wrote to memory of 1456	5364	SodaMusic.exe	112
PID 1456 wrote to memory of 1796	1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe	117
PID 1456 wrote to memory of 1956	1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe	119
PID 1456 wrote to memory of 5676	1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe	121
PID 1456 wrote to memory of 1560	1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe	123
PID 1456 wrote to memory of 2544	1456	SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe	127
PID 5364 wrote to memory of 3352	5364	SodaMusic.exe	129
PID 3352 wrote to memory of 3368	3352	SodaMusic.exe	130
PID 3368 wrote to memory of 5792	3368	SodaMusic.exe	131
PID 3368 wrote to memory of 5052	3368	SodaMusic.exe	132
PID 3368 wrote to memory of 4036	3368	SodaMusic.exe	133
PID 3368 wrote to memory of 1920	3368	SodaMusic.exe	134
PID 3368 wrote to memory of 3900	3368	SodaMusic.exe	135
PID 3900 wrote to memory of 4812	3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe	136
PID 3900 wrote to memory of 3980	3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe	138
PID 3900 wrote to memory of 2084	3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe	140
PID 3900 wrote to memory of 3256	3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe	142
PID 3900 wrote to memory of 3676	3900	SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe	144

C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
"C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
1⤵
- Adds Run key to start application
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2552 --field-trial-handle=2652,i,10508393780084709715,5821427474205670962,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4008
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=3028 --field-trial-handle=2652,i,10508393780084709715,5821427474205670962,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3580 --field-trial-handle=2652,i,10508393780084709715,5821427474205670962,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=electron.app.SodaMusic --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3736 --field-trial-handle=2652,i,10508393780084709715,5821427474205670962,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe
  C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_DQYN3eI9ochkt_CYf7bvc.exe /VERYSILENT
  2⤵
  - Checks computer location settings
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5144
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4388
- - C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
    "C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe" --install
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5204
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5384
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4048
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=relauncher --no-sandbox --- "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
    "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2412 --field-trial-handle=2536,i,13680315758413191799,10352596633712176975,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2772 --field-trial-handle=2536,i,13680315758413191799,10352596633712176975,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      PID:216
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3360 --field-trial-handle=2536,i,13680315758413191799,10352596633712176975,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=electron.app.SodaMusic --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4344 --field-trial-handle=2536,i,13680315758413191799,10352596633712176975,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe
      C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_PAtcgOjMdYHbRHbZ6gl5E.exe /VERYSILENT
      4⤵
      Checks computer location settings
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1796
    - - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe" --install
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5676
    - - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1560
    - - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=relauncher --no-sandbox --- "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
        5⤵
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2392 --field-trial-handle=2748,i,2394896039153158220,10263506922085678308,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2916 --field-trial-handle=2748,i,2394896039153158220,10263506922085678308,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3336 --field-trial-handle=2748,i,2394896039153158220,10263506922085678308,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        6⤵
        Checks computer location settings
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=electron.app.SodaMusic --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1372 --field-trial-handle=2748,i,2394896039153158220,10263506922085678308,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        6⤵
        Checks computer location settings
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe
        
        C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_QcCvyHmASEcN3ENEm0vpD.exe /VERYSILENT
        6⤵
        Checks computer location settings
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe" --install
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3676

C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
"C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.PresentMon.txt

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\LICENSE.PresentMon.txt
Size 1KB
SHA256 88ca9632f3ef9edac8bbf8fdaf1c9304cfacbf8d15837d28d9b2dd4002dc47c3
MD5 8c0d95016db97e2ee501a52feecc0ca7
SHA1 e9037c2c021c4f88bcbde45119785191bb5bd53b
SHA512 5fc6e1c8eb5d559e47d5d5c7bff3dd8e9958fe9e3894f18c0673c25e840ddb8b6b425b83ecc452f0d8a2894704a65f2f2e326efe3339dde3c707642924055a04
TLSH
T1EA11821E725003B22C8B1361557E68C4B26BB24F79AF2784206DF380232A06DD1FBC44
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\LICENSES.chromium.html
Size 14.5MB
SHA256 5891f0bbfdecee5be9202c1c02f1c1301605522e47c87b87abfb3ff8c523307f
MD5 a169a04d20e37b3d22210439510ad90a
SHA1 f8c3353b5495a3cc84546b5d9161f2c1a1bf1b6e
SHA512 dfece22ec9f629fcefa5a851c753d1ce159b88d79fdfb4790f037b2dc16c66ceb1f329314ce25ccd9d8b4962261852d1759eb9f15193900a5dfc69995c726c4e
SSDEEP 24576:YBSojZ6foojZ6XxjZ6JCjK6KwR+uT3mfRjr6ZjK6xjr6mjK6ajK64jK6QjR6+jry:YseFma8mt
TLSH
T123E6A42F7B48037306C642A2AB8B65CBF31E903F3B561654345CD1681F6BA2583FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentMon.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\PresentMon.dll
Size 352KB
SHA256 21fe6e4d24e0af5eeaaa364376ef224f00f8f0b12ffb823ffa6f70c0b6b501a7
MD5 88681090ec32c9ba4948cf6a24aaa34b
SHA1 66bc90b09408dc276f625844679f2000c82e44b2
SHA512 cb8fd565e2c9e8fe35262af50cb001e9689306d0ffc7ef29a3277688e0f986d1efc43b0dc041f0dd5f990e6144416b790afeaea8128ca7c193cf2c69bbc39860
SSDEEP 6144:ngDLai/S5m6wytcRn1rv8+bVlv1xaN5VJFYC7Lm93IXTevPq:ngDL4mtrs+xTxa5J577
TLSH
T1C5747D1AB7A414B4E4B782788AB35A02E7727C460361D6CF17E086563F33FE0697E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SodaMusic.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\SodaMusic.exe
Size 2.3MB
SHA256 ebd2692a8eb9814d44965cb13a1d1d8bcdde9d758c0bad9e7e599d0ac5ba8a4a
MD5 ef0d2530723fba3af4750b2d7fc66ab5
SHA1 2a89eb5738fee4ec6ce93c83ec099b98bdf320fc
SHA512 d7c3c2144bf82f0cdeec045bf3ec946da0b15eb22d6b40e98efc37882c662ea436eee7bf70b3ecf245bcd553422ecbfc1c76db11bb4fb9179fd8d9c7b4a012c3
SSDEEP 49152:DumKCy6ZsUmbl5mLBSDf5FA330fsUdp9W4LUmO0+G+WCO:FJOB2O4O
TLSH
T1F6B58E17F29A10D8D05ED178CB5A8232EAB17C490B25B5DF0794BA252F37EE45B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_shell_updater.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\app_shell_updater.exe
Size 1.2MB
SHA256 f09692b00f7d80bc60ef8221092c4561784472c8a2599597ed8be7c37699a9f6
MD5 6aca321978ebe6e985a38c3827a4e043
SHA1 fe03c8d9ce7bad9fbfab1aaa7ef189ffcabdddac
SHA512 e301a277dca5a98883538e7af3c39f1b33723bf226ec53110d5abd6be7531682a27905d5ecccac7f6f0d0b63c1a8674d32434c12dce9bedd03dcde985b8cae1a
SSDEEP 24576:HkiI5aUI2XRTJqDBFEfCF2baUEykMlTHWggQX9KOWZy5Rks7pkp:+5aUI2hTMDBFEfLZWQXR5RksG
TLSH
T1D055AE41F5629075D8562176341CA73D9A389E054F358CEBC394BCE8AFB06C21A3B6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bmf_hydra.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\bmf_hydra.dll
Size 688KB
SHA256 6e2953c59e625b158fb3621a25f111d90d7659b1df149395243a19659b200642
MD5 abe8ce2bc51949e1965bb5d79e43333a
SHA1 aa90b5b7a6f75f1bb49172d6574306c869ca0bcf
SHA512 081ca2c1b0afcbee2572eaaa979c67aee8d51759da0bb64e6324442d5d8517bb852daf7ab6d4bedc87b9c3baaa410e80d69895e93f776502e4cba79c8f1e899b
SSDEEP 12288:aTjrqvZoI4I6ToooXCty+MuXJI+UiAhFqIqZ1y+Mulv3PM8QLbRGGn:GGZo68+CJM2IbiQqIqZRM83lwdn
TLSH
T187E4E026F6A210B5D0779138C9738902EB72BC5E037086AF379A426A1F73FD0597E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

capture_service_client.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\capture_service_client.dll
Size 5.8MB
SHA256 afae45954105689f25d9abecb4ff89e9622f956dc9c0bf135840bf6c809ccb88
MD5 d576d8523fdb3d14313da6be67b315a9
SHA1 fa4564f57c6eab2f3296fd71735d0a89733e9cc1
SHA512 00b6732876dfb974ad38efcc4130cbce899e50a93842f79b62d1b43c4098cf624adbdab92e8e9891d94ea8fd075d6bb25133bca2a342a9ae3e691dfca483ea49
SSDEEP 49152:slJnGJq7a6cePTPTgaPo+WgAKajTvCWbjrafpNGq+/kOc93tZR5wqNExb5Yhb2KF:sSkatSgaPo+WBTauyfy8Wop/V
TLSH
T1B0566C9AE36210A8D41EC8B0CF6A55219A643C5E53F593FF26D576E42A32FC43B39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\chrome_100_percent.pak
Size 143KB
SHA256 376979e53e4f916fc0499a79ee78e0a5e6864b76882ccf6b2c41cc44af88be48
MD5 cd2208d1ad5aadf427cdee8623c022ff
SHA1 383acc4cfae7de5d5a7551600f2aed2511d7f103
SHA512 b5bc5c5ebe325032095ad7c1f1ed610e043e0ff4ecd189419234f41d6e9738948caf7be01e3d075e04f3c6327b58ae07d1f4a09185b63663c8d64ed502d8b3c8
SSDEEP 3072:sz8gCGIQRTw1CLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:sz86I2ThjQB05K18Gb0OV8ld0GecQ3Er
TLSH
T138E3D1E7B3F0EE7DCA9756F762164071EDB346290691024B464AE8752A36788C8D87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\chrome_200_percent.pak
Size 212KB
SHA256 466a7cb406a89631af4da9f67a8fb71d7018b670cf93fd08272c796e1a16f38a
MD5 dd4bcd1bd48161d111e8601588537d29
SHA1 225d7c9e534e34cb46d60e47301d02a7c1015fae
SHA512 b397969854d4c4a57b844ce07b7a6d96056d7016b346bb8adfe88cac421da02faa2044fd880695e277d7d464ef370e3d855e85031ee62311570f6def37282c66
SSDEEP 6144:5DQYasN6svyAEW7cyjQB0ugx5GMRejnbdZnVE6Yoppx4:WfsN6svyA1tjK0a6edhVELoXx4
TLSH
T10F24F1D7B3B49D7DC9670AB3521601F1FCF215395AB6420B068FEC357A66BC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\d3dcompiler_47.dll
Size 4.7MB
SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
MD5 1a7544f942a9a9de9354e7a0f9060e3a
SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
TLSH
T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\data\icudtl.dat
Size 220KB
SHA256 33488789a3710402492794c81680522e46596e6fdc31de70b9f51de687be86cc
MD5 638450ffec2b568e46d4a7d9de23d130
SHA1 a5f3fc33b14553199c0cb2c0d0113cf0c1926986
SHA512 9279e8fbc529f3971e04af88be0e4bc9861a8444f4c32ec7a7c154362b26849da850dcaf8adf813d334b99956d4519a1e716c7e569d23957ab3da51288758154
SSDEEP 3072:1Zwpp3t6oaKAuNPHtZPosa7oLCeRcu6yNsje:sPt6olNvtxopa1WFq
TLSH
T195243F6379CBA94FF3234B30859553B896B377DD5B3398B93A182389AE5A3D1C1017E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dump_reporter.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\dump_reporter.exe
Size 1.4MB
SHA256 3f5b23ba460fe8669933c9b803d307ad76b827bf46e54ba5f688779bd9ad7448
MD5 549599f3a5b948c1473131fcd2d9434e
SHA1 06a74ad903b5cb820be0e3d5029de2f27722572b
SHA512 5139b6e97c6b19510e97bc185effb2e119d4aca45774f9c595c5c5a9580837b8dadb7511aed0e298495d2e20aee5c70a3b1be83c997626ffcdf4bd60414100fd
SSDEEP 24576:m4ZTChMs1xwAQdQEK5SSl0ubf8T9oxakDTp5SwmGOwmCBHHT:NZTciA+nMfl9KoY0T7SwmGOGFT
TLSH
T1EE658D17F39900E8D069D1B8C7468636EAA27C460B24AAEF0790B7552F7BEE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
Size 2.6MB
SHA256 c43b33903e0d06bd661ee9814f3c55a52c033d7d317d595cf010146396c43e5f
MD5 b892915cfb25853be88761d01ae2af63
SHA1 5dab9716a66e97429d4dfef902b86ca7ec48c562
SHA512 531ca244cd4a42206e2cacc15ca740d48911258ad10b847b0015889fa8edd80d74c5e386e1deeaa49fa2b27ef7fd09e917dc7285f4bdd40e8e9f5642b24276e9
SSDEEP 49152:/EzafuNeCphq1SLdohMK8yt4X3OSOtTFfyWChh41NMGAjO1:DfiC7
TLSH
T1E2D55B13F3ED41D8E0FAD674D7658232AA72BC465B38A6DF064072191E76EE09B3C721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventlog_provider.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\eventlog_provider.dll
Size 17KB
SHA256 3c524dd0adc122150da4e58d2a2cfb5dab17ad94f86e11602268ef8f30679ae4
MD5 dfbc734638a725dc2ac1c3a13f97ef39
SHA1 67b8126a6b323a29fce9df8ce9523772e9ef043a
SHA512 7e5aa1851e1dbe2e38a6b8f9c076e66dfe6ffd440ad64d94e98443a42d1947e3145e1ad81cfc69c3b46005b92079ebfcca59610458d4d61096c368cd162449b6
SSDEEP 192:pqql4VDbnPIIYiYF8ARzbt2i9VjCO2ULc8pq8RuwdmL4pUQrNyGtQonL:jCHQIYiaBbttjCO3y8RbmL4nNy4xL
TLSH
T199823AA387E01C04FD6B9E7075D04A366E72B5A55B90C1C72259C1584FA03C67EFC3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\ffmpeg.dll
Size 3.7MB
SHA256 9a0747b597b0716cef36fedae69f06479bd70daf4b6faf275cd3f582ffe9708a
MD5 c28a0ee9d8479b859c8aab11b04ce260
SHA1 33eb6aeaf014554cb548daad6457b6541c74c949
SHA512 2f2a4728484420e073d1357ba6f5a4496d5f15a4a67f9431599426a8706d2eaf0b24c635b39a18330cdad8d738eb0b10ec81e32f16c6e228710c9cc366edbbc8
SSDEEP 98304:uhpQ+cmZ6F9doPG8st6Qer1i/sXrENOeJrvkHXOFvqKwpQ7MZtR7ZdZ9FKb17Dfx:FGadoPG8st6Qer1i/sXrENOeJrvkHXO1
TLSH
T1F206AE47F6D611ADC06AC034879BD213F670384A8B15A9FF26C04A213EA7FD86E7E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\icudtl.dat
Size 10.0MB
SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
MD5 ba9e45bfca3621e4086e6a1870f8cc41
SHA1 8d1b2d42707812608907f8000041c16e7755532a
SHA512 07ac486039098753d77b53ce0638a172c583620d6feae0447da9b8931fe9e0f8b108ca7c8282b6596bdcfb252b3600bdfe7cb01c96b3564605084a932dc7298b
SSDEEP 196608:fwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YEs:fswkpHiXUxY/iJ53IWhlVjEeIHs
TLSH
T199B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\libEGL.dll
Size 468KB
SHA256 26ea8f49ba16dba34127fc40d64f68d6eb0bfeb5d08089ff130387f5eaa32c21
MD5 4804dd9bfa8a4c8b5b9569cbd621e1fe
SHA1 cd82aea641aff64ea24ef45a7a7546da4457a0c0
SHA512 37158eff6626d6fa16784baf7bacf0eedb096008ca37954d4908f4f39a3774291387050e64091f2b1ef0db7c0391654548c2b82d68557d6f69fb04c64272f639
SSDEEP 6144:FLLKTsxauJ/JvCnn/62IC5egckQPv4XZ+2qOfDqq:JLwuunVIC5egcDoXZ+2hGq
TLSH
T137A48D1573D94CA9E06AC178CA574642EE72B8864B61F6DF03A0D2392F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\libGLESv2.dll
Size 6.8MB
SHA256 e801f6155fb860da7f5fd1a135a68f389ddbe879300d6515c8278c1a1c9e56fe
MD5 6c7044b226f9fdbf09d0e3478fd0ecf7
SHA1 f3cdebeecb7e93aa96056c797338d2062931ec64
SHA512 8f2be3f8d9dadcb3f535e9215fa5e09f1734dcbb91c9ddea921a45866da39880e77a6aad602137c29669edeb61a4eaa77320073ecd23cd52a0388d4de8107dfd
SSDEEP 49152:nOWAe+2HYnCSqFk6OoUNvLE6HRO3CwjcyZyZcDRtEAdZjUsu8qQETU9aZxYC4LqH:2hXLhQcyMQRt9Z49ZCCF6PppSXIYFHOc
TLSH
T1E8666B03F7AA80D9D04DD2B8D7478626FA7478850724B2CF279857212F67FE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\locales\en-US.pak
Size 499KB
SHA256 38d0cbf1e776fe2c5f2fb6f7b132387081b00195b686b8d8c830796f675618fc
MD5 d65d128930e461f491f93975e5836156
SHA1 0da2ddf74868dad76d08022d0a9ecd4c6f3cc168
SHA512 a97a9f749a8147c49620e7606cc8cd0e3a6c6b6d8abbc63aca8d5b56a207b77dfa7fcd60fab92c37f15674e65ad778a94ae90c6533ab3fa1f965807cd1444dd1
SSDEEP 6144:qCCHh5sCyZuTsSBNMP9e+Qtt3faY7jsyo0X5v+juangH8/gFwB:qCCHAbZ4NMvQtte+5GjIwB
TLSH
T10FB44C1FF7441229069352A27F0995B2FF36D06CA35112563CBD812C33B7B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lynx_core.js

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\lynx_core.js
Size 184KB
SHA256 62e3f90bd87e19a2034c78e53e864cf6e6244487bc061f27c31751c2fd91c48e
MD5 ac4c7c3c21fb356964ba682b95e5236e
SHA1 7d7435dc6f284aa85bba6924fa7948168861a240
SHA512 4b4a43ef986f11a484ebd1f3b4835722075c57c69d8b275df5a6e3ec0274d4ce359ec5a1343ca596a12a2f01afa2ce54d3ba67a84c784af49708dce613898884
SSDEEP 1536:he4skKS3RvjBTxMXh8AKDS9z2x4TQkrb6Dg6mb0GSxidlVUk54hq5h+rkcAIWrUi:c4skP99qXhxK0z2x4Txb6Ddmhmz5DiR
TLSH
T17904E88CF7A4B06642E77064413F540BF3BB6518F84A80A4F26ADAD42DBD44E512BF7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lynx_shared.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\lynx_shared.dll
Size 33.6MB
SHA256 16d2340d4d03e020398debbed51052d5ad210a028ff74aaf4778680810b79e42
MD5 53cf7be634309d442b167e0a1cef0f65
SHA1 8dbc7abd323af59c7f48e7b9e8b59955865d5b42
SHA512 e2eb7d93535a2052c129f34ad8ced8aca7ffe2dabc7b6397f9948f8e223109d2e47a967753e965ccfe2f3e041805e738c2e707d25fd519d764c988e241a6fc49
SSDEEP 393216:68FvAaxawGR6zvoWLX0zRKqrDDKB+fpoOY8YML0J3ITI/Xk/slW0Qd:6+PxNz2RKqXDAqAJ3ITs+slWB
TLSH
T1CF778C03F29A40E8C04DE1B98B479633E9B1B8454725BADF17906B522F7BEE0673E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metasecml.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\mssdk\metasecml.dll
Size 6.6MB
SHA256 a8762163cd5c4eec576537a500e0fe09cf03a9f3af0c23ca5a5bba5d52582054
MD5 ed1a26cfd3b3891b95905850e11daf50
SHA1 fcebe3743b8fa8837b696dd9953a2c57d7a463c1
SHA512 9f26a89a5d0264dc347cdcccdeee58d1f7b5389985c6abae439709eb3663ab3bae037e6ef621ee8773c0f3fb2851459a7d4d170fb6d0f2ef59e713b86d16b42f
SSDEEP 98304:f7vmXetmJbMC+dN641cWhfi8MzKwYkBvFl8fuVbEisdEo0:jAetmJbMC+v6khLMzKwYCCfuVbEis2o0
TLSH
T16A66E0AA66E802F5C0F7C179D74B970BF7B1341547715ADF06960A092F23BE64E3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

parfait.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\parfait.dll
Size 1.2MB
SHA256 62ea1cc46e556902ba1dd685e76513f05030246ffc1082ef62912cd2886d3002
MD5 73ea8e6636893bede4dfcec092ab60f2
SHA1 42694104e6b5a9c8449aa5f92856d7fad933b029
SHA512 6f521668a6121564b007d6d0cfe84b4a9a502c74d8415629952ef2daf99241c7726e77b9bc008359f4bc6c50eb820bcc97ea13fb1301866f934cb3e15183e796
SSDEEP 24576:dBnh00IAO97rBHXBWP2/kdsSpvWmrbVEo8r+fMFndnziAVc93pPlwXDKLeTQgHtX:dhh0bAO97rBHRWO/kdsSpvWm3VEo8r+S
TLSH
T10C454B5EA6A801B5D0BBE17DC683550FD6B2340587B19ACF03A507DB1F23BD6623B722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

parfait_crash_handler.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\parfait_crash_handler.exe
Size 1.6MB
SHA256 d4d6d705b04d88fcbc177b78fcff6c4327abc31ad70945707efaada202ed450a
MD5 834246f4ac29525294611f8aa1bc763a
SHA1 59b4c569c47308cfef6bb47d68b922268589710b
SHA512 f82c588532ed237a1b6eb6fefbc1a4d0fc4c022177cbbc49596e9bea6caa4fd9e58f27b28a56d99b131825ef45a77362c5649fa77079b4efa77b95e8fe71bd36
SSDEEP 49152:jYwYT0M2/0IN09oSHtYf0SBfZMjliVfToyp:BYTsEYBQli1
TLSH
T10A856A1B637401FDC0ABE278E9470D06E7B5744A03719BEF07A046A62F63BE16E7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

renderkit_windows.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\renderkit_windows.dll
Size 13.8MB
SHA256 02b50399b10e25b5ffa5d72b586ccd970aff2986fe3c1bd3c991a97d14746d58
MD5 da8a3dc2a371c731bb7e5aa67c6bebd2
SHA1 218bf36a017190e8c86540e1636f8d2cacab90c6
SHA512 9a445f6be7b395a9b26fda213496183129e94b630af6caec6902885dc93125e631a746eedef77195e8394211149aaa042e4c7381036a1361a8defc4d288ab916
SSDEEP 98304:d6c6sMoN1M0rhiBB3rwjWErG8d6AcchEHdpm8EW410LXjYvrujjZR:dYPobM0UpMyN2EHjSQYzu3n
TLSH
T119E67D07E1A640FCC08DC1B89B1BAA26E772BC4A0574F5AF239467712FB6B601F5E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources.pak
Size 5.8MB
SHA256 3e3350659f42c0121ad5aed0ec1d9cb2d2ba5bb322b9410a2faef4c0809d1815
MD5 4ba787c01f42660cfbccd66454a2d92e
SHA1 b85e3ebc68c3b4b2933848f549bd24f9c7c36337
SHA512 f902ab754349c699f975dec0292cd3133aece9bb65f05a069536c06b81395bf6c662054ac5da0f496a16ca6376526e0199e86b49cec1cd90ae28fa00740573c0
SSDEEP 98304:DW8MT2POX71PZRQwQLRENbrjrwrw5TWB2zfQzQz8mKaUUQz8hB0Pxtq+GhVd:NMT2WXqwhbnkrwgMfQQQmPc8X03VGhX
TLSH
T17E5633BA3B9A986FF10C83B940AAC7B0426CE9126590215F31DC3211AD3672FDFD557B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar
Size 8.5MB
SHA256 72be352273d3f2f3588e42c01b55e7425336344132f0e5a709cb5b6850010327
MD5 8d2a83e895453c7605e6f37e6ea8a5c2
SHA1 ffbe8102a096d6234d043945836e8554321fbe03
SHA512 b1053553955dd28f56739b4351bc6c0ecf27c5d8358e9787d292ea8ac1722ae9140b1b36008f7c9a61931a3158f7b1d985eda7ad80ade50b06e3310d10df3b81
SSDEEP 49152:FmLw8cdYE+36xzt4Zx137BwZBl8uWCvAfXxVW4n0QGMSbA/IlBaLw8cdYEeyzdyb:5wZx137BwZuMBKt
TLSH
T1B896D6322096E935B7171BFA189E41D66F64B88AF540D1143C4C926B9383F3CF1B6AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdms.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\bdms.node
Size 160KB
SHA256 cb90bcaab8e1312711a29c1a75b8f42c3db8540eccbf8c2fb8cf92cf66198d2e
MD5 bf73a7f553bf80b0a99a8e71e30cdf77
SHA1 c45ddfe4ec53f2f58d91309b2c9f4e9486ee24b6
SHA512 a777e6f3e3b3bc8534365c678e0f42580b01edc9b06baa84df4e205cff0eb4b4e5cc14da40a3ff92f03e8573d4fe72abd1d4977bef02c695ce6303728760d8c4
SSDEEP 3072:kWW/Z/inBI2gDrw7WdMYmsaArLjYNU8o8uUvNIXI4:kWMZanGZI7xYmsaAvjgVvNI5
TLSH
T1D8F36C17B2A400BBE1B3963988A35A12F77678120790CBDF0394837A5F673D19D7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdticket.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\bdticket.node
Size 1.4MB
SHA256 de1903fc6b58c54a6a06be3d787d0703292b47353d2867ed5e2db8bc28324b9b
MD5 063ffe682c9c900278f1a8b0f9cdf97b
SHA1 ba4e348ad09f8c41721179100b2b49d75e525232
SHA512 0e6b83014b004fa81418a979064154aeb2964a157d7f586e5571b314928ad004b6408a32b080bf11ba514b38fa1b0ae275a143e43cfd460ad952191c5ececf61
SSDEEP 24576:+WUzHVi2iGgQqcoadqm+B5lAn9MKmD+1BN9h+dO:RG1HIcoVeV++N9h+dO
TLSH
T13D658E6B929402BCD9FBD175C9974E4BD7B2B80A0371A7EF0BA049565F23BE1463D302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

device.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\device.node
Size 292KB
SHA256 79adaf12288e01252de50187e4b7b35b461581b7250c874568c5c5661e3a4a46
MD5 b2ab54303605628f6174d391632b81a6
SHA1 c073108668b5a983960ff867c824cc7856d7847a
SHA512 202bd7657ab683133274edf1a335512dab79d8e2ba8fb5f968422eb38254bac2edcf8e7ad9088195f8003fae030219ff6f38c3547f0cc3577d279b20220a7578
SSDEEP 3072:lsxYko0rNTIWUhCXTg/ug2gWa05BOduwTovhhK1Oo6KoaX/o+P3mMqP7hw0PH+qJ:lQNZU+Gug2gWJ5BOdz8pwLXX/47h7+qJ
TLSH
T1C3548E5AB7E008B8E967923CC9534906D7F3BC1607A0E6CF03A4479A6F273D1993E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

entry.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\entry.node
Size 844KB
SHA256 75b13673b0655b89cb8950d8ce11adb3453bb6f1185fda98eb7df1d2a8b10d94
MD5 6646abd14f1d7d5765de7e281b72b6e4
SHA1 ec3a05f85f7bddeb20032fd6cd798e8f2fd90ad8
SHA512 31b4336a28fa260f6a6429c113571ad7df29fc2dd2a02069574c5e561ec2090c6769f00637625c7a224c446b91e0012be4c84e30296608b0dd64d1f89c030231
SSDEEP 12288:04fVODNUpvRjcvb1sosxod8euFunmxT1Bt2/:0rDNUpJU51d8euvT1BQ
TLSH
T1EC05AE2E66B40191D6F7A13A6ACA8F55F672B4010710AECB02B3509D3F1B7D899FF724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmdb.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\lmdb.node
Size 406KB
SHA256 002c04ed5c4f8b74282e48eae337d550bbda6735f3f942aa2e93d060bc4a8f1c
MD5 6439d844e7801cf66f5759f6bd57ea46
SHA1 04bb384d9a5d6dc7b4e2e94a00e351097123a274
SHA512 239617a892ec4b75e858c98485babf2b4beecfaa1b60f805cbb3d2a9a6e1e427dbffcbb5d6b386d922d50e9e3b8b54afae82c611935e3b0c248419303495212f
SSDEEP 6144:HBYtW1eTgYU2aaNJ9cBt68i7XHL1+tgOuCIgIn/6roXVbIr4:HFeTeUJuD63THL1YXWgI/64bq4
TLSH
T1A0947D6BE3A408F8D07BD17889778A13F6B678490320AACF47E445652F73BE2563E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\main.node
Size 6.1MB
SHA256 6e9e3df1a2261159981a738b6ac88cc5cee136f36918ff10a5ca39fe8ba86c9e
MD5 7e07828f9b9b7d9ff1e8ac825023c3d8
SHA1 e10d4ba6b6988914b38052e988c7d98c9a7804af
SHA512 1028ece512908331d9db3c79e764c586c4971cefd1f80c9726bc9f52fa9edd6376fdc888658c4f411eeaf832a0c81ed73a9005d9fd21345204d23848036eef55
SSDEEP 196608:c0bKaKbG/gZ4aJus4v58GzzF6RKkS7fJj0sVdms8XH12GCmnyXDZm3btn6GHuSHt:CRQi7tn6GHukwMznLnD+wgOH
TLSH
T14156B51E18742D04DFDBB4B277CE564AB5369A933B015CCB0233A49E396B1C6D5FB828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metasecml.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\metasecml.dll
Size 8.4MB
SHA256 53f322a7731cf64e6187d2fde1bb07558c2ab0a64fa6db0ef7c95d618ea9a226
MD5 dd6b05db3cae5673b3a2d916dabbf6eb
SHA1 e32d6e7701f737bfb2291551217aed75aa64ac59
SHA512 b47d912c1df21c98ba6b128e80d23d821772ae87d8174f54359f08bc62d3d0dbc79cb4ea9500b532e8591b483847936c5211c73a536b666586e6d7aab299f8c7
SSDEEP 196608:OOPIgM+7yvpqUAY0d0P570JC3YsqGmNY2u92SDmOGF4FtUl:OOzh7yvsdU570KKGmHYiItUl
TLSH
T1E79623AA62587398C01AC5B49033FC4AF376562F4BE8D5AB72CEB6447FFA450D503B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskbar_widget_helper.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\taskbar_widget_helper.node
Size 268KB
SHA256 e9d43ec7ec2a2466a37470b3a7aae2b1a9899aac14708ef392e510985c29ca8d
MD5 ab542867401e72c00174a0ac65c09841
SHA1 11592003f63226da088cdb32ef44c40456d4933c
SHA512 88f95d2873b712306f251da031a73d8ce3dad02f5ab78f9d4f9742e748ec79919af1e7e861a235f0bfd9efc02d2f5f2836bb956579cd99958fe388f27ac440d9
SSDEEP 6144:9NP2YZrj+b3bsvdBrWfNI5nT5D/bk4LJn:9xZObbsvDWW5n1vBLJn
TLSH
T1BC446B1B73A50CF9E97B927D89535A02E3F2784507A0D6CF03A042662F737E25A3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ttnet.node

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\app.asar.unpacked\ttnet.node
Size 215KB
SHA256 36a4f5030961c8196d475a499ef7991fcbe218d228a604b8f8b43801bee2390c
MD5 7f89c7592b64e5f9e68c20be78886d0a
SHA1 41b4040d88e7ef5488ad2819bed5aea311b4c5cc
SHA512 e4292bfd60a4fe1475ec2feca1014c3fe281622e009639220f7e24f0bf79811d30722923d7cfac5d72d6d36f73dd894e39c1c53e63a74ac30fe126776d611149
SSDEEP 3072:7qauvTKG8mtlrKbkbjL4RWMG19APSDjJDeuBDak8WRD6IK:7qhuG8sVbjL4RWMscSnFY0Ds
TLSH
T183247C5972A401B9FDA7C17CC9938E12F67278400360A6DF53A0437A9F1F7E29A3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

captcha.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\captcha.asar
Size 559KB
SHA256 cd323e21456270465a08554adcdf4c601246bcd47bd72d597ddfac434232e04a
MD5 f546f1a656ea94243a5af35b410df977
SHA1 af7ec34fa620472a166d87ec485aca74a9caf202
SHA512 7cac5aaf032e3e8cc900d9bab3d9c0946c0bc483211fcbba078a5eef596ccd0c4d50c8056330476c494666a8334b9dd4cd6127e51ceab3798f2a4fc1a629a6a3
SSDEEP 6144:4gpv26vYLLahRsIhhTiYoYuAr1Ih+H9WhwP81OvgBh:48v7vcIj2+1q+H9QrOy
TLSH
T1ACC4F65A705BF87746032BEB96EF4005FA2875441064D1107C9CE16E7BA6F28F2B9EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktopLyrics.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\desktopLyrics.asar
Size 1.6MB
SHA256 a081800fecd508fffc793e9ce112bf44c2904b0e240f0e5916b93440ca01595e
MD5 3ab49feaf8c6cc4ddff67890d5e02d58
SHA1 eb353bfe691ab98edc63acb7eb030164a4d40832
SHA512 dbfff31d811ae5a77330de5db7be2794c69705b362e0e61cae0d8317a877e8ddb52deaf9c5e9fd4da72fed950478b744fd5c7329adb67c573960443c020f805c
SSDEEP 49152:KSuhfAMUvSVOZJtUT9WJExhLXV98uFLRMpG7vAWTBigNVjlWkv/:Cuer
TLSH
T18D75075B7127F03646536FEB5EF74051BA693608202081607E9C925EB396F28F1F6EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

feedback.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\feedback.asar
Size 1.7MB
SHA256 be23d7cfde715d4fec88a193658b631d8df402107dbc588b3c272e03144b20d0
MD5 d1596e654164ed50e7df45c3d6c11fbd
SHA1 466255de81d1f8475e81c96045370a97489b4d07
SHA512 d00e693dd7a23c819f84f3393a45a8b0957e37f16c921cc49411fafc9cd42c646c6d74eaf2ecca40a7442733f70dab2ae7221ad367157c125433b9b55dd5a096
SSDEEP 49152:4Z4c2NFmPSzRYfBjwUM8JxAnyGui8r5x86VdpG7vAWTBigQuzJVjlWkPE:4YusA
TLSH
T1B685F6677127F43606136FEB5AE74051BA297648302181607D9CD19F738AF28F2F6EAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MiSansVF.woff2

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\fonts\MiSansVF.woff2
Size 11.4MB
SHA256 ea5ba20faec6123dc3bb868ba9fb84d782676a628c957a59e94917ec30c4d9a7
MD5 05a36ca6925ad9ae6bf305bd78a5efbc
SHA1 7f71037128d1858056ceab43efae3e427142deea
SHA512 61918a503410a91880b67f099dc0d3ebd6cda229d8dbd51d868b7ea29ed2e097130860e72675964b15471161a5f524097b416fd5fd9442f48c6091d9084cacbf
SSDEEP 196608:ZPFzmkBmdt5FIQWqFlTuM6jPAwwo1iPitgpFxTSWYlzsqIfyiADVl:Zkt5qQWqF8dPbb1k+yx2lzsqIeDVl
TLSH
T19EC63319BA10E1BEC79F5D3E0DBD7767E11221310B02ADF3D4FB223D98699A5EB28444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.ico

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\icon.ico
Size 167KB
SHA256 d2c3ee89b4343b7fbbd34889af3b81d1979bf69fddc84dd740c1c084a7330879
MD5 45aa7f3af2367b852836a6f640afa362
SHA1 625555c715cd950cdb667973a89c7625deae5689
SHA512 46e58030e407c8c86b2a0210b567f0c12ac3d0204f51f0a293660233633f5536469b34bfed57b29fe97a577821b0cbd7c76a8cbae2dc7dd27a2b0436123636ae
SSDEEP 3072:VgzpfAwcf8j0erMToRBgQrehvTpGWhRobDTyoRJ/437FF5yp:Vgzp4w3jNMkoQCFZhRobzmj5yp
TLSH
T1F9F3021E81D2951BDBC436324F53CA3F03B14E9FD895391259F0AE2BB9DC46BA80F598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imagePreview.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\imagePreview.asar
Size 1.1MB
SHA256 f4fec40f3dac6b6ba85145914b9e049e83b75450d7c816f3616edb5040c2eb53
MD5 e4ff312b501de9d1be94d54de14589ed
SHA1 09421cd561ea5bce3045f8053423383e4f7b9f98
SHA512 cce095590f4aae8584ee496a5c4f4dbc8422008f24b934441f9adb5f739537b097befc58944dd1334a9f06e88987f3f25a6498de83deaeeb4e699dae52074912
SSDEEP 12288:bOR2+1kpByr7vAWTBiganVHDlW/15NWC/UF:CQJpBk7vAWTBiganVjlW/15NWC4
TLSH
T1A545C55B7127E43646136FEB5FF74056BA293248202181607E5C919F3786F28E2E6EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\main.asar
Size 34.3MB
SHA256 297df9589b838857a896f0d0bf411e7f7ebdcdcaad54afc460087649b0df5eb0
MD5 ae6fea20fd36cf9abc626f6f4e63e718
SHA1 971c1fde01a90c6fae5f27373d6cd1d08c54e063
SHA512 cdc6e69bb4edf0719cf63c6ce23dbb109c85ce77283a7589940ba981024772a4edadbc396a93c24f6b9c8bc8a3bd50e7d149d61cd6b3575c3c6c8ead0a8c78b3
SSDEEP 196608:N4oChmph/T8mjtovzHfmpD+0/ymxNIcLnMaQUUjyp9sJG2QzK3:OoChmfTlBfpD+0/yeNxLMaQUUjostQm3
TLSH
T107777B11357BF936A2435AFF09EB4010FE24B4087550C5107D9CD6AEA3A6F28B5FAE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

offline.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\offline.asar
Size 596KB
SHA256 42d376040fa2fca62a0ab6d89b62a8ac40256277594cf78810dfcd55f007b728
MD5 57f6eb59e3d7c1a6530aa252eb8eb527
SHA1 3adc5eea8db2011d73bded411d6a663a09b7286f
SHA512 30ead0dbc99210682c33d9e32d9cd286db3811f5c0966f5554d0d67d510df37c2b0fa1bc9a069c72514a095877c28f31f7b256d35efe05fe025897895914f27f
SSDEEP 12288:TapADPdVc7Yf4trchc0c1ctcocDc3c0clc+cNcDcpc5cZcjcDcicWcMcCcGcRczb:GpArdVcEfOrchc0c1ctcocDc3c0clc+2
TLSH
T1ACD419E8F1987031939BE9A1502F3E19723735D6F48E85A4A339D5D02C34B8BA617F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskbarWidget.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\taskbarWidget.asar
Size 1.1MB
SHA256 de3034035eecd8b2b1bb8089baff9a0e66dce3d160b298cb8a98db181bd4ce4a
MD5 07bb72e3b940fcd0573ec542460a6385
SHA1 784c8b553a7806728ee9cdccc332f58f05660598
SHA512 d46e9874c14aee74bc018f2fb976e469d1a26a89e8a504cfb9d3aee9f66c10e52993ae0154737fbdd314bd975043d9f1f6f9be30f77addc55e6edfd25c931e6c
SSDEEP 24576:fVLThFcrP1zZjwBFK+PpBk7vAWTBigtFfinVjlW/15NWocrf:fVLThFcrP1zZjwBFJPpG7vAWTBig2Vjd
TLSH
T15C45D6177127F13646536FEB1EF78052BA693608212181A07E5C915FA387F28E1E6EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskbarWidgetShadow.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\taskbarWidgetShadow.asar
Size 906KB
SHA256 2fe1e7d6c267c08bea6fcc2934efb86896f931636770670ad79210f97cb3eaa0
MD5 7cf0a22ee4659619afda659ac0902321
SHA1 465db99ff6f00e3a96868ff74bb774d4acbd6f02
SHA512 23e8ad609a990d6fa51442fecacd5824a593700c8be093f7d545dd5a3d03a9e547f83cc236c562897afccd61601e09cee4ffda26f389f4ecbfa76bd32fafc464
SSDEEP 6144:lOd/CNEqRuXrV1LyAXUZ7vAg+WPrfbBiuBDPRNTnVVG+DieW/15NziemRrd0lz:O7rpByr7vAWTBigHnVHDlW/15NW7rd0F
TLSH
T12C15D65B3223A13646136FEB5FF74156BA693208203181A07E5D919F2387F24E1E6BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.asar

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\resources\update.asar
Size 1.0MB
SHA256 47920ebe6a706a59bea4bb9dfc2a67880d10eb8d057dd385a6299eb446fb3d2d
MD5 14327b48a9cb9939f46820f68b5412ae
SHA1 ff1f2e7a85a1d2c367a086e588dd0106ba8d3bbc
SHA512 f45d1059ffe78afd35d7bf94553d338439ca88b4c3a7e6c8e2779875638d500c9c703b59edd51c88853721e9be4ee808344a682c50b009ca76824269531b5ae5
SSDEEP 24576:h0soaJivHMncUv6SU5uW2RlnrzpBk7vAWTBigHsJ:h0soaJivHMncUv6SU5uW2RlnrzpG7vAn
TLSH
T16735D56B322BF43646132FEB5EE74051BA297248202181607D9DD15F7786F28F1E6EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell_config.json

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\shell_config.json
Size 566B
SHA256 32132983a68658d327664777a9bd5901c14884bc133102f5ee4abcf605a924e7
MD5 0d406f8e2ddc4f77b13d5e3d104fff51
SHA1 4095596fb43c518d179d3303ac8c2059532b01e1
SHA512 0f84c7538f77547a46d395201f82a7e4168baa9bac4f3403a3e60fed0ec60c0adb667b0afd6a436d4042810e121af0082ed9c7d35f95c63abb6d82f8a48bf178
TLSH
T118F0BB9AC4614A9F9AF480C8C91D571633191E1B0DC0363862B35F4D681D4EB65BC67C
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\snapshot_blob.bin
Size 328KB
SHA256 3d8b4d71610c4c353eac9243d8f3ebd6d4fb8cc8b5c6e9b42b0ee284585a05b6
MD5 09e32a11cf385027e87203be9fb5245f
SHA1 dc26b8b5a00f292a39f7c02d05fab9bf8c86be91
SHA512 32bc3caaa88f9f136a681ec005d3ae2d2d75d8e53c1cf7203b497a98599cade5b52c81d8b9fe17e98aab4086325e217d858a87dd1f154c83467c2b55927cf7b5
SSDEEP 3072:L6mbRKqQbt+xmR19fnOrJkGKnpNd4sOkMjg7Je3:embRLSt+y3YwdZOv8K
TLSH
T1C664BC46B70ACB36CA882271CDF9AB8A3A74B1CD9FC6421B7549437F387163C092579D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sscronet.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\sscronet.dll
Size 9.0MB
SHA256 600e3bb0c2114d8fc6bf29dea80be9c8cc8635281831f1cb4db13dd379091519
MD5 9a08615345e5c35bd86ad25d9048f5c1
SHA1 32b88a7a33a0ebde5ee26b12712fc1df71fa6930
SHA512 50fd960de6868cb7af6f195c30bfa0f2675099798dae17eee9ef034e9dd4fef1347165a2b3e60577bc6f25173907ca18b443ad655124aa85610e706242f82bb5
SSDEEP 98304:w83hSLTh611xe+BzdXHdtehrHFNSn57VWYefGwX6beOqpalqqKK8kjuAm:wUYh23BzLa7S5hpJwX64p+8nAm
TLSH
T10CA64903E2A650ECD05EC1B897179232EA757C890B35B5EF0790BB252E77BE06738725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tt_crash_reporter.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\tt_crash_reporter.exe
Size 2.0MB
SHA256 0f9330ff50a63762479c967b2e3e7c8fda9e1ee2c912b417943d5cc91641d102
MD5 f761a9d1b5aa7b9d57c46a574c93d41d
SHA1 7704d1e4dc7f57ccd5043e17f369ff06e0e6b673
SHA512 8dd02937f70fecb10ba7debf1bd61d25b70ac927c6ba2513e3de1bc72c6f3d3dee4571a55d00ad1b7c230f929c1a0a1bf4c08389d8797af47c9367d6158ed2df
SSDEEP 49152:WXho76s7ComtU69rjek57/kyMG5EG19wF97AWCk:tAeO8kk
TLSH
T140957C17F29900E8D09DD174CB4A8232EEA1BC454B24A6DF0794BB562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tt_crash_reporter_config.dat

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\tt_crash_reporter_config.dat
Size 256B
SHA256 31b1b6efc855d612533981fd96c9b32857588171dacdcd5fecf38866123e979d
MD5 28f80c4a5866c354e6317588f71fc820
SHA1 e73ce35bcdab0580075bbbc18eb048b487e5e34e
SHA512 4e4a01b73db72fc45bacfd7f0467ec0e9f517dcead1317cc746b8ee1c6e4301d47a9ba5a858f8c64a27bd485a77fc5ed854e3d88aa38d00c647519dc3b7fe6ad
TLSH
T1DDD097B0064270F29FEBC03B0CDE2D60D186A9389A2DFA74E3ACCC970015722B0F02C2
MD5 SHA1 SHA512 TLSH

Submit Download

tt_crash_reporter_dylib.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\tt_crash_reporter_dylib.dll
Size 1.5MB
SHA256 610c2af0576d949ed1c78e9857621700305242ffb33fc6b220fdeaebc23cfa5c
MD5 c9df381ad5bb1acdbfbf7da7aa1e3531
SHA1 6376fdb24acb72e975606a9b644ad14ff2802d7d
SHA512 3d6ac710151b6df6e76594af52ec8dfc4eb1dd22e21a21a2f24587dd7fe21e197bce10f41f63bb8a61139547d50e869b8ff1240ba65dc651cedbd6cf4e407994
SSDEEP 24576:PmisM9HbTknLGLLMoGUS4EF7/JgBBDb02s7OUPqRal9MdRx0ANRAcfLryIV:PmCaYLMpUS/J/Jg398cal9sx0ANRZSIV
TLSH
T167757C17F29900E8D09ED1B4CB5B8636EAB2BC410B24B6EF0794B2552E77FE45B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\unins000.exe
Size 1002KB
SHA256 08eea1b0e147e4b4f20fb3bfcb1bacc07bde3a6f581f6d740180d230badb98fe
MD5 4d1a177e01f05237138da0d2af54d5e0
SHA1 7549ca756cb0d8cdf51fd2d51af1109f9638ec69
SHA512 6e91cbaf7eed59ece3100fa4add93fe0b322bd8ed06c427bfe8d175924fc97ee4b1794599273a2da510e44cd66dd15d566d6b43df8c5d3e4b5426b1cc30eb134
SSDEEP 24576:VwYNsIaX9C2NzjgEGpswbvZqUn6wt6xUzI9ziaHTPgEGYOShES:2SXgCkgEGp3vMOLIwNShES
TLSH
T1F225236315D1CE8AC9C2C6302A31F7B2A9A5BD225CD40767E7C47F477EB0086637E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\v8_context_snapshot.bin
Size 697KB
SHA256 46b4bb5deaad4d18593ddf6ab5b1d6109eadb23024a54701f95910458ebad9e7
MD5 a8cd0f7eec1e28c8e5d67b6a679696ae
SHA1 4128205e7d2b9a3ca10b39a8cdabe6054dd55af9
SHA512 1004808d90dcdb36b969f055908724413a83c97f218c37c277bc44e2141ed54390de973228aff6a32f25a7e3be7abdd008a95aa7a25d70c46bb7bb48a0c955d0
SSDEEP 6144:K0TNFK6bR3Gt+y3pwdZOUkxVrS5G5ZYXzhU63/W5xBMX7qd:dTm6DbkxVSXtUG4IXud
TLSH
T123E49295F70EDB37CBC946B5DEF59A467CB8B08EAF47811B310807BD7035A780A25289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\version
Size 27B
SHA256 1e57a53e6ba8e44e9ec55daa6aac7b02bc66934c74ffe17b493aa924195ea1f5
MD5 6ef42ab4f890e01d6c5ede9586aba366
SHA1 13ea238513439e4d272bdfb798862bc8c2aa91ba
SHA512 cb21d5d69efbad9972c983e00379ab576e05cd35a1b71e51363386d46c33b4685be0fa0834af1ab45a821d54c3e4da039775e79ff8709b706a206f211c4f75a5
MD5 SHA1 SHA512

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\vk_swiftshader.dll
Size 5.3MB
SHA256 7e9112633617f50dd8aa012231160beb1a76e798a32de4b31c95f8a842b7c5bc
MD5 f7d77786e766f3e5a63beb8324648bb3
SHA1 ca39f5f2e8383b6f44f08c3f7145db7e16132c3a
SHA512 e6915d8503f6fc35abd834ea6e11840b71fcace79656aebf1542035f562fdd978e74f99e3965b4024b56ab37bc8969fb1a15af024a02d8171af1881726a84cc9
SSDEEP 49152:6VdQKXekVIY5IXm6mX4GicU1BWdAYaqVFRuCILqhF3Jpzhkhmp2c+r8M6bZxqofM:67QKesAmp0qQxTB
TLSH
T1BA464903B28581D9F04ED1B9875BA623F232B8811B72B6DF42941F192E77FE06739716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\vulkan-1.dll
Size 874KB
SHA256 ccd9d36d7d9fca10ad7d7ec2edc8c9b75f54efac7e3ffa10ea417dc953a9f289
MD5 2f4fd140b3f7e9d498812623cc923469
SHA1 6707b11917b881bcb415e25fca5c2e88adebe2db
SHA512 5d176572861b98b8eae92b842d6745adfe78e7eebd3b960a25ab718d0ccc1f8c9c8b1623642ff3b4b21848f5a111813883db65d2c7bd547f25eeda5641b05c3d
SSDEEP 24576:KwCJ1eFZeQjFEUzmxLD6Z5WSDYsHS6g3P0zAk75h:IreLeQjt0X6Z5WSDYsHS6g3P0zAk75h
TLSH
T101156C12AA948669D476C074DDC24B03C9F174922326B9CF02A81718BF6BFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SodaMusicLauncher.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\SodaMusicLauncher.exe
Size 1.1MB
SHA256 7980530a4be890107a361d34b1fdb02e4968ef74ac6d8e729657f17bcdf9330c
MD5 dc6a7922aa3e0dbb17130b1f4c903e22
SHA1 da1c32898bd23b31652ee8fd4dd550c9b3077a22
SHA512 c188c7668f00fd48f726ddbba0ab02be3fd1460b86df373ef86e6f05ad43847cc98061ca6baf36021791e1e4a0a0e9fa384108d0c7a9c8a912bc0cecd91fc304
SSDEEP 24576:x8KBY/yq+CjKOGUnEr+Qu/L1caFyf/ywWJul1ZSkUMgCCQ/2:+5+oKOhnEr+Qu/L1jy4Jul1ZEWCQ/2
TLSH
T14F45AE02F151D0B6C8536271645DE33C7A299E0A4F624DC7C7E4FDF86AB05C21E36AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_config.json

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\launcher_config.json
Size 50B
SHA256 9eb86ab29f84457cee428fc5d2b21b1165ddd51a1f340d2689ab613349f0a4f6
MD5 665c6bac0aee9c5111ee9861f686b521
SHA1 b5180ee7fefb07a0020986a0b327e7d4ac38007a
SHA512 6fca817b9d611106e95ac1a2c8d121abf2b52f5c6d4ca23571d777876e841b101e6a5eebe040ccdc611b7f340efc05bfc49508c365e29eea452bbde022820d91
TLSH
T12190025080714223956556990950042A520816A70700384893E2189D6165D674115A04
MD5 SHA1 SHA512 TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Temp\TTNetCache\version
Size 4B
SHA256 67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450
MD5 4352d88a78aa39750bf70cd6f27bcaa5
SHA1 3c585604e87f855973731fea83e21fab9392d2fc
SHA512 edf92e3d4f80fc47d948ea2f17b9bfc742d34e2e785a7a4927f3e261e8bd9d400b648bff2123b8396d24fb28f5869979e08d58b4b5d156e640344a2c0a54675d
MD5 SHA1 SHA512

Submit Download

res.zip

Path C:\Users\Admin\AppData\Local\Temp\nsa5BE3.tmp\res.zip
Size 337KB
SHA256 0ba10da2ec4f693a34eefdfb0c47d8ab6946418748d78d23a03018e5b9aa0fa2
MD5 4b2c1ff4f4eb22579ff81e7146137bd1
SHA1 4303e3ebb497384e62ac1f8e080d322818465049
SHA512 f3de37244d0981bc69559daae2f058c17be2c36cffc0afc6cae499b838c0ba3140c10bbbd120b8d2829a6f1829c8bb3cdf56622e74b367fe5471417902788871
SSDEEP 6144:zQhzVwBjFT/O1UfBzIu9CU6WzzdYXhNrfpyRHnYAzXsqYtwTgbsEGytMvzswbvRl:zYuhGahR9CzWzd1nFzXsqY+ggEGyaswj
TLSH
T10A7423BBAEE31EF4CE43D1FBC236726171096513CDA0561FB9610188CE5D885436BEEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg533D.tmp\ApplicationID.dll
Size 198KB
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BgWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg533D.tmp\BgWorker.dll
Size 2KB
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
TLSH
T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
MD5 SHA1 SHA512 TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg533D.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg533D.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg533D.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg533D.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_plugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg533D.tmp\nsis_plugin.dll
Size 1.4MB
SHA256 d6859424c370027c7ea14b06fbc97f068974248594316c85d0b0a143b8555b0e
MD5 8896206c6c72667f46ea8af1cdd0b9e3
SHA1 1dbcbda8d311984e516da30f360335a407d7c058
SHA512 2ae02cea08d517cb8d03e3e03f58751aadc2b2219791cc206b83c117265c415e40191cedcbe93dd6df2bd7afee3775ff3568a0f79c5e70732af05e180b68bd47
SSDEEP 24576:/ebnAfHdIgQidWFqkXXdmevjpfz/PdNqcf7eZlIL:/KAf9IAdWasB/PdNqcf7xL
TLSH
T19B658D4176D1D0B5C84B6231392DBB3C6F287A064F2189C7D3D4BEA82A717D199327BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk
Size 1KB
SHA256 b207c64448c74004db8baa5f7e971e32a7854656ffdb1b319fa746c2662c89d1
MD5 d359e97c8e38f8c7949225ceb90638d6
SHA1 67345aec3d6c111c650126ecec08ba22b6bcf6f9
SHA512 cd50e051ef10731bce771494f7a8d5e75226f1264bba8c5baf0cd1eb6c622e407bf4aad725bca2d825ca10e5b69fdff344f58a9bdf81689250b97ab018ada831
TLSH
T19E21D2555A8B6F25C3FBC936C9A31B398773F461FF25168C005482851D18F816A48F1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk
Size 1KB
SHA256 33f1b72c05e965d99093cd7add8e65222b874e9b54fe7326e71f1ccb473ef0eb
MD5 d0933013388bc0fb5c47309f58abd0c2
SHA1 f0960939ace711d463f531c4be3c984867310ddb
SHA512 7631f232b985b78a8911ae057356cb25f6070235b59cb0ecc2aca6872b135d3439cb99012b929b5bd1fba510d481e6feee1fc7e9c469560d7cbc191e8faf178f
TLSH
T13D21D2555E8A6F25C3FBC936C5A31B398773F452FF15168C009482851C18F826A48F1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk
Size 1KB
SHA256 5fee4abce18ef23bd04d6bdd11f987e26d44286f7b2f46466f9d4cc1212d9128
MD5 776a93ebf1a9707b3ff76f83b0a7591c
SHA1 ca5c028fe65c74222b6de5045c103dcadf03184e
SHA512 9442b3cf987a4a9f7b6e8a551f9e9208950435abe130e9aa200d98cd9269f36301ce5728351269f6b10c9daa9cf768b27631ac4e74e29812dc4bb26b5800b83d
TLSH
T19121D2555A8B6F25C3FBD935C9A31B398773F451FE55168C005482851C18F816A48F1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk~RFe5871a1.TMP

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk~RFe5871a1.TMP
Size 1KB
SHA256 158359a18bd61b14bc74fb4a5f69502975a3b77e5aa5a885f73ef4fee96e887d
MD5 906952430b660c214a1c3a14503a14b9
SHA1 4f27a87721fa41a44aef16caccd8e50af3c96ac1
SHA512 b2902186a9ad9c1d93c5ad2bb293c6c2c8286d9bccda7d9cc3120da404377c199f450f8f1fac93eebb84b2eb8c0cd3372eebe741bd633cb8e4fb32d9114bcf9f
TLSH
T1E621E1555E8A6B29C3FBD936C5A32B388773F411FF251A8C009482861C18F826A48F1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk~RFe58cbc7.TMP

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk~RFe58cbc7.TMP
Size 1KB
SHA256 9296168e9364483c85654de70421a21279733d6cead95d1b97c010dc526a38d9
MD5 c6e90c38762b9bb13db4f37ce7d1fa08
SHA1 d524c697e6e11b2d3ad37473d229451b1b42081a
SHA512 af574ec1f21221c8b5ed84c07d4dbc39e39bd20b0c63e174569fb9d7fb98e69ef411ed8d5b2dbd9ea64ef24d6b285c0574ee2fb55fa9654806fcf73526a69703
TLSH
T19521E1555E866B29C3FBD936C4A32B388773F451FF652A8D009483461C28F826A48F1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk~RFe59889f.TMP

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk~RFe59889f.TMP
Size 1KB
SHA256 1b29adbe83ec5d5a8c92eb210173c6c09e5ecdf0fc875c96da12dcd85196f680
MD5 1c34ef86c5e106248e79686cc5425942
SHA1 831900351e435495f0f766913759c25e1e10c330
SHA512 bb6fe97fbe185926a70248706904a43b331bff99f26a5aa03778ac3f7e07bbe333a7aa1da63a108363e15e9822009fe8007ed2753f9eda4dc2707dbaf0b40c8b
TLSH
T1132103555E866F29C3FBD936C5A32B388773F421FF651A8D005482861D28F827A44F1F
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_0
Size 44KB
SHA256 ae582b7c48f1be89c5452572cce27fd581e650d0d542886e31c5b92b8a467fc3
MD5 ce052daf03e26bfb41fe0376950c1063
SHA1 fbb3387a9ac07c6b2e15307853bda2bf68cd71f5
SHA512 78664600a9ccf63a2dae2fe68135d67d1bc3f8f275a091287db4d64318036c56d118c2f568c0cfa2d1911a49609bf3218d804a3f46256946c81d961fcc7d65fb
SSDEEP 3:MsFlTlrllkl2QOFn/1//+M/l5FkXKy7RKu1/5ravX/:/F02QOFnFWM/lAXKy7RKKRk
TLSH
T1C513122C9FC00007DAC0503083C2DBB057B4D400078723F124989424641C78904CD00C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_1
Size 264KB
SHA256 a8f22689518e1c204a30d6b45172fe9a362e728227a13a051df12b5a7ff1090d
MD5 53c9badc4ff60d0d649ecb640b608663
SHA1 0bb0063e13b8d94db4526f7d9e483186bcb9d3b3
SHA512 95c74fe2062b797ca69433c1bd7f6dd7a8058e3eabd7ffa8579e945a2ebe6055b8a822326eb16243a25083eb56bae579f9470e782eac1ed047636cf68fc10ce9
SSDEEP 12:U/MDKV7n8NkVAFg4nOhgJOT8L23/9cI06TAKJ/8sPl8sGOjFD3TXLnOmGOaV4:6V782WeoJOT8L0PPxL
TLSH
T164449C6A8DD0EBC6C673037808EE561413B5601A4B9AD6A913F625333E63762B47816C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 03833f23569e8c59b9cd48837e7f90c358629798ef2f070869b7a2f65a61e4e2
MD5 4749f16ea3371f41a960c5126ddd134a
SHA1 ce388e08489ee0924fe30cb70ca1104f6ed0b88f
SHA512 bfd9aec604839a28bc9ffa3660e9d6b03aec7b6aaced7020afa7aae1b1104106d881e4e92d85aae23143cd2c4f32b57f749ba418dfb2d6b1e1a1dadcf2227864
SSDEEP 24:WTq3GLBiKo/xjhU94civWZX5LCK65qV9ySCPVrDg1pLRLdF5bJkeUf:nGLEtS94ci+x5LC0V9yS6rWx5VkeUf
TLSH
T14425D721244712D9FEA38EF4075E88A45BD7F120871F3F8F7584949C2F25425A6E9301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 bb8dcf0b786457991f633b5058b3682a48070be04330f9dd81bf56e0bd56f790
MD5 c01f861a022c7139653a66239a459e9a
SHA1 e0518074fc6650b00bc10c997cba44ed46469064
SHA512 cbcb757ad08fa5e784b3d29fe9c10ee53476613d3134d8725c6975fc15040ac68e1fd6d76ad0cecb2ad2e1e81779ac21164c3cf5b0d8236f82d757dfe589118b
SSDEEP 384:RWqrpaWmBvy3Nh90bIHKrxuVhH8wqU4zvoGN:kqrwzBKh90bIHhVCnU4zvz
TLSH
T145165CE68E507D06DF6E4D74B2E8CE237E71B0D1A500C8D797A980755B207C2399F2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\index
Size 256KB
SHA256 9366cc319216e89364f19003f334d13184913784e31adb1e6224f2d3f7f2c86e
MD5 dfa7639bef93c47dd2331be5dc90e733
SHA1 a4d716d5d05fe5817446797458c119914319c26e
SHA512 07ffa73ad104c28e653343c2c1f78b3fa58e2c03447814f0b975718671f8a202c7a475e8dea047a08fb127a41ab1bfc7c3cc2fa5bff69edaafa3532d64004b95
SSDEEP 3:LsOlElNllkll/luq11lVmltcsl/h/:LsKM3lEtbEWsl5
TLSH
T10144027C47800017CB9403F541818F24A338DA0047CF4783205842301C137410E43080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e6f8b2164b5e7bffadef9839bec4f590807be1fbcfff06f37d32d3fc45937f47
MD5 a19ce2c8e30fc2a711e1f1e4e5fd217d
SHA1 52652e08077082c60943943a498fe282258eb30f
SHA512 96a8b2d14b30a13035ce1e558626672034f6b4e5457b5d443cc13c6d81a5deefeaead699322eb503eee5f3532fa70a587e03da7da31acd821897252dcd6af39f
TLSH
T139C09239AFEC48C6CB7285B744C61585743224441DA32E5B907420B4840874032D2178
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ccdbcdefd03fa7c6a62178704a594e0770d5e5fe0e48af0db656638e2e7c2afb
MD5 892eaacda6eb7591fef9df616661a2f6
SHA1 96bba370584f9427ba710ac3cf30f76fb927a83e
SHA512 4f605bebb683b6cd0f0dd7762e77fce315bac2c61243591d9c2cd166b4779bf63d7a8c158f5d84a6e735ec51d43d05fad22126ef6e8721e224731053e82109a9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

DeviceV1

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DeviceV1
Size 127B
SHA256 fe832b518bca9a113d868a4986a8da7b6e076dfa53a0814c100332b9c7ed05fa
MD5 3663af4dfe50063508f5020b2e37bde4
SHA1 6394bf90196de9fe161e8e498a78e7fbd93ffcee
SHA512 978529953c8b8de21b0519363db49a20d94ae69d4a9da0af0810c9631024b247fadda45f0d335bc3ec2225d1fd57817d104549bc0647ad17d57b267b97686184
TLSH
T1ACB02B82AF988063D5ED0831A6081101CD04994048413A90880B244B38CF2F5A40DCD8
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SodaMusic\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SodaMusic\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Local State
Size 389B
SHA256 9b5e32a5f5dd2e8a03d964cdfa521d04c154cc6c4e4b5108992ae2c852f2b9bc
MD5 0e608cd086d21b1898aecb39e10591c5
SHA1 d6b3611df49c2098dc7b0f8cef5868ddd2717d64
SHA512 fc1c4b86f7c1860b315f65434df2b51744730c070db41ec9af135cb2273cc06cc9302181e7f5c10cf83f3fc22e90408d303af1000efa0c299f85b10ca5d99dc8
TLSH
T1FEE06830188DB8CAA78207C9AE27E40B4EFB152BC262330122DA1F1916BADC51018460
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Local Storage\leveldb\000003.log
Size 147B
SHA256 15928f04b333013b4097d98479eacf437eb136c9d7ab933ae382aa1abd571eca
MD5 68013a2d2ba942c4eeb0345a1f25db72
SHA1 2b21940092a559643c14c9e1f80f92dbb238ad0a
SHA512 3c0b56c5fb3e5b1b309aa414c9be14973eaa003f1dbcce958f52ce99acdd7670ed10e812d249d0842624f47a18ae992cb7ee4247a49e70378f7a9b3c839599d7
TLSH
T177C09B4F5DE5933CD87A567D76C2140475098966E3EA155DD1C414042C769D45FCCE48
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Local Storage\leveldb\LOG
Size 249B
SHA256 9d2ed2aef0fd01ea7572ff93345e7f3b80122761425a3efb46143cd54cb70169
MD5 12272149bdd6ecb551b8a1fece2f210b
SHA1 063bdbba66beb57a180d784da22840f0d1c153ae
SHA512 53f59cf25e9780ee92750615a02765f618b5e0bbcb5d2079db28305b209701f5fe3130205534f0913e84b01cbc309e3953724e68e01ebd65e5a7fd5672b93b1d
TLSH
T1F1D05E3546FD826DB305C1EBDA7F772CCBB4B251BB88720E9E99E5C97085418AB418C2
MD5 SHA1 SHA512 TLSH

Submit Download

AppSettingsCache

Path C:\Users\Admin\AppData\Roaming\SodaMusic\LunaStorage\AppSettingsCache
Size 4KB
SHA256 18dd8050fcbc76405b7e5db6798f19d696bd08f5860b538e56b33138614209a2
MD5 1a519cfdcefeba456d2ce04e632db276
SHA1 35d8b7c5bb9e33d06f548645f85ed6386029b8af
SHA512 e7051a52f5a562cd48b000fa3330455739fddf43f84ab03547e666b6229882577eae0943ac7a6c2f2addf624ee9601407bac7846316c6b4e0852c5aca772a489
SSDEEP 96:y67pYyLd2fmT0rEdF95+/llwFXfWzZZbLAPr9ViJ2A:y67pMmToS9k//w1wZbLATn1A
TLSH
T1EB919E80024B9DC6141113D4185ECD3A5A3AAA0B38649307417B1AE6AFB5F1CEF143D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config

Path C:\Users\Admin\AppData\Roaming\SodaMusic\LunaStorage\Config
Size 238B
SHA256 fa8af59179bf1d7e2b45e8520e426fa7b7c28c5edab27596942791708ec2bf5a
MD5 08feed7d0993b5f879833090c2e2740f
SHA1 79a1ee1b7b25540f33652344786f12af4b5abbf5
SHA512 76420d435b97ffbd037933bd4043d66b406c61d23df8cf04fea201d5d51ebf91935ca0d5ea63228548e7ec5bab6acff480de1c2a869849256a9c5f9a08901d81
TLSH
T12FD097076EB59BF9C5C93936D84007F0063FBF0276F0370C1861028EA1C80802190724
MD5 SHA1 SHA512 TLSH

Submit Download

Config_mkBpEg-L44Sm3ieFYiSfb

Path C:\Users\Admin\AppData\Roaming\SodaMusic\LunaStorage\Config_mkBpEg-L44Sm3ieFYiSfb
Size 219B
SHA256 f61f7308563368e02a31091ab4bee7f8ea8002f3765eb43d73a9306df125e7c6
MD5 fa56e001c743935266b9a54cafffb9ab
SHA1 8b9729db56fafc55d5273db58662c9c9d2cf1695
SHA512 5ad67c167a399642f37bc23e2f4669c2d85c20b7fe2f09c57f0c2deeae960cda37daa44e9a9a1e4ed10648ca62d7eaab32e840b45f68cdd97c4d715251894d1f
TLSH
T1DED023A3D3EA44C3B64167F044F5194994585F4144F14B215F41754F84C74E0D035314
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Cookies
Size 20KB
SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
MD5 c9ff7748d8fcef4cf84a5501e996a641
SHA1 02867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA512 d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
SSDEEP 12:TLVsFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLcF1kwNbXYFpFNYcw+6UwcQVXH5fB
TLSH
T148927B8E2F347651C0F49733F9C24A972F7C202C53637A96AE4454F2DCC25ABB5095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Network Persistent State
Size 764B
SHA256 b6b625c3c1ad125caa32f2cdf59f3a6f5a34285575759fd38eddddd031ed1902
MD5 a79a6c3f5873db57c712e40dc6127f28
SHA1 a2c0140bea2fe0cad43f6878cdb4df3c9624774e
SHA512 98d7313dd665160f16475f90222b5f6529a2b8aa23bf1910a09019e23415ebfc025e6f1bf445ce0e776e4d0ed91e538f85e57a6674564ce6936ee4dda5ce3350
TLSH
T16701D2E7C7F419BE9B2293F55E213E23C5EE0418039C7C5288E4AB1E57F2476A54168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Network Persistent State
Size 1KB
SHA256 57ffbacb2f7b1acf83706dc239b02f51b829350d315bed459d716ddc71349946
MD5 254e0030d320055379a6e05bb919a0f4
SHA1 0ff1b2a0b1a6eadde041efd11c98ac2287dd7de6
SHA512 73b9fc0c4f8a6b843bfeb135232bf133a2938db67cebbf9091e00dd5ff527caa204de536ddc9701efa455b714c34ba8f09de0051f9833fac3d7ba3fc4c3b83fc
TLSH
T1F72134E787B4097E5723A2F46E212E23C9FE1028039C7C9244D49F1957B2972914168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Network Persistent State
Size 764B
SHA256 9dd00e363c3f726278f28976330558e801d458915ceec07194073d8d557d45df
MD5 858121c85d0a66bec93443dc3b569a61
SHA1 020d21b5a49bc540d6060e606d1944b76f2fa61f
SHA512 b8e0773169d9cdce436de887a824594978d3e0c2dd43210e88589d5e38faa484c836812d1ab2e63343adeafac0d3cb9c0176d0f00d4b670c35d85d57042d9589
TLSH
T1660122E7C3F409BE9B2293F45E213E23C4EE0018039C7C5288E4AB1E57F2475A54168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Network Persistent State
Size 613B
SHA256 3c5990f2825e02cbf7dd240bf21fb274a9357c9d0e0059cfa90b57e5e1b78eb8
MD5 4eb88cee286b8ec679d44b79ad81bfb0
SHA1 5d1b72547657c5ce6ded10042f6ee7ccc60371c0
SHA512 a42f6a68dd87fd83b5d48073e44344ce6302e6e7a6627e78b979e9d96eea4e173e85f020e6c244026b67cfc6e8fcf577ff3673731692f74db65b2aa4a17386a2
TLSH
T18AF0F4FB83B41DBE8B2293F45E252E23C9FE0019039CAC5284D46F1E57B2975A54058E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity
Size 371B
SHA256 fbc43fb14c4c6b5bcab665e09af8f4108b784b322009138d29de51ae7821dd58
MD5 77772df05f9a65fe6f514adb35f45a5a
SHA1 b4af71d6d0aae9615606a018c8e8f065f492f2f8
SHA512 85fa8e8a457f45293b1aafc18ba3856f8ae7af58ac64d6981b9af3c3e62db19fe9dd52e65db69d51b8a9d78a923c8bb62a9ed8b400b32631c90a0e5bb8e0312a
TLSH
T112E068A2826EB86B2038869D2D80F8405E3AFC3501A260E8D9D2453C94450AB3A1F402
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity
Size 371B
SHA256 5b12b08f94d4ae016e4750a07febdd8dd4d26bbe48db03a133a29255a4854e7e
MD5 ab6bc5e0b756638f5541ceb75404731b
SHA1 b39b0f75fc11d07baded162c5b1827d7faafe16a
SHA512 d3dbfb16fc007c9ca0d897ccb0fd1d75512380034df90b87e1ea17859f54b48c69637d67bf30b7a32e6f7a281891e88526652f1b2e9a7bf10c9dbecc38ce5301
TLSH
T1A1E068A2426EA42B0038861D0C81BC009E7EB035024260F8E9E2453D98558BB251F402
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity
Size 371B
SHA256 dda1f05f712314bbb1c7e7db21ea29a22f8f0e45cf5de556882e7886cc740660
MD5 b14a5f18b94f34fe1de5da980e22d79b
SHA1 bbcc3ead175dd9efbe6533c4a73548137374674e
SHA512 440b932e48cc8489c49e6413e928355c85b73c1629cf797f29235d0f64bc05c69658c75eb7dd1d71895e93a64aa7116ae773934844a31fa8f3363117a494319b
TLSH
T179E020E342AFA42F103C862D1D84BD055F7AF4391251A5ECEDF6463DD0650BB653F406
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity
Size 371B
SHA256 5e6fd8b92db7fafeb724fea1ce4c92809e689eb08cf940e7d4b938467c76570c
MD5 2657efb89ab2001e91aca1180c8a40bb
SHA1 ef176d4048773591ca224137390bb1df467ed5f0
SHA512 d63bf52fb17dd15d27092ee1fc887a0bf19a85b7c902f5b1ee2d8a1c460e045b54fb5e04cc36f100dc3c0825c28f154f873a8d1ff1791c579b8cb9f770f81ed8
TLSH
T1D2E0D896817DF86B10380A6D1D44BD469F7AF03403D1B4F4E9EA413CA0471BF151B006
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity
Size 371B
SHA256 a5f6c224b0be0a955e6940398c949820718862246d71da1629b8dac64890c2ac
MD5 1da914ce96976eeff066af7059f18fc3
SHA1 2f78879474ddcc644011e480538809bf2c8ea078
SHA512 8d5f8311250fefdadfcdfe34fc25d12e152949e5e9b405c0a137136b144204b04172819aecb57d85beb2b073238f2fb6bec187c644e19870f53d0c6c56fff6ff
TLSH
T16DE068F2816DA86B206C0ADD0C41BE004F3AB03546A164E8D9E2412CB0470FB162A412
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58754a.TMP

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity~RFe58754a.TMP
Size 204B
SHA256 632ad5dc24b052b092dfb53eaddc510fa06b21c80c9b0db2c48787c477cbeb9e
MD5 8bf3eb6f0028670654f9fa6726f8c2e1
SHA1 fbfd22933a85461a73e63d957676183ed75fc213
SHA512 ac418100d63dea79d873fafc113aefa6871bc7b8e27011f5e050efca609ea2621b11e515d10659182fe2086d861538ce439a3d329e5f46a913eb253f5c624a9e
TLSH
T1BDD0229A8178F8B7003816BD5805A8118F79E03402E2A4F0E8E1803C90460BB281D00A
MD5 SHA1 SHA512 TLSH

Submit Download

c5139ee2-eabd-4538-a088-b4c3d55cf11a.tmp

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\c5139ee2-eabd-4538-a088-b4c3d55cf11a.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

douyin_app_config

Path C:\Users\Admin\AppData\Roaming\SodaMusic\douyin_app_config
Size 12KB
SHA256 5d0c04a00af480797da27002b2650eb662e716998c71d5059941fce0bbe2b593
MD5 fbf2a876212d12eaea00bf94d100d15e
SHA1 f62ec768ce987f27697e7d399a181bb9f4913f5e
SHA512 a97d677a494f8b806f7069d1a13dfec47a54b2b19c1faab4c063fbdecd618e61eb30b431dd2ec08a4f81023855031820eddc44c8c199fb077c77a433cb712df4
SSDEEP 6:l9bNFlEuWk3tZneRLCEg8CvLulC3JEl4PXC/EyGLCm/Ve:TLiuWknqLCR8CalC3N/CMyeCm/Ve
TLSH
T15B425E074989CE13C4940C7EC380E3A45EA2AFCBC6A546FB19F1F442498145418BA581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preload.tmp

Path C:\Users\Admin\AppData\Roaming\SodaMusic\preload.tmp
Size 539B
SHA256 45917d35d193988cb67505ce020b167d3ab334e84a497439b56d01bbac48809f
MD5 0929a3a35d8212e7f16e651bfe638f3f
SHA1 75439a494f6f538ba14be4dc040f64210793a707
SHA512 c105bcb09701a6246edb0344dd0b72df8d0c5a3245a7401572c90f41efdde62dd3c2173a711c072ae4961d9b4af0d6d91daff40a3396afbabef51e4edda1e60d
TLSH
T1DEF08BC0F8B504244363F185B4C23A0A311CB90AC1481620F98CD79FABE9056A621B82
MD5 SHA1 SHA512 TLSH

Submit Download

tt_crash_reporter_config.dat

Path C:\Users\Admin\AppData\Roaming\SodaMusic\tt_crash_reporter_config.dat
Size 1KB
SHA256 0b1821662c8d23e974ec74f316a6fcd5feee5a91baef54b075289be1a85ddac8
MD5 ec356456a57bff5d84cdd9f47aea35c3
SHA1 81efe8fdaf4ed80dde31a52e4421ce1e35122625
SHA512 9f2d40bcd54b942f317d2545f7b6d06fb701b95dd141da6418936e66064225da707d75fd93af697f327f26bd18f632af2fe29862cd3fe6de8f331e7078a65bb7
TLSH
T19721D7C817092431683373E93E210AAD2D01D8F3760042CA50C92682EA2ECA4EC7AC9E
MD5 SHA1 SHA512 TLSH

Submit Download

49094cc6481accb4f96849f80f563589.pftconfig

Path C:\Users\Admin\AppData\Roaming\SodaMusic\tt_crash_reporter_dump\settings\386088\pft_1.9.1_\pft_\49094cc6481accb4f96849f80f563589.pftconfig
Size 1KB
SHA256 13659d19803ca9e75e9b8759bf7c182873f452ce408579c69c7c6c1e66ec2df9
MD5 2d83a604248d75e4e49b1372a767a15e
SHA1 c38cd7bf39a92f087b1d029fa9bc096c29aa4f0f
SHA512 b0cea3e5f810e483ba2ff13a94a51bfb14213dcbff166238ebc409748f1da9283dc32d36258082514126fbeabbd73a7f34c77c9dea59898c143225b05346dbdb
TLSH
T17621B247CF1E6DA98895855416BC6FD60D4F4FB748A341F2FA2486B8A0C9861C2FFF09
MD5 SHA1 SHA512 TLSH

Submit Download

.msf3_28b0d34d32a5407d10e8ac5b5ebeffbc9887b2f4

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.msf3_28b0d34d32a5407d10e8ac5b5ebeffbc9887b2f4
Size 32B
SHA256 13d52219ea3556701a38b40ac84489aa484e73c317ea4c14cfdb7a2d475978c9
MD5 e8d8713e31656a92efc51a04dfef0684
SHA1 04a5e9a39d259c1330121659445617844944506c
SHA512 d8f4a1364a8da6c28e00c48e76441ec5c212703778b9bbd086d56b094c53ef163ab3a3a5e1dfbc6d035514d3c9d447f0432c6082545aa0752232a8ec3e8c43d8
MD5 SHA1 SHA512

Submit Download

.msf3_97dc4bf8e84cc176f92353df1995d31220ba4733

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.msf3_97dc4bf8e84cc176f92353df1995d31220ba4733
Size 8B
SHA256 e8f5a31f7d0cbd0351179cd87b836c894dc9028570bf95582583237871260335
MD5 96c182cdc7162e41ceaae14ab9009137
SHA1 54f0aa7557f2b233ee3cc3c3c3f04e2d25a3e7f6
SHA512 5dbd6f8af1064568be8a18f9d773958634cd87035f2ec1b6183e150bf541cd2b51f6d9285028084eda14dee639417b8f5dee4f8e462c6925a16d6b3048a61538
MD5 SHA1 SHA512

Submit Download

.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd
Size 98B
SHA256 7ee26859a132b53bc1db6bf5e1d0d166d72d4dcc23ebf23d958c4605fa6b96d8
MD5 7dd48616e30b09280028b785a9293601
SHA1 b81d45159f0a38a88f3ffa0ba993b02fcf4b21c0
SHA512 f0427d51d3f0863e23a07e2ea92d0155cb5dea33e86bfceb7e7a2a6080240b26f39faf6f7f7206b599ebf9748025ef7dfb164e6ca70c9c4ae278034ac073de5b
TLSH
T1FAB012D0E0049591C42CD334B8B911F7AD21036E106B04400181D4214116B71CC33BA3
MD5 SHA1 SHA512 TLSH

Submit Download

.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

~水音乐.tmp

Path C:\Users\Admin\Desktop\~水音乐.tmp
Size 1KB
SHA256 65e1e6ee5723a237e538e4c5ec99ce8de35dc0b781ad0f4a4e576e1a525fb007
MD5 fd4bb5da53580b9e6b5eea68b4835a9e
SHA1 2ca2b571a961be5da28b93f0c34ad2243dcd49a5
SHA512 ae6ea874339d4efb18e925842381f8752d765969f6550aa66eede1c898eb869cdebaa5e524a5341d147430a274c16fa4c09a2d637b80b852276801c36da42454
TLSH
T15721F4519ECE5B29C3FFD936C5E32B398773F051BF15154C009482451C14F816A48B1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\Desktop\汽水音乐.lnk
Size 1KB
SHA256 267529910913335a64f88255ee81e42f36a7f8162773c6563b8f82a883a03ebd
MD5 dccf7b806345693886059dd95e429281
SHA1 7aea6adb75de654501b7dd3e4f91164f7698454a
SHA512 e2649f0a37f25dabc98a8159dd19ec7c3a9d53ffe48794fadb31db45f3612004575e8a90898873a1f7cbdd5f27694e030584793bb0307506510f98f5c94aefac
TLSH
T12E21F1519ECB5B29C3FBDD36C9E32B398777F062BF15198D005482462C24F82AA48B1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\Desktop\汽水音乐.lnk
Size 1KB
SHA256 30469e1a2a266e6c64ffdf7eba80e95fe1e90bf7a2d729775ee244f4da9bc6b2
MD5 f6f8b87c86eb3f5539d9f1fcf30e5a18
SHA1 68c3111ee2066a0ad86717921b74dcdaf191321f
SHA512 0a25c5b650746096a27188fbc0fbdbec97a5fce366fa022fcb45202b6aaa1e72a825bbe82caa0c2d2b438df6ad3b125fb9f1ed8f7649cf67aaa901a5899d9e50
TLSH
T11F21DF559ECB5B29C3FBD936C9E32B398773F466BF15298C005482462C24F81AA48B1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk~RFe5871b0.TMP

Path C:\Users\Admin\Desktop\汽水音乐.lnk~RFe5871b0.TMP
Size 1KB
SHA256 154c8e441405650f4ae3b57b940485e4741dbf7b3efa8ecdce776c2271071340
MD5 32988ed38b1c8fe643138326ef060523
SHA1 c7a1d43927f2cc4dc28b15ea60a0037e523f58c2
SHA512 403ac3c4eae23772f6c34a3815fbbf1af737b02fdd9b63650b708e4e2fd04dbc8d701830586d2d697bc8e4fc4fa313bcac9cbd4d4344747bb4732d1abb116da4
TLSH
T1862103559ECA5B29C3FFD936C5E32B788777F011BF15198C009482461C24F827A48B1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk~RFe58cbd7.TMP

Path C:\Users\Admin\Desktop\汽水音乐.lnk~RFe58cbd7.TMP
Size 1KB
SHA256 cdc92efb1424211cc9f4b85fad980c2151b2bb7adf0bd20da9731c1ba2df0e46
MD5 3bcebb2f39dd70b7e43190e371c46d46
SHA1 dd21673c39202b509e256e0479122f2dc530bb67
SHA512 009fe52fce8e2ec59b15c80c28a39b6a9fd62720fc1378e7561979bdf003622b1bee12d4a8c37b541072bfb4904b176f5a3c19ddcac4a691e2d8855166e58242
TLSH
T1C421E1655EC65B29C3FBD936C5E32B388777F025BF15298D0054C2461C24F826A48B1F
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk~RFe5988ce.TMP

Path C:\Users\Admin\Desktop\汽水音乐.lnk~RFe5988ce.TMP
Size 1KB
SHA256 28840b8ee6c401b16c0ef3041eaece5efa401714897dd99f4041184e43a4e27a
MD5 d1d1a067b6a8e890d38e34a6e96a22bd
SHA1 c3f2ff6e54347d52946124d008a5c63de3490f73
SHA512 eb7a0595daef36bb4ffcc66317da09fd2a80c934e0882abf310f7925d6488ba3b1e8d5245780b65651762f71e2e6de3331eaa7c375c0e988f73f4bb4d8c58d7a
TLSH
T1E42100659ECA5B29C3FBD936C5E32B388777F021BF15298D009482461C24F82BA48B1F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1756-4-0x00007FFB30400000-0x00007FFB31491000-memory.dmp

Download

memory/3368-822-0x00007FFB30400000-0x00007FFB31491000-memory.dmp

Download

memory/5364-550-0x0000028955420000-0x000002895550D000-memory.dmp

Download

memory/5364-467-0x00007FFB30400000-0x00007FFB31491000-memory.dmp

Download

memory/5364-818-0x0000028955420000-0x000002895550D000-memory.dmp

Download