fbc4061465690da603a34ef658fd6800756c11ad67511316a456d28d22b70508

Analysis

max time kernel
151s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SodaMusic.exe
Size 153.0MB
Sample260705-3lencsb19n
SHA256 fbc4061465690da603a34ef658fd6800756c11ad67511316a456d28d22b70508
MD5 eb4aaed842d9af36288ab0b16b3b21d1
SHA1 afaf0ec79b1132be6828cb223a24199646984488
SHA512 3676000dcf20a7dfac8e234701c3bee6d2d56bb7596f7ff8e5b336602c9632ccd816d38c317b74a5dcafadcdf6db444331e51c17603f099d71b183fa67cb4768
SSDEEP 1572864:gqi9oCWYyZSH7d0wPaj/HzvgIJ6NTypba/44VDYeIYtsTiFffUBabwhweVxOtwVZ:AoBsa6JypbAI88hhcf0
TLSH
T1CE789D13E29A10D9E05CD1B58B578633EE72BC460B38B6DF265427162F77EE42B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.SodaMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SodaMusic.exe --auto-startup"	SodaMusic.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5292	netsh.exe
4328	netsh.exe
5564	netsh.exe
2756	netsh.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe

Executes dropped EXE 4 IoCs

pid	Process
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
252	elevation_service.exe
2912	elevation_service.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe

Loads dropped DLL 38 IoCs

pid	Process
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Soda Music\\3.5.2\\elevation_service.exe"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ = "Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0	elevation_service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{DF691195-F933-489C-86F2-497BF7FC923F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\ = "TypeLib for Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\ = "{31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\Version = "1.0"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Soda Music\\3.5.2\\elevation_service.exe"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DF691195-F933-489C-86F2-497BF7FC923F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win32	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DF691195-F933-489C-86F2-497BF7FC923F}\LocalService = "AppShellElevationService"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\Version = "1.0"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DF691195-F933-489C-86F2-497BF7FC923F}\AppID = "{DF691195-F933-489C-86F2-497BF7FC923F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\TypeLib\ = "{31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31CAA537-7F80-448E-AC39-94E535F51B1F}\ = "Interface {31CAA537-7F80-448E-AC39-94E535F51B1F}"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{31CAA537-7F80-448E-AC39-94E535F51B1F}\1.0\0\win64	elevation_service.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
2088	SodaMusic.exe
2088	SodaMusic.exe
5780	SodaMusic.exe
5780	SodaMusic.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
964	SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeSecurityPrivilege	4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe
Token: SeCreatePagefilePrivilege	2088	SodaMusic.exe
Token: SeShutdownPrivilege	2088	SodaMusic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2088	SodaMusic.exe
2088	SodaMusic.exe
2088	SodaMusic.exe
2088	SodaMusic.exe
5780	SodaMusic.exe
5780	SodaMusic.exe
5780	SodaMusic.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2088	SodaMusic.exe
2088	SodaMusic.exe
2088	SodaMusic.exe
2088	SodaMusic.exe
5780	SodaMusic.exe
5780	SodaMusic.exe
5780	SodaMusic.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1324	2088	SodaMusic.exe	87
PID 2088 wrote to memory of 6012	2088	SodaMusic.exe	88
PID 2088 wrote to memory of 3092	2088	SodaMusic.exe	89
PID 2088 wrote to memory of 2872	2088	SodaMusic.exe	90
PID 2088 wrote to memory of 4296	2088	SodaMusic.exe	93
PID 4296 wrote to memory of 5292	4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe	94
PID 4296 wrote to memory of 4328	4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe	98
PID 4296 wrote to memory of 252	4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe	100
PID 4296 wrote to memory of 5564	4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe	104
PID 4296 wrote to memory of 2756	4296	SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe	106
PID 2088 wrote to memory of 1596	2088	SodaMusic.exe	108
PID 1596 wrote to memory of 5780	1596	SodaMusic.exe	109
PID 5780 wrote to memory of 2372	5780	SodaMusic.exe	110
PID 5780 wrote to memory of 2540	5780	SodaMusic.exe	111
PID 5780 wrote to memory of 5312	5780	SodaMusic.exe	112
PID 5780 wrote to memory of 1400	5780	SodaMusic.exe	113
PID 5780 wrote to memory of 964	5780	SodaMusic.exe	115

C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
"C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2476 --field-trial-handle=2692,i,8860020498013353905,8746480118781405845,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=3084 --field-trial-handle=2692,i,8860020498013353905,8746480118781405845,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:6012
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3588 --field-trial-handle=2692,i,8860020498013353905,8746480118781405845,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  PID:3092
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=electron.app.SodaMusic --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8860020498013353905,8746480118781405845,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  PID:2872
- C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe
  C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_Zum2mzcA5sSv_jp3Om8zQ.exe /VERYSILENT
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5292
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
    "C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe" --install
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:252
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=TCP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5564
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SodaMusic" dir=in action=allow protocol=UDP program="$extractPath\SodaMusic.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2756
- C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
  "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=relauncher --no-sandbox --- "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
    "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2504 --field-trial-handle=2616,i,12871964787276217761,9557559308588879587,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2976 --field-trial-handle=2616,i,12871964787276217761,9557559308588879587,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3380 --field-trial-handle=2616,i,12871964787276217761,9557559308588879587,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe
      "C:\Users\Admin\AppData\Local\Temp\SodaMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\SodaMusic" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=electron.app.SodaMusic --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=2616,i,12871964787276217761,9557559308588879587,131072 --disable-features=OutOfBlinkCors,SpareRendererForSitePerProcess,UserAgentClientHint,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe
      C:\Users\Admin\AppData\Local\Temp\SodaMusicUpdater\SodaMusicNew_l3i8Ka9ksSUX2U6ZhbKqx.exe /VERYSILENT
      4⤵
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2980

C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
"C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SodaMusicLauncher.backup

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\SodaMusicLauncher.backup
Size 1.1MB
SHA256 7980530a4be890107a361d34b1fdb02e4968ef74ac6d8e729657f17bcdf9330c
MD5 dc6a7922aa3e0dbb17130b1f4c903e22
SHA1 da1c32898bd23b31652ee8fd4dd550c9b3077a22
SHA512 c188c7668f00fd48f726ddbba0ab02be3fd1460b86df373ef86e6f05ad43847cc98061ca6baf36021791e1e4a0a0e9fa384108d0c7a9c8a912bc0cecd91fc304
SSDEEP 24576:x8KBY/yq+CjKOGUnEr+Qu/L1caFyf/ywWJul1ZSkUMgCCQ/2:+5+oKOhnEr+Qu/L1jy4Jul1ZEWCQ/2
TLSH
T14F45AE02F151D0B6C8536271645DE33C7A299E0A4F624DC7C7E4FDF86AB05C21E36AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\elevation_service.exe
Size 2.6MB
SHA256 c43b33903e0d06bd661ee9814f3c55a52c033d7d317d595cf010146396c43e5f
MD5 b892915cfb25853be88761d01ae2af63
SHA1 5dab9716a66e97429d4dfef902b86ca7ec48c562
SHA512 531ca244cd4a42206e2cacc15ca740d48911258ad10b847b0015889fa8edd80d74c5e386e1deeaa49fa2b27ef7fd09e917dc7285f4bdd40e8e9f5642b24276e9
SSDEEP 49152:/EzafuNeCphq1SLdohMK8yt4X3OSOtTFfyWChh41NMGAjO1:DfiC7
TLSH
T1E2D55B13F3ED41D8E0FAD674D7658232AA72BC465B38A6DF064072191E76EE09B3C721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_config.json

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\launcher_config.json
Size 50B
SHA256 9eb86ab29f84457cee428fc5d2b21b1165ddd51a1f340d2689ab613349f0a4f6
MD5 665c6bac0aee9c5111ee9861f686b521
SHA1 b5180ee7fefb07a0020986a0b327e7d4ac38007a
SHA512 6fca817b9d611106e95ac1a2c8d121abf2b52f5c6d4ca23571d777876e841b101e6a5eebe040ccdc611b7f340efc05bfc49508c365e29eea452bbde022820d91
TLSH
T12190025080714223956556990950042A520816A70700384893E2189D6165D674115A04
MD5 SHA1 SHA512 TLSH

Submit Download

shell_config.json

Path C:\Users\Admin\AppData\Local\Programs\Soda Music\3.5.2\shell_config.json
Size 566B
SHA256 32132983a68658d327664777a9bd5901c14884bc133102f5ee4abcf605a924e7
MD5 0d406f8e2ddc4f77b13d5e3d104fff51
SHA1 4095596fb43c518d179d3303ac8c2059532b01e1
SHA512 0f84c7538f77547a46d395201f82a7e4168baa9bac4f3403a3e60fed0ec60c0adb667b0afd6a436d4042810e121af0082ed9c7d35f95c63abb6d82f8a48bf178
TLSH
T118F0BB9AC4614A9F9AF480C8C91D571633191E1B0DC0363862B35F4D681D4EB65BC67C
MD5 SHA1 SHA512 TLSH

Submit Download

local_prefs.json

Path C:\Users\Admin\AppData\Local\Temp\TTNetCache\prefs\local_prefs.json
Size 137B
SHA256 a08c09a98bcb60222645d31f07a7daaf1e5380e145fccc2ba5fafc5bf6e7b1d6
MD5 b55f0abd39b50be3ece4712ef58066c3
SHA1 ee6a35a28f184fba9d289e6f2a6d68f0e5cc0619
SHA512 b4b03efca40c02e51b1b68dc193b4aa06b82c9cb1182672c0029661c2c7eb72f89a705b6dbdb1680f1514fd1491a69157331d5786a0e3cb360a0bee86537712f
TLSH
T1D7C02B52066008FF0351C3A1A0101B17DFFF100A4218AC4D4610061E41399DE020044B
MD5 SHA1 SHA512 TLSH

Submit Download

version

Path C:\Users\Admin\AppData\Local\Temp\TTNetCache\version
Size 4B
SHA256 67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450
MD5 4352d88a78aa39750bf70cd6f27bcaa5
SHA1 3c585604e87f855973731fea83e21fab9392d2fc
SHA512 edf92e3d4f80fc47d948ea2f17b9bfc742d34e2e785a7a4927f3e261e8bd9d400b648bff2123b8396d24fb28f5869979e08d58b4b5d156e640344a2c0a54675d
MD5 SHA1 SHA512

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp816C.tmp\ApplicationID.dll
Size 198KB
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BgWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp816C.tmp\BgWorker.dll
Size 2KB
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
TLSH
T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
MD5 SHA1 SHA512 TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp816C.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp816C.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp816C.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp816C.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_plugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp816C.tmp\nsis_plugin.dll
Size 1.4MB
SHA256 d6859424c370027c7ea14b06fbc97f068974248594316c85d0b0a143b8555b0e
MD5 8896206c6c72667f46ea8af1cdd0b9e3
SHA1 1dbcbda8d311984e516da30f360335a407d7c058
SHA512 2ae02cea08d517cb8d03e3e03f58751aadc2b2219791cc206b83c117265c415e40191cedcbe93dd6df2bd7afee3775ff3568a0f79c5e70732af05e180b68bd47
SSDEEP 24576:/ebnAfHdIgQidWFqkXXdmevjpfz/PdNqcf7eZlIL:/KAf9IAdWasB/PdNqcf7xL
TLSH
T19B658D4176D1D0B5C84B6231392DBB3C6F287A064F2189C7D3D4BEA82A717D199327BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk
Size 1KB
SHA256 8b0b241b5f830eea5ae11f7eb0496e06b55f07ffe757774bbee2b37d32be42f8
MD5 280ced20c6c3e8743f03ad1c7dd04b8f
SHA1 84fce32cc3e5a4b689997b2337b1242ead7a64c2
SHA512 5c4512bb88a86054f820c3ac2daa383f11e4d944349d133c5c3dbea598b4bf7177a4e999568d32037b1e0d7ef99c99a56bce99a23f086c865d49244cb40e56f9
TLSH
T12221E1105CD66B25D3FAAA3991E72729C637F452BF261F1D004883462D16BC1ED18F5B
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\汽水音乐.lnk
Size 1KB
SHA256 296f694f5604aca340231c24764b108ed15509cbba7987be4d51188b369407e2
MD5 8469a564a0f87648c2260cb2ec4ce53d
SHA1 7714076ecc9e50c617f435bad824740d180814db
SHA512 29672b07597b21187853d8db1ab548874d4f9cea3f7f9d21dd3bc57148b4286da36c8ab89d10794dee8e337fa674529210bed23e78d90d2c263c910f05bae913
TLSH
T13821C0106CD66B65D3FA9D35D1E62729C637F452BF261B1C004883852D15BC1AD18F5B
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_0
Size 44KB
SHA256 3133fc2089667808709af62983b565b0049ece145174788d9f0df93415fd2be8
MD5 5ce31d40a6a6ac6611910cd27aa33a4e
SHA1 1e4518c4ae3919ee4a9fa8fa0acdf46ca12ea026
SHA512 da0aa74967f0fed654a0d7731f94f3e0b1299f6bcb3c8e888e97b03bd5eca9aa463b9e0617fa6f61fd567bf07aa51f45ccf033fa46b553342553b2743955591b
SSDEEP 3:MsFlTlrllkl2YOz+l0iWRReN8kM/l0b/tl:/F02YOz+q9eakM/l0
TLSH
T1AB13127CDD800D4FCF3D0030938852772271C5410B75930770302033180D3411E40630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_1
Size 264KB
SHA256 be2b060494d10525fb640a6d932ee5d2c9d6ebef9f2e01b2f5648bb9d9bfb4b9
MD5 9c354ad43b930088a12bef127ef552a2
SHA1 41c9bd55ab6612bb3989a85ec4db8ec3d1e38444
SHA512 2e447579b48bf04f0430ceccf5158ce9501424a9ab0f5aabb67c57f40d1ce646633d4b891975a5b2f70f4bf2b8239f5c4173216c08f43c9fe04f9da32315d79c
SSDEEP 12:U/cXzuUAwLyGOjFDFSIXL7XwXFXV49iIbVAFg47XJsF28L23/9cI06TAKPP:7gwLM6IbWeGe28L0
TLSH
T15644B17A0690A97EC77393388AD953041BA680141E5BD6A5D2A236933BF22A26704274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 0c6707d0c5b111c546aa8f7e26d34c414f227a0c9ae432c4cbbe647b7dea397e
MD5 36c6206a6b8f4940e1679ef2ee90640b
SHA1 6f77e499aca5fc7cf0462342058acb350c37132e
SHA512 c573feb5a8197ef5bb63e6cafeb25cb6f140ad6687e953ed3dc373d485e2c985532ac3198fa2b06e554273ce694ada61bd9a0b36e77532c3be52f8c73e5047ca
SSDEEP 24:WTnlwGXOfGLDjxjFI6RpCswe+Zm/Zu3yBpiNejvXY46AS+n:4qrMj9FIehdiUX+l
TLSH
T1A125B4050A9111D7C9F405B2CC9ABAA7A908AB28368530628F8A4EDC03E04EE0224A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 c27607b4e37841c52d9c18d2e080ad0bb12ec8dbea01229112b626a9a98b326f
MD5 b13a8a0ba68b7858954e95315c3cb1f4
SHA1 771b9733c130682edf716a050948e1f44f0c0933
SHA512 c04dda2fb88a38c0c7b4c68175adee6ef7f447f38ec5a07fb2b5c23c2a91e15f0efec69b719be5d5216728b9d4748e5524b722eddcf155a6eaad70a4e75f103f
SSDEEP 192:gk8GItaGCkaWm++vMdgFJgWnz7fvoGa2MdFFelYyYpyX2LDj7P8wApfc9ST:gkataUaWmBvV/zzvoGNwsYYX2b7apf
TLSH
T1C7166EF94F309E06FE9E9E7870C4CD126EB1E0C1A91184E79399C0651F507C36ACE1AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Cache\Cache_Data\index
Size 256KB
SHA256 83f8035f03a6fe3c72393fb77cf248206ea3c08f3db7450612ad16d171909445
MD5 5e31317c330236c325386f47ac361224
SHA1 a3bc7124dc9e623ef732797c841a4bf8e88906cf
SHA512 4c3daf10d2ed9cc30e8a8c28122e2e8387acc9cd77bd67fe4a79fc32d23cd394e4c4579fd48064398ef2986f10a2e14632d6a0aece23aed20e06d879953162a2
SSDEEP 3:LsOlElNllkll/ltvkl1lUltnMsl/Clt:LsKM3lEtKkGsla
TLSH
T11044023C8740414AC64803B45185872C7738C600474F4393000811301C017410F87084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 56146d1a88342b5582ffb53703d597a1d8e20d129f3b3b6772f2ef6c923f9af4
MD5 3f0cbaa17bf23200bcb4925eb970e65c
SHA1 c0c1a0f640f960416f5bd69d937e027eaa727d17
SHA512 74e635801830019de594294cfc38cf382c88e57aca4ac5551251ab8d6592eaa63cfe2f4b98fecc59b87177ac6d6b39ee271f5ed927d7ff6edc6b4f6330717dcb
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 1ecb0e9b424978826dad832a370d768d8c59aacb9672dc050a7f7352ab812018
MD5 cc3ee2f1f49754415c151cfb2625b475
SHA1 cc93631c5f9c68f91951feec7c6cab97e4435659
SHA512 39186df9e6b9937ca1cdfa74eaba3518c117b3ad74749fefb48cb3ff949cc86029662d57e9a3bd48954dc2561434fe6c0618470270c0ec7fcf95b36f67430b1c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

DeviceV1

Path C:\Users\Admin\AppData\Roaming\SodaMusic\DeviceV1
Size 126B
SHA256 019e6027458bcdf3a7451a5c33611d4c3946143e0036eb880665f95099b82a84
MD5 c4f2c4011ffe693f39d28711e6556141
SHA1 c8cb3c9bb7372a4eb0c4cd99b3f6daec274076e7
SHA512 f85805fa27924aa61b0c0f26b926972aecf2530e8eef20997e00b7b1102d877fcb1810f08eed2d7d6562407b73f6df7bf092ef8133910511fd37af30302ab9c6
TLSH
T182B09B478475485DE3C49CB6C9B1C1885485E718D5365405255F78F41C5F557E44F05E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Local State
Size 389B
SHA256 f72f04c8635858e640790326f38fd328137eed9a171d82bf78bb1745294c075d
MD5 5817ee4c1655bf59749fc85271bf621f
SHA1 1e66a3f56969de5564f2a37da268dec9b3aad94a
SHA512 6410397fcee311c67425953805310d9bf32f8544ff2abc31f9cfc184cb99d090d23b9d3ca22c1f9dd6c55da1f768a7ab7e29db42c53a13bf5d8c055fe76e13c8
TLSH
T154E0687178D4688927E25AEA82074C029E2962A3E3A659692758950216BBDD0842E971
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Local Storage\leveldb\000003.log
Size 147B
SHA256 170371fe973d031e876c665fdcd2b3296a1abf5e69b30135c49936effd748c3f
MD5 3fb04998e18391705675a499cf14cfd1
SHA1 a54e300d1e90780f55a9410e0c5d5b71a2ab3df8
SHA512 2aa34b99f8f8f038266966cfd6e78b0c61425b36160b528bf223bebdca6385137d74a361140d8ff2fe7cd1d4fd64f284118693aa11c75529e8a25c12598220f3
TLSH
T183C09B8F5EE5933CD879597D79C314487504C467E7D9525ED1C421041C769D45E8CD48
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Local Storage\leveldb\LOG
Size 251B
SHA256 d6b2630076446bcd21838c4d6d60c38725695755037f93029ec7905843d80138
MD5 24653bf4fa77d7be0c94bb68a839b5c0
SHA1 30170b9a8a380f3b6097e67c6d40fa52a62af7e7
SHA512 1ba5a591687ab8c66e9fa0659dcef33b5b2835d616d01398c6d9f9e03ebb5f767e16eeb8f673a97a6a79b5ef708aff74f2d034afa5c65fc506aba721c869c1bd
TLSH
T11AD0C23214D945286303C09B892E7328C7B4B1507E8C320D8F96A08860880088A418C3
MD5 SHA1 SHA512 TLSH

Submit Download

Config

Path C:\Users\Admin\AppData\Roaming\SodaMusic\LunaStorage\Config
Size 238B
SHA256 fa8af59179bf1d7e2b45e8520e426fa7b7c28c5edab27596942791708ec2bf5a
MD5 08feed7d0993b5f879833090c2e2740f
SHA1 79a1ee1b7b25540f33652344786f12af4b5abbf5
SHA512 76420d435b97ffbd037933bd4043d66b406c61d23df8cf04fea201d5d51ebf91935ca0d5ea63228548e7ec5bab6acff480de1c2a869849256a9c5f9a08901d81
TLSH
T12FD097076EB59BF9C5C93936D84007F0063FBF0276F0370C1861028EA1C80802190724
MD5 SHA1 SHA512 TLSH

Submit Download

Config_iniE5b6OtCH-QoBuQ4SHh

Path C:\Users\Admin\AppData\Roaming\SodaMusic\LunaStorage\Config_iniE5b6OtCH-QoBuQ4SHh
Size 219B
SHA256 f61f7308563368e02a31091ab4bee7f8ea8002f3765eb43d73a9306df125e7c6
MD5 fa56e001c743935266b9a54cafffb9ab
SHA1 8b9729db56fafc55d5273db58662c9c9d2cf1695
SHA512 5ad67c167a399642f37bc23e2f4669c2d85c20b7fe2f09c57f0c2deeae960cda37daa44e9a9a1e4ed10648ca62d7eaab32e840b45f68cdd97c4d715251894d1f
TLSH
T1DED023A3D3EA44C3B64167F044F5194994585F4144F14B215F41754F84C74E0D035314
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Cookies
Size 20KB
SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
MD5 c9ff7748d8fcef4cf84a5501e996a641
SHA1 02867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA512 d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
SSDEEP 12:TLVsFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLcF1kwNbXYFpFNYcw+6UwcQVXH5fB
TLSH
T148927B8E2F347651C0F49733F9C24A972F7C202C53637A96AE4454F2DCC25ABB5095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Network Persistent State
Size 613B
SHA256 6ec6c221549e3aace1edff8aaad0e1694195e7706918802aa68d95831538027c
MD5 014351431ae8cfcdee9af655a61ecd24
SHA1 d1e4a66a5ec85b6021a24b1cbcda0af229957036
SHA512 8851d3c650cde4505082df41553bfc4ce61a6efb1ac4ebd41dc64c5661aef03b7db4a4da2fa7d35f80e33b63ca1d32850732795837a71a0ab0421d07d6cd5bdd
TLSH
T164F0F4FB83B41DBE8B22D3F45E252E23C9FE0029039C6C5284D46F1E57B2975A44058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a648.TMP

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\Network Persistent State~RFe59a648.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity
Size 371B
SHA256 d0f80fed50f53dd7fd20dd196092a995d046b410b134edf1deee31697e4d4341
MD5 0698174b985466930abe844382a99b02
SHA1 7c665e1c5a1f24bf0f9c5bc77b5270395eee2458
SHA512 b7eaae4dcc6fb691e1316f0340e6f3441a4b198f2a96f3aba0729f0b8e960af2ab79ef681fa9a755d8354a6623fc3edfc34c9588d1fdfe2e3af77147ca5157c1
TLSH
T14EE0689682FDB86B1029062E5C44BD449F39B03402C2A8E4EAE28A6CA0460BB261A406
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity
Size 371B
SHA256 6b21dbf237125b374721d29ccca7de3fcf39dc9c652a47599fcfd4f8c4c441f1
MD5 8b93d212ce70c24f885dc9c004fe81be
SHA1 d6dd3c69850c798837037205a780d669d248442e
SHA512 f356ca4aef299e4feeec717a7b718bfb37d06c0e028c2403e60e30378aab8606eedabe3089272d35178c5d88572d84a41f3f3162f311ecdc4b62fa844b43801c
TLSH
T1D7E0D892C27DB43B107D472E2E84BD055F7AB035025168ECEDF6463CA0951BB251F406
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599b3c.TMP

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Network\TransportSecurity~RFe599b3c.TMP
Size 204B
SHA256 ee9aceb0f8aae65e875d34194fa3052123be14c1146225f7ab9277ad685ce498
MD5 167ec2269dd0454df8578119fb1e3723
SHA1 40fed4fd5a4c722f702abe47380211747c94ba7b
SHA512 e7c4a193c76b9b0dc940d0747fc1b3fac9c9b1e0c57f40b1844bd12990e783fcb43bf6a1ca988a1c78ce166c3da0fde41bf64ca8c582dcb95833eede3f6b26a1
TLSH
T171D0235682687877102A126E6805AC40DF78903402D324D0ADE1842C90470F72518409
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Preferences
Size 86B
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
TLSH
T113A0124350152476150F2A2400474E5618E801301D1BF945C1E035A1756685C084700E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\SodaMusic\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

douyin_app_config

Path C:\Users\Admin\AppData\Roaming\SodaMusic\douyin_app_config
Size 12KB
SHA256 5d0c04a00af480797da27002b2650eb662e716998c71d5059941fce0bbe2b593
MD5 fbf2a876212d12eaea00bf94d100d15e
SHA1 f62ec768ce987f27697e7d399a181bb9f4913f5e
SHA512 a97d677a494f8b806f7069d1a13dfec47a54b2b19c1faab4c063fbdecd618e61eb30b431dd2ec08a4f81023855031820eddc44c8c199fb077c77a433cb712df4
SSDEEP 6:l9bNFlEuWk3tZneRLCEg8CvLulC3JEl4PXC/EyGLCm/Ve:TLiuWknqLCR8CalC3N/CMyeCm/Ve
TLSH
T15B425E074989CE13C4940C7EC380E3A45EA2AFCBC6A546FB19F1F442498145418BA581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preload.tmp

Path C:\Users\Admin\AppData\Roaming\SodaMusic\preload.tmp
Size 539B
SHA256 45917d35d193988cb67505ce020b167d3ab334e84a497439b56d01bbac48809f
MD5 0929a3a35d8212e7f16e651bfe638f3f
SHA1 75439a494f6f538ba14be4dc040f64210793a707
SHA512 c105bcb09701a6246edb0344dd0b72df8d0c5a3245a7401572c90f41efdde62dd3c2173a711c072ae4961d9b4af0d6d91daff40a3396afbabef51e4edda1e60d
TLSH
T1DEF08BC0F8B504244363F185B4C23A0A311CB90AC1481620F98CD79FABE9056A621B82
MD5 SHA1 SHA512 TLSH

Submit Download

tt_crash_reporter_config.dat

Path C:\Users\Admin\AppData\Roaming\SodaMusic\tt_crash_reporter_config.dat
Size 1KB
SHA256 123890998690ffb1126ba590f33ffc08d37979367b2c98570c970866d23af94d
MD5 a0341a102c710a222d11b3563777290f
SHA1 bc65da6c72cdff4c617433e50b99f2d89d713763
SHA512 3804e4bdcd2bdceeb1a8ea58b4f572947be6be1eb0386b504af389a8fc9334c37575fb135c3bfd021c27cc16781c877bc2f7c04d4ca16e13959c999f85789e36
TLSH
T171210ACE813130AB1C12766D5E2E38624225DCD12D2043DA848BB1D8BB530EE4EC2FBD
MD5 SHA1 SHA512 TLSH

Submit Download

91eb2692943b981e3ce4465eb0b53d32.pftconfig

Path C:\Users\Admin\AppData\Roaming\SodaMusic\tt_crash_reporter_dump\settings\386088\pft_1.9.1_\pft_\91eb2692943b981e3ce4465eb0b53d32.pftconfig
Size 1KB
SHA256 13659d19803ca9e75e9b8759bf7c182873f452ce408579c69c7c6c1e66ec2df9
MD5 2d83a604248d75e4e49b1372a767a15e
SHA1 c38cd7bf39a92f087b1d029fa9bc096c29aa4f0f
SHA512 b0cea3e5f810e483ba2ff13a94a51bfb14213dcbff166238ebc409748f1da9283dc32d36258082514126fbeabbd73a7f34c77c9dea59898c143225b05346dbdb
TLSH
T17621B247CF1E6DA98895855416BC6FD60D4F4FB748A341F2FA2486B8A0C9861C2FFF09
MD5 SHA1 SHA512 TLSH

Submit Download

.msf3_28b0d34d32a5407d10e8ac5b5ebeffbc9887b2f4

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.msf3_28b0d34d32a5407d10e8ac5b5ebeffbc9887b2f4
Size 32B
SHA256 9eb01049a20562f16170214a4f08280d164cb4c1d79deefd9f22b60a8b2a3ae3
MD5 76efaeaf5ab406400b3bfac9110f1c48
SHA1 3a38b169ae6de8bdf6da751bb43e9d093f4eb2c8
SHA512 2a7ee769df1f92882cc6ea8f6e208da7f7892d88e7dca054c30fc9cc1cf5480b97b89ed141f1ebdff9b7674bac3fb39dc70cc49bd5d001a4c51da9650c5669fb
MD5 SHA1 SHA512

Submit Download

.msf3_97dc4bf8e84cc176f92353df1995d31220ba4733

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.msf3_97dc4bf8e84cc176f92353df1995d31220ba4733
Size 8B
SHA256 e8f5a31f7d0cbd0351179cd87b836c894dc9028570bf95582583237871260335
MD5 96c182cdc7162e41ceaae14ab9009137
SHA1 54f0aa7557f2b233ee3cc3c3c3f04e2d25a3e7f6
SHA512 5dbd6f8af1064568be8a18f9d773958634cd87035f2ec1b6183e150bf541cd2b51f6d9285028084eda14dee639417b8f5dee4f8e462c6925a16d6b3048a61538
MD5 SHA1 SHA512

Submit Download

.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.msp_092fde7a53a0274594af0984c7830fc0c13dc8bd
Size 98B
SHA256 dffb557e347feb37e36dc926e26955892f4c1f58f42de27744ff7b14fafc0e90
MD5 bc2fdfa86ef49dc2c56c75f8386bec19
SHA1 2d66dfeda2f6d4ec4aaf28b65120a7bfd3eb06c1
SHA512 bbc74359c978427a34745a51b4efd5e449b140b5223113b13b4e43466295b7e3f421b80d29589a8c4dd951d85a2bfcd863635e1b1e08ba7ff78028649abb9180
TLSH
T12EB01249A067141D51471151F246E0F4AD605444CC82953B6A76CACC16C2AB00408C57
MD5 SHA1 SHA512 TLSH

Submit Download

.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d

Path C:\Users\Admin\AppData\Roaming\mssdk\ml\.mss_1f149f2d7f76b27fded4588b7ec7fb6dd577723d
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

汽水音乐.lnk

Path C:\Users\Admin\Desktop\汽水音乐.lnk
Size 1KB
SHA256 9bbca5de9edb9857bc52f831ada07a881e8e90b865b34b8293e9c9c2c744a563
MD5 68ad566e5ab945a18662cb94ffe99f7d
SHA1 23d77cd25b6570eb1dd3af829eaeb024b4069a33
SHA512 2815d3ab70e91b715c440355f3e28937462defb0461ac4286386474ac76b49c26741a05280a066f390cbb1d6e642fae84481ae098a8cfbbfdbd86ca5ed2a8349
TLSH
T1DD21DF10ACD66765D3FBAE39D2E6272AC637F4527F161E1C004883462D12BC1ED18B4B
MD5 SHA1 SHA512 TLSH

Submit Download

汽水音乐.lnk~RFe59a109.TMP

Path C:\Users\Admin\Desktop\汽水音乐.lnk~RFe59a109.TMP
Size 1KB
SHA256 bc6d9b034c45989dcab94be524987facb5314084a69d91f0cf4e23dfa9549e7f
MD5 74c5651b2d26137c678d21287aa2263e
SHA1 f6957512ae9560053046da09cf4ba08237dcede8
SHA512 adc14a33d882c618410fb2db4bd844fe97e2fa2df462aa62169494223281be0492acafe28ef5ca02394862aa53369f1974f4161e4e33d246dd3b188bdecc9f59
TLSH
T11B21EE106CD66729D3FBAA3992E72729C63BF4527F161E1D004883462D22BC2ED19B5B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2088-4-0x00007FFE5D470000-0x00007FFE5E501000-memory.dmp

Download

memory/5780-456-0x00007FFE5D470000-0x00007FFE5E501000-memory.dmp

Download