hxxps://www[.]oldversion[.]com/windows/winamp/winamp-5-622/

Analysis

user interaction
yes
max time kernel
122s
max time network
170s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.oldversion.com/windows/winamp/winamp-5-622/
Sample260715-jxxtjae17n

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
99	5016	msedge.exe
123	4088	5.622_winamp5622_full_emusic-7plus_all.exe

Executes dropped EXE 7 IoCs

pid	Process
4088	5.622_winamp5622_full_emusic-7plus_all.exe
5380	pxsetup.exe
5356	pxcpyA64.exe
1276	wadxsetup.exe
5584	dxsetup.exe
4980	winamp.exe
3656	winampa.exe

Loads dropped DLL 64 IoCs

pid	Process
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
1464	RunDll32.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
5584	dxsetup.exe
5584	dxsetup.exe
5584	dxsetup.exe
5584	dxsetup.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
4088	5.622_winamp5622_full_emusic-7plus_all.exe
5288	rundll32.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe
4980	winamp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinampAgent = "\"C:\\Program Files (x86)\\Winamp\\winampa.exe\""	winamp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SETE001.tmp	dxsetup.exe
File created	C:\Windows\SysWOW64\SETE001.tmp	dxsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_31.dll	dxsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETE15A.tmp	dxsetup.exe
File created	C:\Windows\SysWOW64\SETE15A.tmp	dxsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_42.dll	dxsetup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\shifter - fractal grinder.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\shade\seek.png	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\drawer_bg.PNG	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\xml\player-elements-shade.xml	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\Winamp 5 Picks\Tuggummi - Pina Colada.avs	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\yin - 160 - Controversial.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\yin - 315 - Ocean of Light (yo im peakin yo Eo.S.-Phat).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\Winamp 5 Picks\S_KuPeRS - Inverse Kinetics.avs	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Eo.S.+Phat Cool Bug v2 + (Krash's beat detection).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Stahlregen & AdamFx + Eo.S + Flexi + Geiss + Phat + Rovastar + Zylot - Fractopia Kaleidoscope.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\textures\kaite.jpg	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\System\albumart.w5s	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\beat_r2.png	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\songinfofont.png	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Forum collaboration thread - second try #6 [Goody(2), Stahlregen (3), fed (1)].milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Aderrasi - Ert (Wary Mix).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Aderrasi - Ert (Wary Mix).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\flexi - smouldering.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Common Files\PX Storage Engine\vxblock.dll	pxsetup.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\winamp\thinger\pledit-hover.png	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\scripts\titlebar.maki	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar - Dark Ritual (Star Of Destiny Mix).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - golden mirror.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - sunset over the river.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\wasabi\fonts\button-font-normal.png	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\player\ct_background.png	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\about\nibbles\level7.png	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi - when monopolies were the future [simple warp + non-reactive moebius].milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rovastar & Che - Definitly Not For The Epileptic (Inner Perspective Of Life Mix).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Stahlregen + Flexi - psychotic flower gelatine burst.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\shifter + geiss - neon pulse (glow mix).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\System\xml.w5s	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi, fishbrain, Geiss + Martin - tokamak witchery.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Goody - Ego Decontructor.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\in_mod.dll	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\System\vp6.w5s	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Goody - Unstable Sonic Reactor - Final.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Mstress & Juppy - Dancer.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\ORB - Starfish.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\shifter - urchin mod.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Bento\window\sc_alb_art.jpg	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Phat_Zylot_Eo.S. spiral_faces_v2.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\DSP_SPS\justin - tremolo and pingpong.sps	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\Community Picks\Tuggummi - Shiny metal curves.avs	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Stahlregen & aderrasi + martin + rocke + rovastar - Charmed Spun Sugar.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Goody + martin - crystal palace - Aqua Lumens.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Phat_Zylot_Eo.S. spiral_faces_v2.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\fiShbRaiN - when robots take over the world.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\xml\ml.xml	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi + fiShbRaiN - operation fatcap II.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\scripts\imagecontrol.maki	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Big Bento\xml\color-presets.xml	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\avs\avsres_texer_circle_edgeonly_19x19.bmp	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Phat_Zylot_Eo.S. rainbow bubble_mid3-starpoints_spirals_VE - Bitcore Tweak.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Rocke - Cold Love (Tei Zwaa).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Stahlregen & Flexi + Geiss - Tiger No.5 (Random texture flow).milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - disco mix 1.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\shifter - tumbling cubes.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Skins\Winamp Modern\scripts\menualign.maki	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\Flexi, fishbrain + Martin - witchery.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File created	C:\Program Files (x86)\Winamp\Plugins\freeform\xml\winamp\thinger\vis-selected.png	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\Milkdrop2\presets\martin - dark galaxy.milk	5.622_winamp5622_full_emusic-7plus_all.exe
File opened for modification	C:\Program Files (x86)\Winamp\Plugins\ML_BOO~1.DLL	5.622_winamp5622_full_emusic-7plus_all.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	dxsetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5.622_winamp5622_full_emusic-7plus_all.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winamp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winampa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunDll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pxsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wadxsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxsetup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2304	ping.exe
1248	ping.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5016	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285762253468056"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a4d4fe68-1df3-42fe-8a8d-594d9bd60fd0}\ProgID	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e7568058-32ea-4b10-af1b-8b666978891e}\TypeLib\ = "{65eba1d4-45e2-4ec5-a7ff-cb7e14659c77}"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37668F25-B3FF-42EA-A3F9-25EA0740902E}\TypeLib\Version = "1.0"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPL2Timestamp\CurVer	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{654e1149-060b-4fd1-af4b-07e1d2a83ae0}\InprocServer32	5.622_winamp5622_full_emusic-7plus_all.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3d055b64-824e-4613-b845-6afcdb888aa0}\TypeLib	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4d60fc87-14b0-48b3-93c2-5967b0fb6f96}\ = "CddbUI2 Class"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC0E5DD3-8BAB-4671-85A1-68BF93CB35E4}\ = "ICddbMusicIDFingerprinter"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLInfo	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.RMI\shell\Enqueue\DropTarget	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.669\shell\open\DropTarget\Clsid = "{46986115-84D6-459c-8F95-52DD653E532E}"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SC	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbURLManager.1	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C30FBC5C-F56C-40DD-841D-5E4428F3BAEA}\TypeLib\Version = "1.0"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.PlayList\shell\Enqueue\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" /ADD \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbDisc.1\ = "CddbDisc Class"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27C6EFC-76ED-4724-9741-9531FC52242C}\ = "ICddbWork"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA9A4BA6-1879-4A32-82C8-BD84D8FADF00}	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA9A4BA6-1879-4A32-82C8-BD84D8FADF00}\TypeLib\ = "{7919D0CA-3043-4C02-B778-AB2BF4931F58}"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.MID	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.stm\shell\Play\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2758dffc-f9fb-4c62-82c9-fdc9bceb5e9c}\InprocServer32\ThreadingModel = "Both"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbID3Tag.1\ = "CddbID3Tag Class"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{623CE0D4-7B45-4B69-A28D-2401E7AA16D4}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB780E88-D446-4157-AF74-04E8E48E46A3}\ProxyStubClsid32	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.M2V\DefaultIcon	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MKV\shell\Play\DropTarget	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.ult\DefaultIcon	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3BFA2B55-49A3-42A0-BD2D-4D60D9B9C93F}\TypeLib\ = "{7919D0CA-3043-4C02-B778-AB2BF4931F58}"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.flac\Winamp_Back = "VLC.flac"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.s3z\shell\Enqueue\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" /ADD \"%1\""	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7AF4E5E5-2DEB-462F-BBAF-684146856C6B}\ProxyStubClsid32	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53881256-92A2-4292-8E24-68CA3992E337}\ = "ICddbPLDataListItem"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBBC42AC-1409-4D95-98FC-7F6ACB33EC15}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.s3m\shell\ = "Play"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.SWF\shell\Play\DropTarget\Clsid = "{46986115-84D6-459c-8F95-52DD653E532E}"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbMusicIDNSWinamp.CddbFileInfo\CLSID\ = "{80a8f856-eda2-44db-a9ae-fafaaa2f5798}"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MP4\DefaultIcon	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dccf8d5f-c1f6-44a1-b065-60d56557f821}\ProgID\ = "CDDBControlNSWinamp.CddbURLManager.1"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63C7D158-BCA0-4C29-96C4-06BDD744ECC2}\TypeLib\Version = "1.0"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5797BF13-A4E7-4170-AE22-5F06B2823E04}\TypeLib\Version = "1.0"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.mdz\ = "Protracker Compressed Module"	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.it\shell\ListBookmark\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" /BOOKMARK \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBUIControlNSWinamp.CddbUIOptions2.1\CLSID\ = "{a68d109d-ab8e-4476-8ba8-bce0879c4f8f}"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.FLV\shell\ListBookmark\command	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{751E8ACE-610B-4336-B425-5038154F68A2}\TypeLib\ = "{65EBA1D4-45E2-4EC5-A7FF-CB7E14659C77}"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0F041D4-1570-4143-BB6A-4CE041B109D4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6131C03D-97D0-49CA-8EB1-5FA0D10EC072}\TypeLib\Version = "1.0"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61bd27fe-604c-49f8-a979-7a260a51ea5f}\ProgID	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44959787-915B-4FCF-9763-1038483C000E}\ProxyStubClsid32	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CddbPlaylist2NSWinamp.CddbPLGenLimitList\ = "CddbPLGenLimitList Class"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.xm\shell\Enqueue	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.MP3\shell\Enqueue\DropTarget	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.au\shell\open	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CDDBControlNSWinamp.CddbListManager.1\ = "CddbListManager Class"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{038841AE-24D2-4A27-A69D-21A58E4B1077}\TypeLib	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.ult\shell\Play\command\ = "\"C:\\Program Files (x86)\\Winamp\\winamp.exe\" \"%1\""	winamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24959692-AAC0-411D-9E6B-C7611FCCACBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCA2A70A-BCBC-49E9-8EF4-04DABCD68B81}\TypeLib	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18D6BC7C-4CBC-4B6A-9550-2B176438B87C}	5.622_winamp5622_full_emusic-7plus_all.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5797BF13-A4E7-4170-AE22-5F06B2823E04}\TypeLib	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5311019A-98C9-4377-B8CF-72C00A55914A}\ = "ICddbPLGenerator"	5.622_winamp5622_full_emusic-7plus_all.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Winamp.File.stm\shell\Play\ = "&Play in Winamp"	winamp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC288125-6636-405C-BE68-E9D37700DEB0}	5.622_winamp5622_full_emusic-7plus_all.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2304	ping.exe
1248	ping.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
5380	pxsetup.exe
5380	pxsetup.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1464	RunDll32.exe
1196	msedge.exe
1196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	5100	vssvc.exe
Token: SeRestorePrivilege	5100	vssvc.exe
Token: SeAuditPrivilege	5100	vssvc.exe
Token: SeBackupPrivilege	4152	srtasks.exe
Token: SeRestorePrivilege	4152	srtasks.exe
Token: SeSecurityPrivilege	4152	srtasks.exe
Token: SeTakeOwnershipPrivilege	4152	srtasks.exe
Token: SeBackupPrivilege	4152	srtasks.exe
Token: SeRestorePrivilege	4152	srtasks.exe
Token: SeSecurityPrivilege	4152	srtasks.exe
Token: SeTakeOwnershipPrivilege	4152	srtasks.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
3656	winampa.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
3656	winampa.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 5672	2012	msedge.exe	87
PID 2012 wrote to memory of 5016	2012	msedge.exe	88
PID 2012 wrote to memory of 5536	2012	msedge.exe	89
PID 2012 wrote to memory of 4496	2012	msedge.exe	90
PID 2012 wrote to memory of 5536	2012	msedge.exe	89
PID 2012 wrote to memory of 5536	2012	msedge.exe	89
PID 2012 wrote to memory of 4496	2012	msedge.exe	90
PID 2012 wrote to memory of 4156	2012	msedge.exe	92
PID 2012 wrote to memory of 4156	2012	msedge.exe	92
PID 2012 wrote to memory of 4156	2012	msedge.exe	92
PID 2012 wrote to memory of 792	2012	msedge.exe	93
PID 2012 wrote to memory of 792	2012	msedge.exe	93
PID 2012 wrote to memory of 792	2012	msedge.exe	93
PID 2012 wrote to memory of 4312	2012	msedge.exe	94
PID 2012 wrote to memory of 4312	2012	msedge.exe	94
PID 2012 wrote to memory of 2104	2012	msedge.exe	95
PID 2012 wrote to memory of 4312	2012	msedge.exe	94
PID 2012 wrote to memory of 2104	2012	msedge.exe	95
PID 2012 wrote to memory of 2104	2012	msedge.exe	95
PID 2012 wrote to memory of 4288	2012	msedge.exe	97
PID 2012 wrote to memory of 4288	2012	msedge.exe	97
PID 2012 wrote to memory of 4288	2012	msedge.exe	97
PID 2012 wrote to memory of 3960	2012	msedge.exe	98
PID 2012 wrote to memory of 3960	2012	msedge.exe	98
PID 2012 wrote to memory of 3960	2012	msedge.exe	98
PID 2012 wrote to memory of 1040	2012	msedge.exe	99
PID 2012 wrote to memory of 3200	2012	msedge.exe	100
PID 2012 wrote to memory of 1040	2012	msedge.exe	99
PID 2012 wrote to memory of 3200	2012	msedge.exe	100
PID 2012 wrote to memory of 2720	2012	msedge.exe	102
PID 2012 wrote to memory of 5228	2012	msedge.exe	105
PID 2012 wrote to memory of 5228	2012	msedge.exe	105
PID 2012 wrote to memory of 4984	2012	msedge.exe	106
PID 2012 wrote to memory of 4984	2012	msedge.exe	106
PID 2012 wrote to memory of 4984	2012	msedge.exe	106
PID 2012 wrote to memory of 6004	2012	msedge.exe	107
PID 2012 wrote to memory of 4088	2012	msedge.exe	108
PID 2012 wrote to memory of 4324	2012	msedge.exe	110
PID 2012 wrote to memory of 2896	2012	msedge.exe	119
PID 2012 wrote to memory of 5524	2012	msedge.exe	112
PID 4088 wrote to memory of 1464	4088	5.622_winamp5622_full_emusic-7plus_all.exe	113
PID 2012 wrote to memory of 1984	2012	msedge.exe	114
PID 2012 wrote to memory of 1984	2012	msedge.exe	114
PID 4088 wrote to memory of 5380	4088	5.622_winamp5622_full_emusic-7plus_all.exe	116
PID 5380 wrote to memory of 5356	5380	pxsetup.exe	117
PID 4088 wrote to memory of 2304	4088	5.622_winamp5622_full_emusic-7plus_all.exe	118
PID 4088 wrote to memory of 1248	4088	5.622_winamp5622_full_emusic-7plus_all.exe	120
PID 4088 wrote to memory of 1276	4088	5.622_winamp5622_full_emusic-7plus_all.exe	122
PID 1276 wrote to memory of 5584	1276	wadxsetup.exe	123
PID 4088 wrote to memory of 5288	4088	5.622_winamp5622_full_emusic-7plus_all.exe	132
PID 4980 wrote to memory of 3656	4980	winamp.exe	134
PID 2012 wrote to memory of 1196	2012	msedge.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.oldversion.com/windows/winamp/winamp-5-622/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff5e5bc188,0x7fff5e5bc194,0x7fff5e5bc1a0
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,5298537054713013554,11908109533457947060,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,3916967188473606413,17377797708671410575,262144 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,17143398078155571026,42555531512134687,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,2944042192018788596,15685430507693203672,2097152 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,9108549282247712678,15356595501947502319,2097152 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4396,i,6301199860017107278,4936353746182288337,2097152 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4416,i,16810545873757446715,936316965755158080,2097152 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:9
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,16690554612215062993,5042955282715796710,2097152 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3908,i,16137653955546970460,17221350306494148964,2097152 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,1064466454915063935,13890328317388391773,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,7742528800198085965,2466384533287527746,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,14911418322872852939,14893959528649118273,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,14911418322872852939,14893959528649118273,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,15947506568511018941,9986577788162218272,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6952,i,2799592802145581015,1689172704873584366,2097152 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,16752502774372413005,4715068931832987734,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
  2⤵
  PID:6004
- C:\Users\Admin\Downloads\5.622_winamp5622_full_emusic-7plus_all.exe
  "C:\Users\Admin\Downloads\5.622_winamp5622_full_emusic-7plus_all.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\RunDll32.exe
    RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\OCSetupHlp.dll",_OCPRD194RunOpenCandyDLL@16 4088
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1464
- - C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxsetup.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxcpyA64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxcpyA64.exe"
      4⤵
      Executes dropped EXE
      PID:5356
- - C:\Windows\SysWOW64\ping.exe
    ping -n 1 -w 400 www.google.com
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2304
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2896
- - C:\Windows\SysWOW64\ping.exe
    ping -n 1 -w 400 www.google.com
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\wadxsetup.exe
    C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\wadxsetup.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\nsj89C5.tmp\d3dx9_31_42_x86\dxsetup.exe
      C:\Users\Admin\AppData\Local\Temp\nsj89C5.tmp\d3dx9_31_42_x86\dxsetup.exe /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5584
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\SHELLD~1.DLL,RunDll_ShellExecute "open" "C:\Program Files (x86)\Winamp\winamp.exe" "/NEW /REG=S" "C:\Program Files (x86)\Winamp" 1
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,10116303554682830220,10762225247808798775,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,5426764528785508199,13792037814067310885,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,3202478749573364782,17692862734644703133,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,475709049373510490,8973493200961680932,524288 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6280,i,7199067289788398861,7902919960477295257,262144 --field-trial-handle=2604,i,14196030135132900733,9542841524141812896,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Winamp\winamp.exe
"C:\Program Files (x86)\Winamp\winamp.exe" /NEW /REG=S
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Winamp\winampa.exe
  "C:\Program Files (x86)\Winamp\winampa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3656
- C:\Program Files (x86)\Winamp\winamp.exe
  "C:\Program Files (x86)\Winamp\winamp.exe" /NEW C:\Users\Admin\AppData\Roaming\Winamp\winamp.m3u8
  2⤵
  PID:1124

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004D8
1⤵
PID:6396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CDDBControlWinamp.dll

Path C:\Program Files (x86)\Winamp\Plugins\Gracenote\CDDBControlWinamp.dll
Size 1.5MB
SHA256 025ee64129129e7e6bff4c0769cf93e00e095b752299e7d633de5d9c261e173b
MD5 72ab7ff3886957602a68b3d89bde44fa
SHA1 91365edba7dc4aae61edf0c5a16705552e668b6f
SHA512 ac1b58c308bcebe6c4b4672b5a4aa14cd1d3a923c80ac495f4d42aab45db0d085ddbf51111f3045bbdc74d1456f642f62775362cf3d132c1b6aaae0c47663c35
SSDEEP 24576:SvT2GcmoUWqOPQwhq5xjK7m1Xqlm9lG/c931tLz9TZFCCtReqp:SiBJUWqOP0GalpTpD
TLSH
T111759E02B7C4C1F1D19A22395237977E5B76E2188B3599C3BB941F4E4E322D1A73A3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CDDBUIWinamp.dll

Path C:\Program Files (x86)\Winamp\Plugins\Gracenote\CDDBUIWinamp.dll
Size 1017KB
SHA256 fb4211686c2ddba152cbc239ef8b630c5d2a8c05e9056d4c797cd0ddb200e9e4
MD5 ac5430ae266925bb85d2d5800d03c262
SHA1 b9a86664a0fac9b79c162587a203674bc6ae9191
SHA512 3992049fe87785c6827fa35b271c37696733b362bf276d5098b0e1befe6c217ee7847d1256dedc1fbbb2d608e7cc195e9229dbde7519615127b7f361edd8a15b
SSDEEP 12288:TFFvHXTxP20IcAakSRH5xYDOLEaX6i25xbHWCxC4gfK:/vFuhcyOLE75xbHWCxyC
TLSH
T106256C32E7D6C439D9FA2339C82652F8A7A2FE15D830C19B29DD3E1D3E785428634B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CddbMusicIDWinamp.dll

Path C:\Program Files (x86)\Winamp\Plugins\Gracenote\CddbMusicIDWinamp.dll
Size 905KB
SHA256 98a8b5ce8023885391bd4be08781deb141479eaae5c70e264eac2d6c2da54f7c
MD5 37ffbcbc724d72a49248cd6df27cea84
SHA1 7ee0fa08510f549d9ad7538416e0e19bdf911ad8
SHA512 b6fc63a76321e241547061a876f50f5b99e68880f6ba4af3d66656354cf827d99f07d38ffab6764c83c5ab1f35748876077af04743d747df3a3a5f86314a69e1
SSDEEP 12288:IRfGUnKhpKQ/SqQRn9EnafhO+98A2WmK5Ge:iXnBQ/SqQTEIA+iAbmKh
TLSH
T117154711FFD1CD7FF49E0230CCB583B936B6A6CC0A35D583A68C1A594E3C6919EE5286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CddbPlaylist2Winamp.dll

Path C:\Program Files (x86)\Winamp\Plugins\Gracenote\CddbPlaylist2Winamp.dll
Size 1.1MB
SHA256 1239b23e01467f6fdc2a0dd109c5713588fe77a4d206d60dfb3712e08d1dc3d5
MD5 7c7f404f3923a9346978be902e2257de
SHA1 c1f41edfb4af754db2e2679a8ae40d3b1a9075b9
SHA512 c60806b31bcb314c4d6e3e4ddd394752a665d16ee223359677e6d08dbf288aef88967a4aea46efbe28600f35f7abc5b6267a6c69820a29ce3f9f2e805fbcc477
SSDEEP 12288:LPEB780cAHdVaCqMH+xtkYBiLUEIa/vw+tb2+ccbC0CqC6Qxxf9hvPfz:gB780ctCxex2cTEa+tCzcWqCRl9ZPr
TLSH
T1BA359E02B3D1C1F5D8D622B96637573E4E32F5080B2695C7AB942F8D5D322D1BB3A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auth.w5s

Path C:\Program Files (x86)\Winamp\System\auth.w5s
Size 170KB
SHA256 7a285bcbd6a7e8a1490cf1bbc23bcbf3566477edb3d874a1cfe50368702ec7d9
MD5 3adf689f2182fb0d0bdb2641e13706ca
SHA1 da3272051ba29172394292cb7e864f5aec89ed27
SHA512 68426d18a46556cedb9280b584f801264614d2a18041f0e2d7ca128a53af5da581da1e297cdba0ad0e4ffeaa3be3b50493958704a1a99c5cdcb1fc34415ebf34
SSDEEP 3072:U+YotLlCk/0o4gil/t4Z+GmntFJI7kmpvSCMn9q6ZhTFClcacCz7+5ae+Lfj/m/D:U+YssSn5kGmntTI7kmpvSCMnU6ZhT4DG
TLSH
T1BA046B91F2D184B2D0F34531AABD6FA653F9EA005B71A847B6482F4D2D7C283CB29717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlmgr.w5s

Path C:\Program Files (x86)\Winamp\System\dlmgr.w5s
Size 16KB
SHA256 058466eb6d58241e326272f4b3b196fb6a8b06e69373742e55a376f2934718e7
MD5 348db0b62f7fd5109a565eaa2f0e7140
SHA1 476a1436be4e01ba32495f167ed9bce176c803b3
SHA512 bf4ea1596eca5c4a9ac23b730383e0107f0c11e655370a474db559ddee51ff1e975cdaabfc7dc637def21a681caee7f0da26c07d54851f30a408f184183b878a
SSDEEP 384:Do0Cy4unqovsI/62FtfspWIOJgUbuBFJnMOKCVlp3R:00CzuqcsI/6M07OxufJMOKsvB
TLSH
T1E5723A277E4AD037C493C17A3F55F52922EEA1501FBF1943E2A506AE0EB76D16438387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h264.w5s

Path C:\Program Files (x86)\Winamp\System\h264.w5s
Size 64KB
SHA256 beb39cc58900c1e9e1938db417d2251d62cc845160ab41bdcafb1e87848ccc2a
MD5 a4258507269619dd7486a92a0a2aa9b6
SHA1 b6f63842e4a8193bfe587ee9e1702cfcd9ca3cb5
SHA512 b403afba7b756b709df3f8acc3446ab389006c7bc887b31d8a02cfedb4ac9ba52d365569411e9fcb47643ad50d700c92dd388586eafb60a0527c26cf14a94610
SSDEEP 1536:KmixPOO27J0ut3+qN7SJKeoo3DMfdzWHx3hb:KmixP47yut3+qtIKeoosdaf
TLSH
T11E536E42A1DB00F3F8AAA43A726E723F6A35666D173E99EBD3403C60FC917D194351C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ombrowser.w5s

Path C:\Program Files (x86)\Winamp\System\ombrowser.w5s
Size 294KB
SHA256 16196bf31b15f8ed749e926b0f24501dc0c0ac396e831bb35a2315dee684b8f0
MD5 63eda57b1635b9d7b087e51de5a03244
SHA1 7a9adafb8f82a1e72b5459ad27c320b85e893258
SHA512 47b86a70454c684bddc4065788777a0660c814c63e5db36a17f169747538385813ea5dcf68f59e3f15ac5e10f8667f442022b01f2db64b829405379eb309ed09
SSDEEP 6144:OOLAKq+icZY89nR/Buy6w6qApJWF7jJ0ywySb9H60OKRm5HR1s7Ajaj:OOLIOp8jOPNwysYFa2y
TLSH
T172548D2C7BE9C07FD1B202395E787B693AFEB6512671854722844B5F2F60BC08E29357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp6.w5s

Path C:\Program Files (x86)\Winamp\System\vp6.w5s
Size 177KB
SHA256 41d5c05098a8372e78f6fbf1d84f1a8916181e7596b2d5288664594aa02bed48
MD5 38a1ff31fccf500a59cde487b9b0e32c
SHA1 59fc4c22bfaf283548869f725860c021c09e8159
SHA512 91fd7418abdae26855c0d671e9da27363d76fb92ca80cf33a7f1cd77ac847afed7575ca887b6d153f4c7752b9a6a0ba947a2eb64b9a66c7857254808bfb9beb1
SSDEEP 3072:wHjuNn2SgHHtxItxN3aqS0xPtnSvS71hjYozUk7d8FG/l6BJbZBJbOBJbUBJbE0L:wx/txItxNq6xEvS71h8yd8PBJbZBJbO4
TLSH
T193046C82E27A84D1D4028936C97FB3A64D7929B4CB4FA5E3F750367DA4F93D102B520B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vp6.wbm

Path C:\Program Files (x86)\Winamp\System\vp6.wbm
Size 129B
SHA256 03905af22913a1c1e6939cefc0e9f961ecd615040fdd5ffa8f785606f80c127c
MD5 e9202175b8da91329492da67e9f4a026
SHA1 8df341778915b566536d42ae9f6f945ae6a083e1
SHA512 dac1a0b16b73d294caeb51dcbb213f8ad68ab8b1a199b15395d0b83feeaedf35f84d96a7b7593d41fb72e8e75f18544f6aadfbace351b56abd8a9362eb57d64a
TLSH
T11CB09291EB0FC9F4CC524B3948CFED01826E2223485611ADB8A3DA81804B0F9833F82F
MD5 SHA1 SHA512 TLSH

Submit Download

xml.w5s

Path C:\Program Files (x86)\Winamp\System\xml.w5s
Size 88KB
SHA256 626936a795c9552ae1c426b5ea64823ad019ed8ce09db12bbe4f0a1c48074afe
MD5 75931c6d6354200996544d81d247a26b
SHA1 fbdd9e1ae13ab5b3ceb22485352d6faed8f6838c
SHA512 a06cdaa920b73d6b3c09de86e75901d5bb433cfb0f85efd27536b5443a4b730394aab272e11671586fac28faa72419b1df812f88ea2c32f1d76449bf7128003f
SSDEEP 1536:VQ+1A44T8CfzjjEQTx91FhG6zaXuYSKuTkXIaHVnvF3JhWgCmQ0caf+8Otk:VR4tzkQF91FhG6eX7SKuTkXRvJJwgXQe
TLSH
T128938D4174D2C077C8B50A759620E25A5E7EFE72042E5EDB7A53F94C8E73EC00D2A7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nde.dll

Path C:\Program Files (x86)\Winamp\nde.dll
Size 77KB
SHA256 3ae00b2e98817349ab0766b5758c19a76190f25909534095b92afeeed122572d
MD5 51ebb9535888592937b41387574c2c6e
SHA1 b38ff47d900b06f3ad4f65d46174be3eedf556af
SHA512 85f81b88bdca0b4ff7065f854fe374b5d9ec2541bb52e960bbc579d1dd6fad14448521b82f1679e70ffd0b8675326d697f0eaa4740385d2c1fa1eb9d9c8b98f4
SSDEEP 1536:jd/6lSWHghrZj+/Mb4rnO54NHlzCtq/7tPQ9rfOKao+mb8j+3s/:jdSlotj+/M4rO5uutO7tY9rfOKao+m6/
TLSH
T18B737C82BE9644F3F60165790D6AAB3D07B6F742C7240AC3D7517D134A353D26E3B2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winamp.exe

Path C:\Program Files (x86)\Winamp\winamp.exe
Size 1.5MB
SHA256 5b4b5a0a6381649f8d9afb0c167f6dcf730d8cc5faf750e51066c0284c7d2bbd
MD5 16dfb59b8939ecc2490ffdc03a3cf692
SHA1 7a84bf9a104d388bc2fa0af896872fe8c9adea99
SHA512 c0f234047e1ea75c21601f291ef001fdee828c6f18cba9c9797b952e3c6a303c997e0454c5c0a98058a93d77050b6a996935774b28fcf6b2a9fa86b5e677a4e7
SSDEEP 24576:qUOxsRqlyyyfmypakW3CX6LCQ8oqqiaMq1KrPQ:qvGqQ936CJ9ojEQ
TLSH
T189756D11B2A2C03BE5B10B3D6825A351C6F9BC617A73CA4B75613A4EE9717C14C38BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d1d2a6d60a166553f21938d1ef48f4f3dc7cc2ea2f0b19ccf998a07fbbe3bdf4
MD5 5f538961d377bc68bdc198328fce1d67
SHA1 67ec83fa3d1695ccfbdd1852502b2544deaf906b
SHA512 e882ae938f6a6119610baef4074b08bced7effeeb1932ba1b15afdc1c19a48004b2bfe293e12ed9b7c9a17fbaa81e34562a49f3561c205fd7b54058ab5ba71e3
TLSH
T15351D8E343671EC2C7E1827214E16CFA3A3AC6FA41CB9EC5388E90B48A5335E31D5124
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ee1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ee1f.TMP
Size 2KB
SHA256 69dff0153d616d49360c9c66ff9ff7a422828dc8f290d03adfabd3402d70be8a
MD5 fa42e110327b532257b7d009ee117959
SHA1 c507773b30600484a0bdbfa5e4a8bb7f0dd1dc2e
SHA512 5c6e07db8ff270b888bf9399d3a765ba600168b6f4686e2bb8e8400a1f2670923ca25358ab56f29eda691fb7628aaaa847c83c84898b16a990a1e4eccd3b635f
TLSH
T1DC51B7E303171DC2C7E582B258E1ACFA7A3AD6FA41CF9E95788E94B4864631E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1568884b0d56c6fa350e8d98db56b128b9a067a049f5a07885af0026a66f8378
MD5 ea6dcad98ebcf5bf10a1fd4b852164d5
SHA1 00474396f7dd0c0a9cce889a467b5ca9eb82e1d4
SHA512 fbf59f1c7eb3d2804768fe04f5581a133a3d32acec51e28a61898ac5be735ec5798ece535f8e76ee6cebdc487ac4667590fee6b158cbbc10b537aba99b0565da
SSDEEP 96:DTOOaJqa91WiNjhEzAwsUzOwBj6Y3cQ0q9A:DqOaMa91WiNjhEEwsU6kj6YsQ0qC
TLSH
T18DA19EF7C3E8CA2DD91152F0AB143E2BCE6D091453283D1BD9E59E5BA3E2472F14164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 49441335de5c049191526d25b5ad32b22088e4ca7b0b6060675ab8ac2e21526c
MD5 cc84d70b5691d8b57c96daaa3b654648
SHA1 c381ba659efe413abf336908d613432ca74de1ac
SHA512 30da47d5e7c2c8f8e4adec974894acb249442271340efbec8574bb91d8aaaa4fe519eab88ed5aeb4ed9dff9455511a3b25fadde599c344fb7f1d160102a51222
SSDEEP 192:sxRgR8yM/jK1Ml8wOy/fpse+mMDde5lSszoD8pkN/g6+WNxcvo04/YC8zuOBGiIJ:sxRgaIy/fpsUMc5lj0/5a4/MNs
TLSH
T1DB62DA166A34997BCCDBD20CF955BF93D6F51573A2901E44AAFC8A0C01E6AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 978ed0f202859c9352a3649bddf26803ab04d23f888a1bacb7e76b1af646c6f3
MD5 8bb3a21faee21c33b403e7d3740f9fbf
SHA1 50170c69f4385157b92c8f072dace80986c38650
SHA512 f770aa8b8baab0da3c07c296eb908f2a373ff2f305c8abda6b0a3e913c49dd6c8ce807a4667e16cfcec1e77c384eb747738bdf52953467ded31ddc39007f04b6
SSDEEP 192:sxRnR8yM/jK1Ml8wOy/fpsA+mMDde5lSszoD8pkN/g6+WNxcvo04/YC8zuOBGiIE:sxRnaIy/fps2Mc5lj0/5a4/MNP
TLSH
T1BD62CA1666349D7BCCDBD20DFA45BF93D6F5157392901E44AAFC8A0C01E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f1421a2c7767d5b32c66598a8c428435d0e8c275af1df11cbcf654e3ea33062c
MD5 5e09ded144cc382fc27bf27745a0b5c5
SHA1 77bc9556d9747261da75bac9a6b1782efefa956a
SHA512 459a32fdc90f0d89746296995c194d43ff51c7c2475f438c0f165d2c32c6e4a913894ae16c1fda9cf1e9f35a2a3fbd0a36f644a5e2e035bfe44998130c626a62
SSDEEP 192:sxRnR8yM/jK1Ml8UQmOy/fpsA+mNDde5lSszoD8p2N/g6+WNxcvo04/YC83uOBGM:sxRnaqhy/fps2Nc5ljS/5a4/ON9
TLSH
T14862C916A534997BCCD7D209B945BF93D6F4156392901E486BFCCB0C01E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 af10bc5e11c78e3c2f4ee70e15dfb8a2d41579c6257a1f97efc18f07afacafa9
MD5 dcebecf075a208cc9240e415191baeb8
SHA1 84501254f1b33354362524e3805d849e81309ec8
SHA512 5316d6f5458ad2ecd91dd5c275ab006b9a725d7e4a0fbf355bf7b33c2e238104b4c552759440b064d441fc9b8b48c6ec15d2f27cec1e64c2a6b38f9549a83555
SSDEEP 768:j/8vrQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCQqq4rovio:j/8vrQWgQ+fB+u1ja3VqD1
TLSH
T1D9C2EC3B640CCB7E4F844EADEC29BED66DD801CF57588D5447EA890C03C67EB521A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5927218a-d217-4872-a6d6-4337147de5cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5927218a-d217-4872-a6d6-4337147de5cb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 46b9f3fa01034aa89177715daf189c2ae9de8ee2297ca46e58f02eb703e5a412
MD5 7013ec175bde828f62002296bc01360f
SHA1 274f3778175e5cdcd2769dfc1c57e0dea79c385b
SHA512 24e8bf68e326299dc23aeec087e182e04dad750fcf92d395e13188ef2b074595d0c97b748c15cdcd37afa6ad0dcff0b1aa3dbbb53a105fbff7de4b76ff077e49
SSDEEP 768:Xj+9p3ZW3GJnsp8+p3bd66j+4BRv86aLIWmMjo+:a9p3HK8+p3Z6n4ycH+
TLSH
T1FBF2AE72E8999D679CE5C648B2477783AFB411A386C01ED4D9DC7F4E01CB2AD530B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 41cc29b627fc11ead6de9202e350b5dd72ba3e747fce2c7f51a3d5f8fa96b20e
MD5 626059af22ed6966e5ebc4baaa23c944
SHA1 d71249116e4676fbd98569f9202295de1b1794da
SHA512 e47c6fec475b2c6d75712189d1b3e8995e4b4cfd55965dfb89df576472037f8f576a70cc3a0770df3b77229543cf51632ca48d37042becfc676aa0baa580cd82
SSDEEP 768:vF3j+9s3lwg1WwGJ0p8+p3bd66j+4BRv86aLIWmMjo+:Y9s3f8+p3Z6n4ycH+
TLSH
T1B3135BF298C78976DCED8747A33E2E429EBCC153B5801D94B7D86A0DCD861BFD206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e80e44b59ac847fe414587feeec254f55fc997c5789f9946d308143e6a550752
MD5 06ca7d7d9f47122a6d0a5853f0947618
SHA1 ef805a9abf8c2d0a508fcda543493baab8f45900
SHA512 5325c334eedb267d342a8aaad7da7923ed59b91940c27bbe7c2460ebcb4732c602cf323c1156e91f38da9ac348d02db28f6b1dcf5b82f22398e9fe7fe19d7ca1
SSDEEP 768:Yj+9+3pW7GJnip8+p3bd66j+4BRv86aLIWmMjo+:H9+3D88+p3Z6n4ycH+
TLSH
T17FF2AE72E8999D679CE5C648B2477783AFB411A386C01ED4D9DC7F4E01CB2AD530B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 715407b5800e37ba39a5a62a37db1691329e4942611a2e896dde4bd57136f20a
MD5 2c0c3d0d9749c68e4298b3a11ce42081
SHA1 6df5d8ea31bfddeb45ca1287cb392ad9d2e7939b
SHA512 1bc0e1da59cc96e8c18e4d7f4a76344908efa12aaad1af89371a208f27bb140e1b69dab09fa981eaca31f4d6d43ab14e9ed5e4e66215e13cfc8d2bb1886a8513
SSDEEP 768:Vj+9p3IW3GJnsp8+p3bd66j+4BRv86aLIWmMjo+:g9p3MK8+p3Z6n4ycH+
TLSH
T179F2AE72E8999D679CE5C688B2477783AFB411A386C01ED4D9DC7F4D01CB2AD530B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 2b8476f2d0a7cdd411d7410a06ea13e56c02175a9843940d2ba8960cdc51e99d
MD5 41fa8b955d43f956ab3999df184e80eb
SHA1 58296e9ede7440c54954ed552cd65247392ce97c
SHA512 8fc8b02c720d1cd78c40bb5b3b184630f02f2e5dcee685366eb96255b9d27619fbba7f037a10124453811c2b4b0dad54e66a6484b6bee323ea6cb6a013ad6679
SSDEEP 768:vFOj+9m3mwg1WYGJfp8+p3bd66j+4BRv86aLIWmMjo+:r9m3B8+p3Z6n4ycH+
TLSH
T16F135BF298C78976DCDD8747A33E2E429EBCC153B5801D94B7D86A0DCD861BFD206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 5a4dd2985fb212762e68a4c389824652167d17e98a0e3cf29b065f3e3bf9fb84
MD5 ef7b5bc1a7c19367114473742abb1d45
SHA1 902c162d8713b2bd6d83a5309267a02a6846d4dd
SHA512 bce6485678292283a770b6b9a6eb46eefa76e2b280408bd7d31de4c0ef9253a79791b922206e2f96cd44e0b07b2641b9a5e84b2c62ea2e02c36cd1c1dc7638a9
SSDEEP 768:vF+j+9M3lwg1WiGJBp8+p3bd66j+4BRv86aLIWmMjo+:H9M3I8+p3Z6n4ycH+
TLSH
T1EF135BF298C78976DCDD8747A33E2E429EBCC153B5801D94B7D86A0DCD861BFD206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8f84cbc513b95a9980906530545f77b38053bebe64f0014957080f3e8e04573c
MD5 10534279ef40707b7082cfcca834dc3b
SHA1 81274c0972ae1bdcc8225f2110ad5e54acfb4114
SHA512 e4647d11fd57202388a168aba2eff70cdf45a95ae030876d2769096987a0b25cca6a045442960b8b3f0a9a1d999f60e1a0e64a32659d9be95d139d2f19b4a7a0
SSDEEP 768:Irv+4UNbdD3jc4Np8+p3bd66j+4BRv86aLIi72bwCl1:Ibsbp35L8+p3Z6n4yZ0ww
TLSH
T1D203CE73F8A899739CE6C644B2467A433FF861A396C10EC4D4DD2B4E419B19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66ce4b65-333c-42ee-b0c8-c07a29e59e8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\66ce4b65-333c-42ee-b0c8-c07a29e59e8c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

AUG2009_d3dx9_42_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXD8AE.tmp\AUG2009_d3dx9_42_x86.inf
Size 1KB
SHA256 5989dc367a8f84815bcfa1c46ff756527c6250c62973220d1af354b70027eaf2
MD5 dff48361a5cb0dea034dc6f16de99477
SHA1 afa417acf7e9da37923255a623ef34c7f6446c80
SHA512 750b69eee07e7d6e7fbdba722e2e1ce377729dca5fe52b4d57d23dd2b80b28b3af8403aa43c469a5042ad35eb09ba4dbefc40a014a137e1b5d87e0f2de203856
TLSH
T1253146DD8C02F4307AA4B6B27B9F374F2727450BEA61310977C90990ABB3351115D2F8
MD5 SHA1 SHA512 TLSH

Submit Download

d3dx9_31.dll

Path C:\Users\Admin\AppData\Local\Temp\DXD8AE.tmp\d3dx9_31.dll
Size 2.3MB
SHA256 e2065619fe6eb0034833b1dc0369deb4a6edc3110e38a1132eeafcf430c578a5
MD5 797e24743937d67d69f28f2cf5052ee8
SHA1 7d39afbf94675487a9ff7e41d2dbb8daedf7ad00
SHA512 8804d0d95688a932c7bf7e1a023179de8df3a5436e356b36d803cb9781f3a378adb9fe69d03b28362755b808cbeb2cc718ab920672270de0b954996996328f5e
SSDEEP 49152:9UIXU56pbC6gU8DJpHJLfdrKF322i0aGHhBoMWMNPbSVjeZgxl:OsU56hMU8DJpHJLfdrKF32R0aOBoMWcU
TLSH
T130B59D51E6968230CCE312B4015E33F9217C8B7117B026CF96542ED9EEF26E59F7829B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_42.dll

Path C:\Users\Admin\AppData\Local\Temp\DXD8AE.tmp\d3dx9_42.dll
Size 1.8MB
SHA256 f8b9cfab7fffbc8f98e41aa439d72921dc180634a1febca2a9d41a0df35d3472
MD5 c6a44fc3cf2f5801561804272217b14d
SHA1 a173e7007e0f522d47eb97068df0ca43563b22bc
SHA512 2371844bc86cdce2d1933625b921b982c4d1b84a39698b51180b09a2d45732407d721fa01d294ca92a88777607a1bb00283f6bcdd4231137a388216d0b09dd5a
SSDEEP 49152:E8kmV+RIMtAO1r5EHT7SPy/OsXEKWtElmrAtmguohFR:E8k8+RIMtAO1r5EHT7SPy/XXtlmrAAgd
TLSH
T198958D91D66B0174E8E29070510D72F0609C8632976127CFAA681FD9AFB87E1DFF42E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxdllreg_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXD8AE.tmp\dxdllreg_x86.inf
Size 724B
SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
MD5 8272579b6d88f2ee435aeea19ec7603d
SHA1 6d141721b4b3a50612b4068670d9d10c1a08b4ac
SHA512 9f1311803db1607e079b037f49d8643daa43b59ce6eafb173b18d5a40239a5515091c92b244ffe9cfef2da20530fb15deb6cf5937633b434c3262e765d5a3b21
TLSH
T15A014094CC039474B689F1B2B76B774F3AEB0917E9112308B3CD04499F6361021AD1BD
MD5 SHA1 SHA512 TLSH

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DXD8AE.tmp\dxupdate.dll
Size 169KB
SHA256 4910d5e9970407c6f4db57c04a07655f01ef00bbf213e1e71a5bd9bc4a6a1c20
MD5 f851454a783aed04c3fae0ca3552fb29
SHA1 357907f085ba99a612dadd307a5d9f84eebd63fa
SHA512 2d66577cf76c6ff6ff6e3e410748af5db2801c4d370ec8865339e97235976629405a7c56ecc6e912c6307c3442a88fcc056c4c38e218d03cc4b11d045265890a
SSDEEP 3072:ut6LK22wxi/9SXBLeqoNWMPCydN0BMz/xYHWl7LdOIlkhuGzyZT25FnS+NKz:8wxaMAHUMPCydN0Bu/OHW5LdrCQGOZm+
TLSH
T1E4046C2DBB80D471C4E200F9650C2AB16BFE99B6072A80D7E3501BD9E8A57C5E53D39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DXD8AE.tmp\dxupdate.inf
Size 11KB
SHA256 fa2880f64c17254de87dd088261f9f25e7552551c6360857ac6682ffab58dadf
MD5 b741088e800dcefccce8444d8db84c62
SHA1 23447e13185645454a7b0c0e83ac8949e8ba339c
SHA512 991bd0efd2aae72b8ef73bb26418de65cfb604c0e09560470048af34d192cc4b1c25faf951d1b3dc2897c3aad0c2c32da965f57a65691b51e741f6d323219cd5
SSDEEP 192:iXw6TiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJKjV6LSb:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDl
TLSH
T1D8428976B9168659F40EB3A01AAF3EC65E3B008FB43124CD79EF11B0572E1AD62FE454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oct2006_d3dx9_31_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DXD8AE.tmp\oct2006_d3dx9_31_x86.inf
Size 1KB
SHA256 a1c61096019a6ae1a9f31e3fe67aa2bb7e9e451967959d7088344f3f20ab572e
MD5 8f7aa1f0f2389f3cac574652f5d6672d
SHA1 921f2161cf46c6314a330ff52c83f8a3f1058f0d
SHA512 a85c03ccaa27adf3c75287529f18e84f526cf91785e0f4281db0eb86feba78522603e21def19bd2a33e03ceaedd9109b8af1dbda4a3fe93fe6eb95366b6df747
TLSH
T17C416AD98802D5347698B2B2B79F378F5B3B451BED52214972C60980BFB3361224D2FC
MD5 SHA1 SHA512 TLSH

Submit Download

Dialer.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\Dialer.dll
Size 3KB
SHA256 3baecec709ffec8676668f67454d594f5a66771f8b3f4e153d0da9bb31e367f9
MD5 0b47f20abb0c1160d6ec2866e2f834c2
SHA1 a04c89619e5775ccfe33ac64a433b2c8d192a14e
SHA512 7e31405ff815fe9abb57af0c07fd63f2b6c152026729d0eb0eb3a214a9e8cf64d48101571180876af0dcdc65636fd4466da994151679b98f6f7eb04bfab32031
TLSH
T1FF7110B503A451F1E62603337CD709CA64B56D100BF1810CDAD80F08B4AB5C2CDB97A1
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\LangDLL.dll
Size 5KB
SHA256 b15b1fc88d1b56088b2d3738d76772a91fa186a316a3e0a154358820d0fb9005
MD5 410a586735f45164c86bda363ad8446f
SHA1 a68d18a8c72ffaa8f8d9ed9f76ea9b0ed397821b
SHA512 d12083f67df132b2be57c202601a0cf82dba4c234910e780d2723aac14ae68407b824405b04737b55104bc97750550a3271a944d647661b067ce134075e6cc2a
SSDEEP 48:aYZT4WeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8m+ofYZVSA:JCWGSxamjHNDuWRWBBWvmuV
TLSH
T187B18630F7C088F6C691453B249336C7AA52B9143708445FCB6B219A2615EEBEF3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\NSISdl.dll
Size 18KB
SHA256 e203bd2042cc75d229cfa18d2862c4c90754b8de1361fd4b65aef808076f5a27
MD5 02d7f5e5dd1512bee2343a21d9970eba
SHA1 382abcdc03c3a0990d4482427bff757a8c5b8796
SHA512 681908f5c9075e5b18862ac3a52e07c8c1e0a7412c54ee6d5a765f72ab7d7d19e3b67fe9ef59279cfb0b77e042277e7b06a6bec788198977415407d520340706
SSDEEP 384:Hzdp+8vYqh+KhpR3+OftfWdrierxIwAWguQhxtzUl2x5fTz:HzdhvYqh+KNNVSierywAWTwOlYtTz
TLSH
T15D825A50BE9280F1D3BA413138A33B3F17B95DB11A980083C7E74ACDADB9147D679A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OCSetupHlp.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\OCSetupHlp.dll
Size 750KB
SHA256 29df920c2323cd740a4f8b47f0b8abe980c10bb7783afc350e6e2da01f5816c0
MD5 e1a2128eeccedc5751068eed19b40d3b
SHA1 9a80e0c2dda638ebbf4a87d62a8a418c5786d27b
SHA512 2887a0479496a472a1b744ffa7eea3bb032f4c37f41a9c27ecfcc388cc2e178b6b1386836cebc1bc612a0a0efc77f9f216fce69922ebd7684b825c00b593a6e9
SSDEEP 12288:LFXFW8B4c+zFzNBLMALXuepJHYGcveHJUfj5PCTX1CAsA1VyOP:L9FTWzFzNBLMALXH2eHJUfFqTX1CAo6
TLSH
T105F49E1377E0C035F1BE2630A63A977599BABD715839D94FA3C4595E0E30AC1EA38723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PxCpyA64.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\PxCpyA64.exe
Size 66KB
SHA256 fbaa0fd8dae9bde80bfe497dca28c6fc9174c14b12ab93e3942fffa04e3db3cf
MD5 08d51e037f487f9ca9fd0b0388f4c15a
SHA1 67188d670673a5e9185616923d1b1a8aa22ad8bc
SHA512 a40bb551fa8a705a5ac2bdc02a17ebba1c6c70f9ffce38c668b07bc538dc4461658b0bf220e26aa1833f624009f417f05c44aa0ff81af59a5ada4f97dd99013d
SSDEEP 1536:nBueoX5ZxIfZu3B9M8oLb8tg+xoEoXJ9hDkGO0mIOT:nBueo5PBWLh+xoxXJ9hwGKT
TLSH
T195634AD3B24400BAD4BAC278C5E26B42E7B3B01417B193CF5770899A5F137D42A7EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

px.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\px.dll
Size 682KB
SHA256 309a40e28271eee4e41cdb5cd1f83c0087702d42f9fc3a87d62f9f30dd53d68d
MD5 dbb66b386c194a58e29e49d7ebbebe65
SHA1 78dced6be8870938a2c8fefb1b5b884159e5fb21
SHA512 6a49783c86f2bdb6cb522f0e53a6e653eccb89b1a2d0d800bfae499d304cad173f621d9dad7765a13848a1e8bc4da355d94fc1a4bbf2beb5c4d999ea79257764
SSDEEP 12288:YhT+GE8INwK4VhupUoh/o/mKg8+ncSFL1T5iU2DF6mHmzazrr32ceMtw/g+CB:YhSXjz8hupUotimPcSFLwjeMtw/g+CB
TLSH
T163E4BF50B1D28072E45E02B0903F57B65FB763361325A9D7D7B4AC906E106E2BE3A36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxafs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxafs.dll
Size 130KB
SHA256 b7c5e5cdb6bf6fc01d1823b6aa1b0fef62f1e594886e2797a00a03809589c0f4
MD5 e66569100ada3821d49be51109fa111c
SHA1 da0d6e0d9073b7d384e410916ae0306e16eee23a
SHA512 981128e378ff2c286ad0aa9ca0012fc72cace283b0bbe4bb21ec7429735ef0b4438a6c6ff8dd3ac11438e25af33162f320a085223d6fcc41f5a7b060d88efb8e
SSDEEP 1536:+QfvGEOg5r766WHTPnqMtpdJn16oYvXfR8zVULjePWwxfFkEba89lb6Oe6FoHkPE:+Q2d2WzPqeaizVUcva89lbxefH4E
TLSH
T1F6D36CD633685376E0A906BD70C697416736B319CFE905C3877AD8886A5F2E48FF12C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxcpyi64.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxcpyi64.exe
Size 120KB
SHA256 1c0e698d620f3703f940baccbfecd883b5f5e46d2436f0c17cb0c6c99155a4ec
MD5 50a76d2d5e4be94556326c4bf748c758
SHA1 dd2188e2fde11b75fa73003bf7502515182d4c88
SHA512 f60decd858d2dce3d7d57f53e7a2f7f1090d2d5fffbb1abcfd37c67718ecc2c92bfd45a208a2ec93efa5e8fa9c33f29e84bc52891998195dda237d6f1ea971a0
SSDEEP 1536:e8n6dVhjfCAm1tHcA3ep2Y3Bfzr6jsi6bJKRTV81Pt+yJBiK2Mb0mIc:4O/OQY3BfzHKRQF+yJBiK2MR
TLSH
T109C3C5867B47A9BBC10F033241E74F6463E1E2212B63CB3E556167392F4B38B5B166E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxdrv.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxdrv.dll
Size 558KB
SHA256 7c9449c2e774087305a28117e47fa48bbf33638144e9694f20d20fb15065ac9f
MD5 8f6f3aa814143099b431744b16845664
SHA1 67f518591a1cbb954a031cc7421faa1aeb25651a
SHA512 5fdd908862dcabc37a794d0f7fe134e6df9f34d0e52cc69a535c37872a4f2edb44e2448654b3832a11f41fd57be36f1ad0f863603d1f268f99c6180a3a48bcb5
SSDEEP 1536:PdT7plr0Xh+r3xZMmourvvsjI9vW/dy1HW6Hfuj+aUfQe95QV88YfOr1oE0mIQ:PkQMmouQjI9v8NMi7UfQe95FOF
TLSH
T12EC447AE57C05EEBC434C234F5EB1770B6B2CC106726CB0B9288A517B52533DADD6B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxhpinst.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxhpinst.exe
Size 70KB
SHA256 8ca37574a79fffe781375955362eca8ba4511593dce6672590be8c42a775f146
MD5 d2728a10ccd2a675638b016d47b1c254
SHA1 9311a83a94d7b5694109e0e9694eada76765caa1
SHA512 a6a31019f560b69935f5873fabe192b5899785544b9cf3841c1a846740edc56b3ba5f396d43d104f51acfd59faa97121f104abf7e4ac4a3fef5539cbd85a9759
SSDEEP 768:CGybMX4w3YpquiJTIG5bEJTRqvHKXWDFuNaTxhcVcvfLJL+Hbmpmm:C/bdqFJTFWJTSLDgQ3ccfLJ0mIm
TLSH
T185637D0B2DA34073E8820A7187E58AD61FFDAE1337D2B27FCF4085462DE16E85E255B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxinsa64.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxinsa64.exe
Size 66KB
SHA256 573d87feddc84eba6b3450bf00ad7ddf498ca99cc8809359fa9bb60c7ac76f68
MD5 6d3630b7f27b3643fde05d1088f84f2f
SHA1 be742991eac9c6c8b0674c4be1fbddd10f7b9d37
SHA512 48a218a270357d3513596d92410bc865ef51c3bda6bfe5f53251e2ca3a5ff6edb31d722ee50d6b85d4e3bc7094b956180bed88575eac226236b55d81e0528ec1
SSDEEP 1536:adA8lmCJH8IeVf1jB8QgWHLhmAe6hnMJ0mIE:adAOJcnBZHLhmAe6hnMv
TLSH
T112634BC3B34100BAD4A78238C5E26B52EBB3B41823B193CF477089565F937D86A7DB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxinsi64.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxinsi64.exe
Size 123KB
SHA256 df83d7cb34c59e1406fb5bf1edd083f8bca649db97979c6debc3d3ab0e36b980
MD5 94f95be2a44c8291132d314582f141f8
SHA1 d5bb1a7519221964497560b579bb5c1f1ab30aef
SHA512 4a726c8431d9722f1213659e3cf150cda5a0850bb874f0f7c4c280f6805a122d14882531e06b11cbcd36d8a9a741a67f12b46dd02933d00c65ad1e255e1ca1dc
SSDEEP 1536:NdSxj9fQCZDQhkC0D0o8dzaMmwNU94mep7g8C5aqdio2yzy2ko0mIx:NafQjOCZwNwa41AYqdixyzQT
TLSH
T164C3A4827B43AABBC10F033181E74F2457E1E2616B638B2E5561677D2F4B38B5B166F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxmas.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxmas.dll
Size 214KB
SHA256 6cc2fc325653f7fc8725808270792921423c7dffba4f4e5bfdf5d396f89c2d97
MD5 746833260d2123ebb46ff44afcb8103c
SHA1 54275329dbc8caafb8a4a61198cdaa0986756ee3
SHA512 a2a577a39ece8b3b1407b528b17a3088179bc5eec3e1a9b14270529f82f6175d9c950da957bf6d707c968e4395eb55464e08778bb887b2871351f5655507252b
SSDEEP 3072:08Vn25ZaElZMuUK1GfnNdspMfRUAist3AcEp5QhgtybXk0P:08VtElZMu54fnHshyuUbU0P
TLSH
T173249D00B582C0B2E41F0578827BE76A5B3E78976B29DDD7DFC06F488D106D0FA76686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxsetup.exe
Size 70KB
SHA256 0f445c4b76bc309a940d5f4ba615bef1dcefbc0d160f3a8d06e0038160d9b4af
MD5 4ee24c7fd67b098431c951db7686bd19
SHA1 5b14bed150ea0bf619b938ce94b9f32b02a6aadc
SHA512 7853bcd7482b85ab362935060506a1b44779946e9428838a1c95cc54fcbf94058ed9c2101b5c4e3114ed125b88692ed694b394ff94ecc8d88c39b57bb21f08f8
SSDEEP 768:hAU7HRAGh50RWvgd01Q1xBovT0/TYJ1BJ5dylihjtJaQ6GUfcY00YeCGL+Hbmpmx:hA11u+BovTcYJt57jtJjqcYLLCG0mIx
TLSH
T175635B0B7D5B4033EC814A3146E54BE66FFEA9333AD2A5AFDF5048462CD02EC56364B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxsfs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxsfs.dll
Size 2.0MB
SHA256 780e084efbe74ac28d8d91dfff1e3bef97ebda3c54c7bd5c8fbbed128f21ea7b
MD5 e5ae8bd7d28eb4bf87f9c56daa6d3e3a
SHA1 61b841bdc9006953d504c137d5d7d8e8602fb31b
SHA512 4930e9e128f9e8b55657752b5a8b1aa82c252dbae6ed0fc5d3112e5be85f30e6381e514e668ce5eb5dba8177583151d89707410b102d4c6466424682bcbbf0ad
SSDEEP 49152:gAKqkC75TGAlzA2LwytkLmImxcIqtSz3L8Zhutsgnypk16PTT7Xx+JoAwx1DipMO:gyAA4ZS0c
TLSH
T1AEA59F92AFD5C176CA4FC2F6845DA73D8966C281532D8FE3E1542E4B283B2D27C3711A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxwave.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxwave.dll
Size 430KB
SHA256 a90d09923443c749266f65797176d70235854b9157a023362701c0d8477b78f3
MD5 24fa4bccc5ac82f5471abd0e3c9cb878
SHA1 9d9caf552519395fc76c7b756532032686827586
SHA512 5e05daf7eb1de0baad166758304a5450750a876d4f7a521215aad279a00dfbc34a96299389dc2f523b54a73894433ce35480f559ed04d10ccbb14b1c75111914
SSDEEP 12288:oOiHxqn65BYQdnYIp1sZtgeUghgWqTX2XWayKt1:IYYxYN+mGay+1
TLSH
T1C094CF02FAC3C4F1C4ED08B4109B57375A352D4A1726D9D7EBD88D67AE223E06B76389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxwma.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\pxwma.dll
Size 58KB
SHA256 4f69dbbad8775b22d328968461c0c7ae11fe902bb949e178bf1878009705d0ed
MD5 cbaa54ae75a0b8430e6bb65c72c7683d
SHA1 5fdead1d32a164426c623f5b871bea3d547801f5
SHA512 18b51a143af0d7d279c961143c4e3b5a42d439f59d7cd495dda174e062f3b9981363c021e474fe7901ff4651a174883f748ca98766a12f08606378cca3c4f504
SSDEEP 768:BeL4jjzn8vtTFfT1rML5avPC4BBL7Z1sozfaB9jXVy8L+Hbmpmr:Mwbwxf05aS44o2B9j080mIr
TLSH
T1F1433A092E834173E4564E3092E5C6D14FBEBD033ED2A12FEF39015A5EA13C45A79B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vxblock.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\PrimoRedist\vxblock.dll
Size 98KB
SHA256 ffa5a535493c11595b1edea75e67ddd6e26e587a27d36e06a499acfa0e0a002b
MD5 ba8559b1de9e06e1ebc5b41138839fff
SHA1 b2eb5557c01a3731adc3e0539b9c9ba32329f35a
SHA512 3314838685b476cdde9f9eb5be4881b29494b04b3f93a544736a2cbe0716c03cdf7f38fa14cf3e68844495a5452dd00ac1ea335fdd030556dde4715826d50fd8
SSDEEP 1536:TNR91XQvkXJLVf5JcdK7MCNItDiVEhm2Z42kB2tv8C0mIn:h1XIen2Sn2kktvu
TLSH
T117A37D1538A3C0B7E4450D3682A6D6826FBE68037FE690DFFF9206891DD23C476762A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\install.ini
Size 26B
SHA256 bdc6fb93206c1e7a590f2d4e97d0dab7d3badaf8b4e1a7b8487e9cf59f05eddc
MD5 385081d5feee87a4ed1a6e5dcee85f36
SHA1 8517162855b477e5498e95ff2e82584ef06d5c6d
SHA512 52bcb1cdae8abbe4b14ff85b57e03426d61e5cb25b1535a827af526ec66c00ae0a327b187cd10279cf18c379c912d3e478ef9966bb497a8b626824fe32d1093f
MD5 SHA1 SHA512

Submit Download

install.ini

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\install.ini
Size 1KB
SHA256 d7375f49642766cc33d7562dad0811152fa2fdba8f8f52b6c29fbab45a4d4b72
MD5 6840cad4363ae875cc93155816283b71
SHA1 86042b2d39fbcd305e388fe8b1aed64545b8b527
SHA512 fbdf1090c10fccc084eb8c8dcebb64ca3bf5fbfaf951d567d3d86169516fe8783762ea3402d75328fc3d7bf949e970c9813223842cf8e6b86fdaee8fb280a257
TLSH
T1F93139816604B5DE20EF2818B0EEAD4C448E58600227BE127F94CFD59ECBD3B11E6F95
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\modern-wizard.bmp
Size 150KB
SHA256 7ae875cfcb6e3b1f4a06460fbda99d8014dc4674ee256b0b79ec656777c7e292
MD5 2d63e33fa1cf672338a22c88fa45e6a0
SHA1 86c510009d6c71d05eb2707fe6a10039df525192
SHA512 d42a7401c1d0d77d517d2f8086286bd6cf487cf5400cd8b8d720bcaf15149727751677f444fd9a8e340072deabad51347956894c1c034dd81df793b3b8087252
SSDEEP 1536:Q8PkKxrHvI+HzF+xBIrVWDWca1dE0/UTH7P2WmPW+:Q8lv8MADDJ+Wm
TLSH
T1A5E3C470F599ECB2CA8017727569B92001279DE17DBDC34D344FB92897FB78128CDA89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\nsDialogs.dll
Size 9KB
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
TLSH
T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
TLSH
T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_bind.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\nsis_bind.dll
Size 3KB
SHA256 8a6f33d6e40000379923b36cb142c1d4ccbab38d23fd65b14776a322e790f6ff
MD5 e9e271612e858698a5aa6f6350028fc6
SHA1 dd31abc5ff5acb0c0fa2170bd5ddc42de25d9838
SHA512 d97c4230d973956b9b13f14216bb037583a26283869d1a5a4a86b3c97af938c865f189d92b13c3ced7f2856c651c1e2aaaae69aa1e79e3e8ab7046ba98d858bf
TLSH
T14C71E03776B08A73D0098777A5E294A6B09B9B7003D6514DCF0749053216A9FAF6E783
MD5 SHA1 SHA512 TLSH

Submit Download

nsis_winamp.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqD058.tmp\nsis_winamp.dll
Size 4KB
SHA256 5946278545abbd0b0f5188752fe095e200c85abe0783632a00726d090c0753ec
MD5 1e1ded1cf1c69852f2074693459fb3b5
SHA1 81b165cae4d38a98760131989fdd8aed2c918679
SHA512 a6f9a43d4432658c3504629e9209ad350af69eff542d139e0ccfe0dbf8662f15034edd3cf8b56d606a740b66c8221cafad999088a4e64a4c9c9fb47793a19f96
SSDEEP 48:SEdAWvTa5HlE1m198EqtjbglT68HY06mzWB+wUKCmMpzm7n4/ZS9:LA2a5Fcm198EqtjMlv47mzWBVgaj4/w
TLSH
T13191B872FF6004B1E2D11EB135C139B259F499316528590BD6C61685342578AFCBE63B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gen_ml.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini
Size 920B
SHA256 8e526f60fcb0ba44d1b517f5de15236c5951b10b41f0d6f94375448e18e6510e
MD5 a800453c6b7083653700a01e02b21bfc
SHA1 3fcf0179c0ec55965809b16ffc29c2685b590555
SHA512 9096f36462ddbd259de5b052a97361620c24cd3b0465a85847e9705376a4e0e694796833e7c96a5802d9f46487827fc6889981e0f157040b56054e6fef602aba
TLSH
T14C11916018A598622D717EC0E2F789C980E4CFE1711DB78CAF7984E10CA0F564E2870F
MD5 SHA1 SHA512 TLSH

Submit Download

gen_ml.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\gen_ml.ini
Size 931B
SHA256 4e8fcb5f7d020cf65af9dd01f253e29586dd3ac5ef4a6fb610914b3bac8dcd34
MD5 80e0f9aefaa508a20ca085e7e85e72f0
SHA1 ae85b09cd26e7248e439bfcb9769d6ff85660f72
SHA512 123f25c122ee26d3502604aad91d7eefca2ce926b71f07981f8db8c58b9af9a2ceb6b89881ea7b2bd7957eb6903f2e7b9323b9d81c8b8be88971fec7f4c9d6e8
TLSH
T1D011916018A598662D717EC0E2F789C980E4DFE1711DB78CEF7A84E10CA0F564E2870F
MD5 SHA1 SHA512 TLSH

Submit Download

met825B.vmd

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\met825B.vmd
Size 103B
SHA256 ec58f79fffd619862667c1a7644ad34f76c4623f2b7857a5341640c893d4de18
MD5 eebb8da8e062bd685542bffe0bb94e74
SHA1 75faddb50b83eae36988c1e3eab075fe8d5a3415
SHA512 8a23a32b28a558e9a5d3a615d4412b768af8948f132b09e97ca121471db46693a4d05ce4df64f1ad951749d65c4d19000e08f7870d99eef9b90b62d2864f1bfa
TLSH
T1E3B012037CC190D51404FF0084F0020024FC0F79B0410DC13CC8E9000E5870F6C76B32
MD5 SHA1 SHA512 TLSH

Submit Download

met921E.vmd

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\met921E.vmd
Size 174B
SHA256 ee730918e759544d7d087fe0b2e0aee12145ec36ecd4f4aced4336d85503a124
MD5 9936bebab9c4e0e2aac7dceffc42dbac
SHA1 c1d2b8ceed49c904db7f174e06cc4e8ef851a87b
SHA512 16a5da57970c1d9b0e00bd8ac21ad53260b48db7b7b8bdb1953c625e8b6a9a132afa53fcb835163b73fe6a5dae40aa5ddffda9a11f42e8942c07b180363f2ff0
TLSH
T1E1C04C07BDC560D51448FED06DD0520215EC0B79E04279D0F9C4F5451D9862F1C76A75
MD5 SHA1 SHA512 TLSH

Submit Download

met922D.vmd

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\met922D.vmd
Size 125B
SHA256 84f5b0b1ecb3612db2d369b18c758cd0de8ad31b371943343fc5b776092fceae
MD5 d39c2a872b313f71c47f6bef8a44b425
SHA1 fb0b1e55ba114f0ec0856cec44934c692690e487
SHA512 b21b234843480ade18abbfc1dcae5edd536def427bfbd39d0c384e439c2b0692d1654703e32b4648ffb6f719fc1236edbc588bffd242ea7792fbb41b82d65b7a
TLSH
T115B092037CC290C62414FE0088E1120018AC0F3AA0424CC03CC8E9812E94B2F1C7AB72
MD5 SHA1 SHA512 TLSH

Submit Download

metA1F0.vmd

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\metA1F0.vmd
Size 126B
SHA256 6217223a02d019b85e566e2804ae6ae4dd3643c95578279a27909c9eedbdb961
MD5 2cdaffaec77db6248825896e5c424893
SHA1 fc8df8ddc7811bfcf8f426dce0316c7eb6366b69
SHA512 387e12cab715c8d9530b21725808c91bface84949f03d17312890464ec53ffbd79ce3a83685e0897e208a2e26e85c8296b848d91b0677df1bac446c229cfe05e
TLSH
T185B092037CC190C62808FE2088D1020014EC0F39A042ACD07CC8E9402E9462F1CB2A72
MD5 SHA1 SHA512 TLSH

Submit Download

metB1C2.vmd

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\metB1C2.vmd
Size 116B
SHA256 a1defd5d6eed464399dc2a0f2c07d1f3a10e45963899ff4b824f748b690362d1
MD5 c83239613245411ebd5416fe69629720
SHA1 e0b7924b12a88958fb9e18d5d8bdf1ed9ab84337
SHA512 f3d264e25bbceb2c58d741bfa16c35213df9a629ac59ef9a275c2ec60320b6580c6f1468627e966e14bc27695d9e157ce264a6259a4f78995e7fbe304d5e4528
TLSH
T12AB0920B7CC084C92404FE5088E0420014AC0F79A0451ED07DC8E9410E94A2F1CB2A32
MD5 SHA1 SHA512 TLSH

Submit Download

metC194.vmd

Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\ml\metC194.vmd
Size 127B
SHA256 cd160e25ecd10aeada7cbe1b0913b8dc8098d009e43b9a549765e0250531c81b
MD5 252e14c85c8b8288fda93614891308eb
SHA1 636d352077cab476c805fac2bc4ff58d83a14b99
SHA512 7c5654607006bd1300874257f9c452b7e5aeaf90e4815ccfa0f195988f7d51dfb8dce68c71d15649242f8d05f970d67101917c4ddeef12ea05d39fa8aa1f293b
TLSH
T1F5B092037CD290D52414FE4088E1520019EC0FBAE0426DC0BCC8E9021E94B2F1C7AB72
MD5 SHA1 SHA512 TLSH

Submit Download

Winamp.q1

Path C:\Users\Admin\AppData\Roaming\Winamp\Winamp.q1
Size 4KB
SHA256 58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8
MD5 d24f1b829d1bd197e157b12d19c220e9
SHA1 555274f63e5b6ddbbd548179754fd0b2cbddf888
SHA512 55c5c6bc1c466eebde84b98e024d774711bc1f1e32b28842d77eaea93dc030878e74012ea48179925313490b7c77d07383213ebb63d691228d2333e4217b33fc
SSDEEP 12:jzgvCixuJwVy/R+g/0N4o75xVWK7WInDWjCDO4nn:j+7HVSLsVW0Tiqnn
TLSH
T154A15C90BB327B4BE88D1B3406B0A5CA9E216C285A66856425B3A54F89BD3845475F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 56B
SHA256 85b420b1faf6d7e70567eaf2b01eac6dcb78e02e2375956c317c8e98d6cbbad1
MD5 69c56e3d98acc64fd35ec6b2916db596
SHA1 cc9d47c9fed45c892578c04e080696ffc2ac0eab
SHA512 234f0db4c217469ec585903915758c890b0040a97735574caa1d73cde68c0fe239b58ce60720a16ee136c14ef0977af894167d12488af5993cd7514d9d79ce8f
TLSH
T1AE9002128310046F2014550F207BE451435C00360F28DCC78112896B789C98A933462B
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 144B
SHA256 28f435ffbc2590fd44df0cd3aa469e701ab1ae2caf658b60d8f05b85c4114bd9
MD5 234454a611f12a1e7455fa28eb68cff9
SHA1 d57de1b5c8f665693d74b9cbf94512024bda0539
SHA512 7fc39db78c5f058bb96ac3687d6d868a860d5027ed5a65340f3dcbbcca1efea64cd1cd9293c38c4c00831d052f338888936257a4899e7426f5b7f68227f547ba
TLSH
T13BC08C0CC228242B1034149E1032A4A802ACC2BA2F28F9428252B8972CCD81B4371235
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 302B
SHA256 113529fc02f2154e322b7abff3fab2f0d227e57750e1184505e74d9bc9bcd2c8
MD5 4005dd252f6fe8b29f193ca12d483195
SHA1 548bc760a59ec35492110394bd04fdaaad9cdc54
SHA512 a31829ee4dd519fa4891c8521a34531fae0f328324ba78c1c77d2dbf0d78947286bf800c2f97bf5d2b4204ff42476244538501ddb0f36804d86b6a386f7ec91e
TLSH
T1D8E0CD08C278958F00341C7F677960E55168DA743FB5F9518342569B7CCDD4E5255235
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 314B
SHA256 e15cd67964a7fb657e4cc2509165c081e8f91f451a3ecec381d86408da12641b
MD5 d0715de77585e6ac36004d6b4f8f35fb
SHA1 e5ea1d2ab1643382f9f274f52e71c0a5dabfb99a
SHA512 e7b7b027408d4fc4a7f1696d39e3711a3d28d8bb66614af0642184367f616596bc9711f8fb2aae170b92a059bb903a378ff65c346dbc4fee31bd5630ea7141c1
TLSH
T1CFE07D08D238A08F00342C7F777964E540A8DAB43FB5FA018302529B7CCDC4E1211230
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 651B
SHA256 4cb086bde7270f0884ebcaec3badd5a777efffe25237836aa902e2a086d7f5e7
MD5 f4bc2262046fbcd3578b5fd133f623e1
SHA1 6a2726da5e36c0511a5fa7564738fe049f364b34
SHA512 03a2e8b0aeaec12677204380b92555ed0aae0079a3fbbabb05fbf9ea56b9d146a943b502e996305a5352e24c751601d77aabd56e0be27974bb3064a1483a6045
TLSH
T1E8F02309C254930F5039597BD3F435B180945B7D2778F152874349E3BC8D88583225B1
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 3KB
SHA256 66d7f32adf473ff96a17aee78c614b3ad81b0183072682f03cb2fbe7fa6ffe5d
MD5 57ff40e9c839ec68de34ec84bde720bb
SHA1 1e038224049553f4c3788f01443a9f604d6c6f48
SHA512 fdca2f6cf6cd8bc9337908d67c74d18197d56bb84902b0054bbdab6d71c83ce56b031641ab962c8ed031d17fcb3b4421ccfb7da74d48ea66779e346973643c61
TLSH
T13B612D0254D8DAEFC421CE44ED74BE8CCBD533A65CC2A800CF79F5A66E84D2B91172B6
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 3KB
SHA256 c8368699816bf3ae659f7579d59a8f6e90a2e71cf15208bbe1d9ef97a703d20b
MD5 2528149a85bdb87657a394a471edc6fd
SHA1 57956dc1cc05febc42de1a3d66dee3004ff16b89
SHA512 77de84d5fac212af2e967a580631a34a879c8c8de1bb56fe0869eb876367ce80769230f7ad0762e76a109ea450fdd8d4cffc82558eb7517a2a7766c5768f28c4
TLSH
T13E612E0254D8D9EFC421CE44ED74BE4CCBD533A65CC2A800CF79F5A66E84D2791172B6
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 3KB
SHA256 13ce8e8de4b9d16a5f0b912947dabfff6f56e356379dba8b832f26bf1366832e
MD5 d58862425904e68290f73a6c48181e45
SHA1 9ad8d7dc2087db9259ba57921aaab956393543fb
SHA512 183ce462aa53d7c5fedb64631658349b16ec4d0e7f0659aff7eaa5a73b3bc33b641e48dcf66265281770fbbe29178069114e876ca5db88aab483ecbe535b2aba
TLSH
T1B381200210C89ADEC864CE85ED707E5CC6D437AA8CD2A821CF7AB8779DC8D177516276
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 3KB
SHA256 51765c72908323f1dffd09873dd902af950f686cc84a21fed726aed81aceb944
MD5 c844eedd4c98a215e57601b7a05503e9
SHA1 1f54be4b47366e92d842e7704668a41e7e371b11
SHA512 f42ced29bfdb532becbce12a307e2800824f18ec74c03089b7fc1f5f8c91ec8223b498cbf7a1ca6fc656da3b27156e015a34d5d2fa7f499e5a0ac2d80d9fd840
TLSH
T17381200200C89EEAC864CE85DD707E5CC6D437BA8CD29821DF7AF8779D88C177516276
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 3KB
SHA256 200b2f86830085cfe5d1627b73f1a352ab653031cad032d95f0ce7e22b6341a8
MD5 740e8c87d2ce0b80f887f34e130d0c1f
SHA1 277da11ae8489ddbcd80ac7fd06423a02fbaecc5
SHA512 15a86fb4d9bafd90067a3c2e23c5e4c41673e392be06c61361515b4ff18b95a4ccf67642f8a14dcc826072cd0e3fd1e230c9afc3a45e4e113a00d60354d0a1fe
TLSH
T19381200210C89EEEC8A4DE84DD707E4CC6D437AA8CD29821DF7AF8769D88D1775162B6
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 3KB
SHA256 ce6f15043e73ffd1f34bcad74bbeeea33d33e3886aeab337c9a6142b9e7c3880
MD5 97fa69e7113bce82487e1c07ebf46021
SHA1 52da3b04e893982187590d93b04b75a0fab1d9ce
SHA512 a795248fd93493fd81977094a4031910e28ec088baad395ae6a62762d222f5da40f3b9dccc2db0a5748cc4769f849114f5386f7603df8efce70aabb446a515ea
TLSH
T10881310200C89EEEC8A4DE84DD707E4CC6D437AA8CD2A821DF7AF8769D88D177516276
MD5 SHA1 SHA512 TLSH

Submit Download

winamp.ini

Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
Size 3KB
SHA256 35f20a662d354f738874b3abb4f93dfb1ef93e5e19cf21b4d26fc51b6d2c6e65
MD5 c0557e8e2f1802fb726e2cbf5822c774
SHA1 d7f8480b3b496bbda653355cb75935c8896a0506
SHA512 effb568129f7af8ee73644e4825ba0e28272eca70043885860fd3c5a32742bfdb1b9f13cb165780738d304844cd76feff81760d56db6bdb5491872868c66bfd4
TLSH
T15181320200C89EEEC8A4DE84DD707E4CC6D437AA8CD29821DF7EF8769D88D177516276
MD5 SHA1 SHA512 TLSH

Submit Download

5.622_winamp5622_full_emusic-7plus_all.exe

Path C:\Users\Admin\Downloads\5.622_winamp5622_full_emusic-7plus_all.exe
Size 15.8MB
SHA256 b9c456befe5b4fca615ed61c33874f1678ef1d89fbc24c0e3c8934a1112957f7
MD5 dd27b3f7a388bde43b05fac944703eab
SHA1 70877976f94f9f343ce097a4e96e11c65d9c5a4c
SHA512 6ab351aac522900ea2bd4e6830f6e5a18f42136216de54cb259336cd59d085c0e8b2dfcbcf905e5c81fa6c3c79b6caa34d47c7247c41edd59812bda354a26056
SSDEEP 393216:2GiF/yW0kSX58kb+dLOTFVZKxQwA9Pc12UUIA0tCA+2kcI:2GK/ytpXZ4yFhcUHIA/LcI
TLSH
T145F6331A7842C963CB5D88762DE3D12B26929DA00A63811BFC913F1FFC361647D53BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 4KB
SHA256 787c52718cfb4d538a91aaf95c8bae06143e949fef34a00d288ff29c6e1b56f5
MD5 5bfa032f11a060f35387d9cc9d703f2d
SHA1 8f3c90ce586eb04794fd8c37ba10383770c58ae5
SHA512 706eaf0fd64920002ddfdfba41a032db2e26f07a254039b86937859000ab1f4becf42e9b62d7df476159ae2e951885f5077093f3697ca4f01cc7be54c1240cb4
SSDEEP 96:ensUv+ROYCVCDy14I9q9T9yN6v1IOx7Yx43IdDuIdvuI2uI+uIpuIsuIbuI+uI9Q:qYI/u
TLSH
T1DA9138892D77C8B2EC40340B4B6E5BCB86AADF470758172573964644FA0EB291F8E9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-4271-0x000000000A250000-0x000000000A262000-memory.dmp

Download

memory/1124-4277-0x000000000A290000-0x000000000A2AC000-memory.dmp

Download

memory/1124-4245-0x0000000008450000-0x000000000848F000-memory.dmp

Download

memory/1124-4248-0x00000000079E0000-0x00000000079EB000-memory.dmp

Download

memory/1124-4249-0x00000000083A0000-0x00000000083B2000-memory.dmp

Download

memory/1124-4252-0x0000000008490000-0x00000000084BD000-memory.dmp

Download

memory/1124-4259-0x0000000008720000-0x0000000008731000-memory.dmp

Download

memory/1124-4256-0x00000000086F0000-0x0000000008712000-memory.dmp

Download

memory/1124-4265-0x00000000083D0000-0x00000000083DB000-memory.dmp

Download

memory/1124-4106-0x0000000007840000-0x0000000007892000-memory.dmp

Download

memory/1124-4267-0x0000000008620000-0x0000000008630000-memory.dmp

Download

memory/1124-4291-0x0000000008740000-0x000000000874C000-memory.dmp

Download

memory/1124-4275-0x000000000A270000-0x000000000A281000-memory.dmp

Download

memory/1124-4242-0x0000000008410000-0x0000000008445000-memory.dmp

Download

memory/1124-4297-0x000000000A400000-0x000000000A41B000-memory.dmp

Download

memory/1124-4295-0x000000000A3F0000-0x000000000A3FC000-memory.dmp

Download

memory/4088-2376-0x0000000005510000-0x000000000560F000-memory.dmp

Download

memory/4088-2391-0x0000000005510000-0x00000000055F3000-memory.dmp

Download

memory/4088-2400-0x0000000005510000-0x0000000005625000-memory.dmp

Download

memory/4088-2367-0x0000000005510000-0x000000000569D000-memory.dmp

Download