Overview
overview
8Static
static
3keepmusic-one.exe
windows10-2004-x64
6keepmusic-one.exe
windows11-ltsc_2024-x64
6$PLUGINSDI...er.exe
windows10-2004-x64
6$PLUGINSDI...er.exe
windows11-ltsc_2024-x64
6$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...-0.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...se.dll
windows10-2004-x64
3$TEMP/Micr...up.exe
windows10-2004-x64
6$TEMP/Micr...up.exe
windows11-ltsc_2024-x64
6Analysis
- user interaction
yes - max time kernel
600s - max time network
573s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 13:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
keepmusic-one.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
600 seconds
Behavioral task
behavioral2
Sample
keepmusic-one.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
600 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/KeepMusic Installer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/KeepMusic Installer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/api-ms-win-core-synch-l1-2-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/api-ms-win-crt-math-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
600 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ucrtbase.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral18
Sample
$TEMP/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral19
Sample
$TEMP/MicrosoftEdgeWebview2Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
600 seconds
General
- Target keepmusic-one.exe
- Size 6.4MB
- Sample260807-q1ewfseq4x
- SHA256 23eb35a348bbeecb81266f7206c697ab020e532375a4472cb7b8c48dd4e0ecd9
- MD5 bac3fac4c1a3ccbb0250ad17f65de813
- SHA1 f27f7eff18728ce87e18739d649669fe5cc0a79f
- SHA512 993c0f2a4f8dc2fb00c5b43e2a73fa6ffd44c47595a715bb0db7b4888b1ad24c8fc3f995b6ef5c5c561a99c853b2a79a58ad4c07451f1c2002d4010693b854d1
- SSDEEP 196608:Jvnmv10HQMIdF1kml6GZ6j6CQrzf4j0oqSzR48EnKq:JvvQRd4mjZ6Rgf4j0ZSl48EKq
- TLSH T1CD663397CCAF4CE7CDC62C7DE172873A9983BE2585EA148E5A86FD241435AC314D7123
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\KeepMusic\KeepMusic\ffmpeg.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\lv.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\prebuilds\win32-x64\node.napi.uv1.node keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\chrome_100_percent.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\vk_swiftshader.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\fr.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\id.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\ms.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\ru.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\package.json keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\loader\font\Nunito Sans-Regular.ttf keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-sysinfo-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\vulkan-1.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\hi.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\loader\slider\bg.png keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-processenvironment-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-util-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\electron.exe.sig keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\am.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\ar.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\cs.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\da.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\en-US.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-crt-locale-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\prebuilds\win32-ia32\node.napi.uv1.node keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-interlocked-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\v8_context_snapshot.bin keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\es-419.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\WidevineCdm\4.10.2934.0\_metadata\verified_contents.json keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-libraryloader-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\et.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\fa.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\hr.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\it.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-errorhandling-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-rtlsupport-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\en-GB.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\es.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\ro.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-crt-process-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-crt-stdio-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\libEGL.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\af.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\fil.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\pt-BR.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-heap-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-processthreads-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-crt-runtime-l1-1-0.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\libGLESv2.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\ca.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\lt.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\7za.exe keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\LICENSES.chromium.html keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\loader\slider\1.png keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\msvcr100.dll keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\ml.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\pc.dat keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\loader\index.css keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\feedbackurl.txt keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\locales\kn.pak keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\loader\bg.png keepmusic-musicone.exe File created C:\Program Files (x86)\KeepMusic\KeepMusic\api-ms-win-core-file-l2-1-0.dll keepmusic-musicone.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Part-NL msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1733810672\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1234578587\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1234578587\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1086621776\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Filtering Rules msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Filtering Rules-CA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1733810672\crl-set msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1234578587\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Filtering Rules-AA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Part-RU msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1733810672\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1234578587\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_1086621776\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\adblock_snippet.js msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Part-ES msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Part-FR msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Part-IT msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\Part-ZH msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5860_580534168\manifest.fingerprint msedgewebview2.exe - Executes dropped EXE 7 IoCs
pid Process 2628 KeepMusic Installer.exe 2524 keepmusic-musicone.exe 4672 KeepMusic.exe 4008 KeepMusic.exe 760 KeepMusic.exe 2896 KeepMusic.exe 2904 KeepMusic.exe - Loads dropped DLL 35 IoCs
pid Process 236 keepmusic-one.exe 236 keepmusic-one.exe 2524 keepmusic-musicone.exe 2524 keepmusic-musicone.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4008 KeepMusic.exe 760 KeepMusic.exe 4008 KeepMusic.exe 2896 KeepMusic.exe 4008 KeepMusic.exe 4008 KeepMusic.exe 4008 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4008 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 4672 KeepMusic.exe 2904 KeepMusic.exe 2904 KeepMusic.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA KeepMusic Installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 KeepMusic.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 KeepMusic.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeepMusic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeepMusic Installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keepmusic-musicone.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeepMusic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeepMusic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keepmusic-one.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeepMusic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KeepMusic.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{10648137-B3A6-437C-B1A5-A1726C9877BA} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{0CA82F06-2578-4428-AA42-7D9AE781EDDC} explorer.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 KeepMusic.exe - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 236 keepmusic-one.exe 236 keepmusic-one.exe 2628 KeepMusic Installer.exe 2628 KeepMusic Installer.exe 2628 KeepMusic Installer.exe 2628 KeepMusic Installer.exe 2628 KeepMusic Installer.exe 2628 KeepMusic Installer.exe 2524 keepmusic-musicone.exe 2524 keepmusic-musicone.exe 2524 keepmusic-musicone.exe 2524 keepmusic-musicone.exe 2524 keepmusic-musicone.exe 2892 msedgewebview2.exe 2892 msedgewebview2.exe 2904 KeepMusic.exe 2904 KeepMusic.exe 5544 explorer.exe 5544 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5544 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5860 msedgewebview2.exe 5860 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe Token: SeShutdownPrivilege 4672 KeepMusic.exe Token: SeCreatePagefilePrivilege 4672 KeepMusic.exe - Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 2628 KeepMusic Installer.exe 2628 KeepMusic Installer.exe 256 sihost.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe - Suspicious use of SendNotifyMessage 45 IoCs
pid Process 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe 5544 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 6792 StartMenuExperienceHost.exe 5928 SearchHost.exe 5544 explorer.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 236 wrote to memory of 2628 236 keepmusic-one.exe 89 PID 2628 wrote to memory of 5860 2628 KeepMusic Installer.exe 90 PID 5860 wrote to memory of 4560 5860 msedgewebview2.exe 91 PID 5860 wrote to memory of 1324 5860 msedgewebview2.exe 92 PID 5860 wrote to memory of 1324 5860 msedgewebview2.exe 92 PID 5860 wrote to memory of 1324 5860 msedgewebview2.exe 92 PID 5860 wrote to memory of 1324 5860 msedgewebview2.exe 92 PID 5860 wrote to memory of 4988 5860 msedgewebview2.exe 93 PID 5860 wrote to memory of 912 5860 msedgewebview2.exe 94 PID 5860 wrote to memory of 912 5860 msedgewebview2.exe 94 PID 5860 wrote to memory of 912 5860 msedgewebview2.exe 94 PID 5860 wrote to memory of 1160 5860 msedgewebview2.exe 95 PID 5860 wrote to memory of 1160 5860 msedgewebview2.exe 95 PID 5860 wrote to memory of 1160 5860 msedgewebview2.exe 95 PID 5860 wrote to memory of 1160 5860 msedgewebview2.exe 95 PID 5860 wrote to memory of 1160 5860 msedgewebview2.exe 95 PID 5860 wrote to memory of 1840 5860 msedgewebview2.exe 96 PID 5860 wrote to memory of 1840 5860 msedgewebview2.exe 96 PID 5860 wrote to memory of 1840 5860 msedgewebview2.exe 96 PID 5860 wrote to memory of 1840 5860 msedgewebview2.exe 96 PID 5860 wrote to memory of 1840 5860 msedgewebview2.exe 96 PID 5860 wrote to memory of 4540 5860 msedgewebview2.exe 100 PID 5860 wrote to memory of 4540 5860 msedgewebview2.exe 100 PID 5860 wrote to memory of 4540 5860 msedgewebview2.exe 100 PID 2628 wrote to memory of 2524 2628 KeepMusic Installer.exe 101 PID 5860 wrote to memory of 2892 5860 msedgewebview2.exe 103 PID 5860 wrote to memory of 4792 5860 msedgewebview2.exe 104 PID 5860 wrote to memory of 4792 5860 msedgewebview2.exe 104 PID 5860 wrote to memory of 4792 5860 msedgewebview2.exe 104 PID 5860 wrote to memory of 6796 5860 msedgewebview2.exe 105 PID 5860 wrote to memory of 6796 5860 msedgewebview2.exe 105 PID 5860 wrote to memory of 6796 5860 msedgewebview2.exe 105 PID 5860 wrote to memory of 3564 5860 msedgewebview2.exe 106 PID 5860 wrote to memory of 3564 5860 msedgewebview2.exe 106 PID 5860 wrote to memory of 3564 5860 msedgewebview2.exe 106 PID 2628 wrote to memory of 4672 2628 KeepMusic Installer.exe 107 PID 4672 wrote to memory of 4008 4672 KeepMusic.exe 108 PID 4672 wrote to memory of 760 4672 KeepMusic.exe 109 PID 4672 wrote to memory of 2896 4672 KeepMusic.exe 110 PID 4672 wrote to memory of 2904 4672 KeepMusic.exe 118 PID 256 wrote to memory of 5544 256 sihost.exe 124 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\keepmusic-one.exe"C:\Users\Admin\AppData\Local\Temp\keepmusic-one.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\KeepMusic Installer.exe"C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\KeepMusic Installer.exe" --source "one"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2628.848.3733278321208248123 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010603⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\com.keepmusic.musicone.installer\EBWebView /prefetch:4 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a01060 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffba7245fd8,0x7ffba7245fe4,0x7ffba7245ff04⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1920 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2344 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a01060 /prefetch:14⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3980 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a01060 /prefetch:14⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4716 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4668 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4296 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵PID:6796
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\ProgramData\com.keepmusic.musicone.installer\EBWebView" --webview-exe-name="KeepMusic Installer.exe" --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4616 --field-trial-handle=1924,i,11582578050766181212,7456942808344721845,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:79ee35485b25448f92953e5392fd8128d8a010604⤵PID:3564
-
-
-
C:\Users\Admin\AppData\Roaming\KeepMusic\installer-cache\keepmusic-musicone.exe"C:\Users\Admin\AppData\Roaming\KeepMusic\installer-cache\keepmusic-musicone.exe" /S /createShortcut=true3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
-
C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe"C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe"C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\KeepMusic" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1716,i,15044922745821047594,16850981056973772935,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4008
-
-
C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe"C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\KeepMusic" --mojo-platform-channel-handle=1960 --field-trial-handle=1716,i,15044922745821047594,16850981056973772935,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:760
-
-
C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe"C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\KeepMusic" --app-path="C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app" --no-sandbox --no-zygote --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2208 --field-trial-handle=1716,i,15044922745821047594,16850981056973772935,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2896
-
-
C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe"C:\Program Files (x86)\KeepMusic\KeepMusic\KeepMusic.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\KeepMusic" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1244 --field-trial-handle=1716,i,15044922745821047594,16850981056973772935,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:240
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5544
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6792
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5928
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\D3DCompiler_47.dll
- Size 3.9MB
- SHA256 e745872db4dd114a65ee1504f401ea26d879edb6614e369a07a80ce7ad1950ca
- MD5 5e717c95808bcb5f654bb312d289b837
- SHA1 c69448eafa40e35424744c28e68cf69ce11a3d97
- SHA512 dc5e6ee0c8fe22897009060821b18bf2f7d0317d30682f7fa84a4c1889358c152d84d22ebe57d0ec8ccc1be8714bce6b1257d30671b8d0fea88309bbd137b8f0
- SSDEEP 98304:q4czLWVMYHItqGZ5CNjEhrZ0T2S1kHn8:qMpGZ5CFEh10TD1kHn8
- TLSH T1D216AF22F6818072D8CB05B0666FB76AA43C9B36573440C75290AD7DEC711D36F3EA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\chrome_100_percent.pak
- Size 126KB
- SHA256 087ca17945ceaa073b2dfafc02272a7affd70786325d741b7d6cca4f47ee3078
- MD5 5c7551a309e5a95bcaafa89e702d2950
- SHA1 063111990f3bce8940f75ebec21b4ad542f7519f
- SHA512 e625a51f9c4b38fa32600c47cac8a8d327655d6bafdfefd734150cd3cefde948dbaa4c1003a129abf73f8f40b580beeb361f8ba7e5c057d928d5b656a1f35781
- SSDEEP 3072:LKzwqCT4w35jPIbfpSMO2o418Gb0+VRLf0ld0GY3cQ39Vm2I:LKzwt40OoVK18Gb0OV8ld0GecQ3f2
- TLSH T199C3D0D7B3F8ED7DDA6716B7A6264072EDB3462806D1430B478ED8363666348D8C8743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\chrome_200_percent.pak
- Size 175KB
- SHA256 4152d1b1c57c1f55085b8c8dc7eb799c92c318bac2f6f0ca03236445f6dcc9f9
- MD5 2845f6c02c5f88693e461811d0e7ec3f
- SHA1 9e0ef04a853640cc59c66927e1db77c1aa828c76
- SHA512 c873b3f5e5bcabd18fa55fb8850a10f0ed15408a2923f874a6211c7498f6503073dee7c1ea5df2811b17b824884215bed89a085df6a75a21965c1fbbbf950839
- SSDEEP 3072:96DQYaEQN6AJPc5jPIbfpSMrfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/E:UDQYaNN68cOo6gx5GMRejnbdZnVE6Yoe
- TLSH T11D04E0CBA3F89D7DC9731AB7622A01B1ECF2113945B6421B47CEDC397696B8488CD243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\ffmpeg.dll
- Size 2.5MB
- SHA256 25628eebfb11819ed9e11cad7e91e8daf14fa482aacb6e0468a093824d0fcdfd
- MD5 cbad26df4ae9dd9e05577edc9c4fa391
- SHA1 d070dd217ad0c1486ed0ebddb07cfe3b337f5a79
- SHA512 714cd167b29e1310e425db2c9ecdc61c57d5ea3eb41e21b099c7a6de4865fabffd096dd01cb91036a1749dadb718f9f9c55b567a592cf10e91276a92ba940ee9
- SSDEEP 49152:RLODafMIUtBm7EuhoUNCCxi4pmJDXhKWXt5dBbj:RRfOtBQEqNCCxi4kJDRKmd9
- TLSH T1C8C5BF41A1A283E5C44B3132345EF37F2E381B69C712C9D79788AD64AFB83D055BB366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\icudtl.dat
- Size 10.0MB
- SHA256 51edd31f6c5d298c662af320424b632172a31e3348cdbb201380636c95ded794
- MD5 516f6b90d1539bd1eaeaa2fc32dadb92
- SHA1 8017789bef98902cdc95c18e67b84378ddd293c0
- SHA512 db4b5fd7f8a0e0a331ffa7c574d011b059df8654cdc6ee4970f84fda20b88a3b8706f2605d91d19a6dd86d2702cc9542e026a054d28f85c51b676daa8d3f3bb0
- SSDEEP 196608:zTzwSv9AAyM0agliXUxCGZHa93Whlw6ZEtZ2:zoKlyMqliXUxCGZHa93Whlw6ZEt4
- TLSH T1B6B62907A2FB4EC2F9F7AF30D9F152679467BD496E31805A11442F3B1C337A08661BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\libegl.dll
- Size 363KB
- SHA256 378b3f426aa48b87f6aec35f4bc2146d76fd387b844d06ed372b36c9a5dbb2dd
- MD5 1726f017bf0e6ac9c14b03ec299af599
- SHA1 eb337c0dd7dc6af4d9228cf6e27b3360d99c9c7d
- SHA512 5fb2b8cf05de0b7b2f8755a5a24a3f86a59b1f05fbfa57145bc635fb519517ee5b0685cef3b581b430c084348a3e3e811c6fd9ffe48709cf52c27805a72989a3
- SSDEEP 6144:DeMkkXdg0nrIEmx/MdkppZ8E0UPAcYH3hssbgKhxAnM:DHXdDIEmO+B8E0UoNOcfA
- TLSH T18984AE417100C071C87E2B313919E7784A7DA9D15F2A5ADB9F984FBD6E301C28E36B6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\libglesv2.dll
- Size 6.2MB
- SHA256 1eb087b382479284356f3366399c6f3a101f81068cc4c1e7259582669d58574f
- MD5 382cf99531c3f0dda67bccfc5c9fdb14
- SHA1 69b19cfcf78a017d76c47b766d1aabdda76a8d23
- SHA512 6120d8d47c86957c690188a531fbd470be668d4f854a8fd1b00baf43b91ca2e59a43fe49eb0aca01bdab7cc05f587a50a8777e179797d61e15b5d90fef1c15bf
- SSDEEP 196608:HzUu47V8XyryGWXB3DmGOf6Na5L2SdOB:Hzv47BryGWXB3ad
- TLSH T14D668D01A5D39170D81E3272281E6B3EEF3597118F5182CBE94C6DE16FB12E2277626F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\locales\en-US.pak
- Size 295KB
- SHA256 c4a2c6a90945868a02ad14b3a994e94b123981d56190bd34cc3cb14f31f2270b
- MD5 a2ed0e17819c287b824cae5c0ac03af7
- SHA1 9694627f89cd65fbb511eacc6c785ab045525ff2
- SHA512 a527351a1c61e6ed4e999c6549ec04b2096712644c4e1f28b48872c031c9f0a4bb118c0ceb40dc3a35315ddc7cf244e3c0c03d864a53d4a76f6dcf1b3889c109
- SSDEEP 6144:xfvPBH0g+FtIpphRO6osMP9elM7BBfaYM+R9X5GSOmzwS:hpYIHPosM/7BQ+35GSNzwS
- TLSH T10F544D1FE784126A069312627F0656E3FB25D0ADA35112663CBC802C33B7B66D3777E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources.pak
- Size 5.1MB
- SHA256 a5cf2344089644a846e9d11de9dd5c611f11d755f5d0e07f21c9686f74629721
- MD5 8ea556f1fc553781a38dc62fe56c99f2
- SHA1 b3157b6961c083aa02a4376006980ca4b5ae9509
- SHA512 c96ee1f1505bc1cfc169dce9c7d572e96e8440acdefd6e1aacfd7f4f8e4e6f24dc0db8fd73979fb5dbb975fd90a71abc88d76aa5d2223e805312267c9d53c744
- SSDEEP 98304:ChfVt7qtWSTCUy5Fcljiglh1eZQL3Arwr/NGKwkT+E59zqaPqPXSF7yOzy2oeUn:0V8tWSSElmGhkQLQkrVWk6q9+nPXsq2A
- TLSH T137463350F3A01D37E2D6E37AD4A810331D35D18759A2B82CF4CE211D8F5CA9B16B97AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\PKVSKeyChecker_protected.dll
- Size 1.5MB
- SHA256 0c4fccd580eb609f1105c74f3fa58270d3510d49139d0834ddf07160f508abc9
- MD5 5834b12daf670a5c43840ec9a83e617c
- SHA1 da458d0ab7a83d091389b569b5cf7eae9acb234c
- SHA512 0deac60e4ad929d764547c4ee6aef43be2dec712317b03d86210fe8b531742da4b188c285029683be4a16bbe1bb6430b05cbd9ca56c9d85aa9ce4ad6c8d4e880
- SSDEEP 24576:Kos4mpxx5mxVXGxAH6D68xjayVthpRODhch3RgtYqchwhNYSjInT62foWQyVs:Psxp8xI3OSBzRODK3RDqcYNY162fRjC
- TLSH T10C75AEA2230BF6EFC48E247CA022CE57486CD6B7CF14C987F99DA82A5E735C23555D24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\WidevineCdm\4.10.2934.0\LICENSE
- Size 473B
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\WidevineCdm\4.10.2934.0\_metadata\verified_contents.json
- Size 1KB
- SHA256 8ac206c72b8764161c571da4ffc747bf45389448daa543173b30504e7a4c4ce2
- MD5 786bbbc5d5cfff6a7bb89b4ed2a44f54
- SHA1 734606316c8d9eb6f8f6620bb75cef7885b72968
- SHA512 15fa2206e5e91e4b153b884596e1c25cb280f8f1372650d3d04a6c88a730eede5ad29e8ac331779ffae7d7a4b67171f469768796260702eda72ac9b48cc1846e
- TLSH T15A31B5940CDD3364704EAA308F561A4B474E24A742A5720A98C01C0FF1EC209E6EB94D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\WidevineCdm\4.10.2934.0\_platform_specific\win_x86\widevinecdm.dll
- Size 20.5MB
- SHA256 4420bfb5fa2ed62f2bfe122cadebce5cbb50e45a6cc56dda688b093918959822
- MD5 8c70e852d6ca9f8339406b5937b8aec5
- SHA1 4c67f4023f9add071a51e65538bca377cd42a1d2
- SHA512 de7e31976b8bdc81ce97eb13a8c487a1f4faa8a9a367005c9d7c5c2fb234a986a4a33a3cccf0930e99cd8a1eec57f96a5f29d6a3173f8ae7844cd59999a7ef4a
- SSDEEP 393216:FKhBOKGlL4YrFLzXzmeWiC0CC6SGAxvSmcIfWYO1IQks2RYZH4dc5uEmtc7ZkDi:EFm4YBLzmisSu2+KQB95BIctv
- TLSH T12A270240F3233074C90B58B1082D6AA6552D08BE4721CAFBEFE46D75B5F26C16739B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\WidevineCdm\4.10.2934.0\_platform_specific\win_x86\widevinecdm.dll.sig
- Size 1KB
- SHA256 9028ae71715f2511f35ef2e692866b4c70bd2dd6a59d5db1495c19816a1f5069
- MD5 b88fdbb5397faf02a20d81277dd03bf6
- SHA1 a341ecf21fe9acac63b0c83902cd601cf8053e9f
- SHA512 89cb60330ac05d66e5111fd3559a2db5d3f8eeca5bba1c88b5155d17bef76fd9cd7428125a65dede8ac365b20e3eb0762bfcb985f4a621a3e80bb881dbaf127d
- TLSH T1FE21E9DDA96016581880EA3E1EBCF125DE3612C1BD3404B786B756823D537B024C967C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\WidevineCdm\4.10.2934.0\manifest.fingerprint
- Size 66B
- SHA256 c932f99f6b8998d31ecc834d2c9abd20b02202fae2f6b2ed54b0cb6e67e07225
- MD5 60a444f3f1c635f826831888f0f2dc9a
- SHA1 70d3ac96c435fdd505dffadd41843930bb85da21
- SHA512 54b33f4b828b3f794f48e0c6ca30cb7945e9043553c6f3a4bed0ca7e82c0674523aaa7126a54e0c5a36973141b5b079e93c3c7a42211126984c244b9a4f5debc
- TLSH T1C6A0028D4CB5661A94197451EC121C1BD03E34F14422F7C2AC49F225485C269FDD7523
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\WidevineCdm\4.10.2934.0\manifest.json
- Size 984B
- SHA256 ee1104b899c47c9b1ac64fe493357fbcea576afe4268e277017ca099592fdbac
- MD5 3d339d9927d564027a62a7d93437de17
- SHA1 7adacd62c070073cdc10eee8dfd78862ae7b3c93
- SHA512 9b81ea0f398c37f3d415c67dbdda5358c672f101fbbf57305df681ad9c8a712352dd79676a162af0b5bfcccb080ca18baffdab24fae08eb57485d638aefb1b7b
- TLSH T17111571089388D9325E8BAA21CD6580697661D9F4CC27F58379E160D8F1C8ABA27362C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\app.json
- Size 773B
- SHA256 645c74ecd5e375cda5897fee5bdc100b895cfcb93bdf6d6bbe517e067cb51f53
- MD5 00580a79b3a44eaab1ccdc7714ed2aee
- SHA1 d33f63e9052fe95b9aedf83c9519d98495c66b8c
- SHA512 826d104f7e5765ea9f8f81d77bd74db621266e211e0b6bab3b2c8df0acee7235715d8b9e4abbbb0686b3bab0b945a8849ab68a69903c61601dd5e5216f8a121e
- TLSH T13F01201265202CFBCB02E61F1056A6D5321F490BC4C52C7EC4C45806EF9F1FCD6107D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\loader\font\Nunito Sans-Regular.ttf
- Size 110KB
- SHA256 095c1f9fd36415a5e437952526b7ece861be53c5022534c16f78126ec237d9f1
- MD5 51a77deb6fba78784d6e7bf54932fab3
- SHA1 76221b9bb3e1e43ffeea6642b491a485ea97d2c8
- SHA512 4e63cea3592f6db7bbe411f4ee7a37754d29a458c56409a8bac2afd4112bc4a90808e57916ff0f2772e13e26ea78ef5a39434253d88963711e89653d451eea12
- SSDEEP 1536:iZJb3BlRk2oyyxyxy6yyhtFpllTh4oQzMlMj2v+XQfYic1HmsZ4C/C1:ijr9k0h4bzMlMjiPfYN1Gsn/S
- TLSH T161B31823B7136749CC076F3D8BB2D3E07372BD906E68C64BF84B6E1AD89B5851986601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\loader\loader.html
- Size 7KB
- SHA256 238f75587e2997e311413f6211ca5ed90392f2c2c1999d8c4d0b17deee19b3cf
- MD5 5d939f6f6850e5575b78a3232dd56a5d
- SHA1 e3cd6ac1af355285d32a5b2ad7c1107b9a9b0f5b
- SHA512 dca4e064ebbd964ad895b0a3354617e02474d60e3b7913f3864e1d287e48e3bee708b671c79ca016e038e85730aa7277bcac412f963ea4184722f2b1b23641c7
- SSDEEP 192:+XxjUR6WhKGpNyxaeHe/Ay5Cqqy6+zK3bz:+XKNKBN
- TLSH T17FE11F5441F580369002E05A1E4A5E0A6FE19947A81B1D0D7BED07ACEFCBDBDC8B6AE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\main.js
- Size 1.2MB
- SHA256 1c8abd600cbe8a5c9ac1994df02063054a519ffbb3ed82f70e2f115e70b64e1b
- MD5 ca79b39c20852b60e5fbd4517fe5a8b1
- SHA1 a38ed2eb199d208f889b42bc550073b31d9a08a9
- SHA512 425c29c808470ed35b395e597cc13a59253decece552be5b4999cf5302b469389acd5d8c34bddf344994ad2a35ee81b4402e195124a39820966c977e57f607ec
- SSDEEP 12288:Eo2IpTkJvH+grdr63MIdoKzcLJJWz0UOLIkfu0gAs6IPwF0gTjJzGjGqGIDBUtYv:/gh2WC0UKc/cUiY
- TLSH T10645844067C0A85C13979FBA731FB4D6F85E1CAF3C48484BE110FDA069AA617FAE5931
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\package.json
- Size 850B
- SHA256 7e5e355883cda8d965ae9826ba932c66eae3c9c319b8556842a7821108dc8e72
- MD5 571db2a75c7f91ff577f739d79821694
- SHA1 570ceb09b40c34e579334505535052dcd2de20b8
- SHA512 9fcbaac1ee574a221171b6a9f81b60c720084b1d633f7dd66114abb6b82a22c18ccbae7378588c571b0cdf95806ca5000f797e31843eac87a42597f0c1f0bf35
- TLSH T153018864453018BB8BE1E18618B2066376084D2B85C07C6C87D7712E771EABB5EBD3AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\resources\app\prebuilds\win32-ia32\node.napi.uv1.node
- Size 96KB
- SHA256 15993682019f09faf3eedb97d99e414d8a8d9f604bfc2fcb14ca819c327c0f75
- MD5 b15e1291b9f77a9c8dfda57ef2c712a8
- SHA1 26c3f2647bae2d0b0ea6cb5a3a979a563a5bb685
- SHA512 84ce7d0c42ffc60efabfe5c60463485af41e3a228eb4d01b9abf63508786125e9d8c592c9a8c3eb4682df1990290ed08f23b253cdfad7a1adeefa25bffcd6c48
- SSDEEP 1536:eily9BU0skgtZ/vCLpTodk9LVrjeM/veQpnsWtcdSuXmnsV5RFtMGMB:eily9UtF4Sk9L5HeDSjsV5ftMDB
- TLSH T13DA35B00F5D1C071D4BE5A3D0835DA65573F7920EFB08EEB6794026E0E742D0AE3AEA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\v8_context_snapshot.bin
- Size 598KB
- SHA256 933c2e57adbc44baeb892a1d7388fed8c6261457af68788a0b04e970ec2f40a9
- MD5 dc2d29adf6286fe385ffab3325f95b49
- SHA1 8336fc256cda72edc4660af0c2c198fdfccd3aae
- SHA512 d8027b5d83785914c48e6ba35e73da3029394d06dfa9d5126e97d3a0cbf4fe56f93b626c000e5f1a1dcc399cc5bf4baac89e886a078e579d9be25ade1f746e43
- SSDEEP 6144:+A3gr/+VqgfQPAhLr/+LljamniglhoTRN89LxgpmPZ81vx5Y6Pd5hH8UKGNx5P9z:+1+kg4AJ+hGmkg21vx5YsHcev5lp27i
- TLSH T11DD47129F712CA1BE6136CFE1BD9C94871B1F684AF478D2375A98B8E30B7B045C215E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\vk_swiftshader.dll
- Size 4.1MB
- SHA256 2fc6073d5815e8f862183ce664da18bf63f6f8a954765b0f3a061878b172c2be
- MD5 92df94fc5cbacdc661f1a3010b58ed58
- SHA1 47e66adee3cf461f327fead1ccf1ca4e145386f2
- SHA512 3fee2e86ecf76be3ac5e5d506f96cbbc84d4412cf5054a4d43cb76c8f10b2a5e8579e24c50438d020336e8787dd67bd594d53136bd038e4ed314ce1c228145bd
- SSDEEP 49152:qNwIQ+GEhep+e+SbrTTQMpDZFNLWL0vLvJJoWwkCgQxmy7FKa/WFfcILdPGa3hBW:qN5STpFJTjkHEwMUAisW+WA4z1/P
- TLSH T16F168C40F6118078E41B23B2652D6F38AFB087444F7A4ED7D6AC2D987F742E216BE15E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\vk_swiftshader_icd.json
- Size 106B
- SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
- MD5 8642dd3a87e2de6e991fae08458e302b
- SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
- SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
- TLSH T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\KeepMusic\KeepMusic\vulkan-1.dll
- Size 738KB
- SHA256 cde96209a1a4a1861e2b7c1057e03efc5fa1221adbf7afd213b6ca67757968b4
- MD5 f0ae330eca6cbad79f80768ae50c671f
- SHA1 36580b906888b191410c3038f27152965d966dda
- SHA512 4313ea66f957b9e4ee50e022d7c0c57d379aa244c432bf4de070fabe8276f39cba0dd978fd019108533f0973353d4c239f56405ac07988a2b6ed6ee01a71266b
- SSDEEP 12288:hewAViq/C/Z4gIi6JmhJSmmZEd5GznM9BBpuEqLbjvkcWP9E60U9C:QViqmugIi6Jdd2dwzM9BKEqLHQ9EC9
- TLSH T141F48C12BC44C131C51F3239BC61B7770A7E455227B48AD7A7ACBFA4BF601D12A3971A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 9cfd6cd61927b1f9cbcc8cbad1630325544c62be4ef606b7864e1ce806b6a1a1
- MD5 d890c9a1349120cf397efe66530f0602
- SHA1 473f3a13703d6e0b8b3507b4474b6cc099951c61
- SHA512 9e6fbd418756379b82b3491097e6e3dc630e2d0c8ca1dcd79eb214c78e31731ac07096f571718ed09d249f93d790015850cda3e4de14c4f9e3e028278c6ed27c
- MD5 SHA1 SHA512
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 3d43d1660811aa4f9858859710b9e94c04607653230331eaae18f8fdc0e05a51
- MD5 6407c6f4e019ae5a3a0bc27d70c1e610
- SHA1 3a6a6106562a86e7440e8678a4e994673aece44b
- SHA512 07851ca6156fd1fd9f99447055ee739327f3d58c2f20db1d3f5b2ed88f88bfc38a739480ea1c5b672a65edd69e051519dfb68b40594a4e0919e86dc74e134892
- TLSH T12FD02B6227250930C610313744C1F1481500C61F008648002E3DFD1E0BC40F10EC2983
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 571c633f8a393df21e05afc0c99d06bb501088a0a06885d04baedf2c55d9fb05
- MD5 4ba6c528778849ca29b926a2c03ff0a4
- SHA1 05ba34a29b0107f816f2572deaf9710f45783002
- SHA512 4d99ef58ed01c88754f51a3bd877fb3ce39ed5f4bb0a47db24f259f61e89c7278eae4b720337327a396a256276d4cf187b205eb5ee4e602125d63f92d9ca7672
- TLSH T1FDD012123B114534C4102433144271080900C60B40854400643C891F1B980744B03483
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 21538667360577e90087d38ab7d779d1ea5c3540902e8caf63938d1119315756
- MD5 998e6dae1e4719f2de734d2ecced4bca
- SHA1 2132152ea7f0ef612855fca90e53134f16222932
- SHA512 f3713d0f2ef52fa0d4185958265bbe12e9de415ac50f775cc93e64a1ab6a69c3c9bb31612fc0d8efc14f6613095a7fbecf15ed7c20b02d1de86b443c1236dffb
- TLSH T1BCB00122884AE41AD22A66F05BC269AA3732981613E72A1142A18AB8A6A67425745281
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59a4f1.TMP
- Size 48B
- SHA256 ddbbf6083a5043095928234146f346a8c8334639fed40c76386b9c107a0f2a6d
- MD5 08a5cad308358cc890bcaf391bd45071
- SHA1 d50bf20b09e9e2da43f4ae4aa951ee2e93132635
- SHA512 9e5f027d408b7d69276e03051eba99d40d8fe1f33ab1fb53d8aaeaa0580334be346e957f85082ad89665629346176ff89d6c6fbf16c84da04398598265f689ae
- MD5 SHA1 SHA512
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Network\Network Persistent State~RFe5a802e.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Preferences
- Size 6KB
- SHA256 53557f91818c2b0ee3ed378833e85b9c193cc356e7839208f8b4b081904c3d70
- MD5 2742404155c9fc013170747e2dab2ce8
- SHA1 ac6cf9033915400437dcb16419335d1a70a9390c
- SHA512 556af93ac09498a6ee0744692264a1a0b0b3006b92d1f65357d57e977228c6c7838bbb8b699d0de351a3b7fc7c9c046287d6186e96e1e7d92f601bde85e85409
- SSDEEP 96:stD/dwtTGHab9vgkKo5h16ZPWs7/x+6Mhmuecp1SMkkjeeK+gZN28XM1C7K:st7yo7xo+WsV+FN1Swj+VG6K
- TLSH T1CDD1A7426E34797B8CD6E219BA357B17E2F5607261D51E58E7F8852C08DA6DC2203D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Preferences
- Size 6KB
- SHA256 44f9d4ccd25c85da38d8108e752e348b2b6b500721940f01c51c3917c90b4846
- MD5 fdf013e9ded5da8037f78e0e77d69dfc
- SHA1 9596c7dd900deab68cf041333190033f16ee931a
- SHA512 e3be58a62f82f9b958ae8ff252f833fb3472ddd3a6ae67acc523bcaa77bf970df65395a5fb75a1d5d3ef86f612ceaa7e8375c0621df612ab969a2d325f3a5ab2
- SSDEEP 96:stD/dwt8Hab9vgkKo5h16ZPWs7/x+6Mhmuecp1SMkkjeeK+gZ2q28XM1C7K:st7yq7xo+WsV+FN1Swj+3G6K
- TLSH T122D1A6426E3479BB4CD6E219BA35BB17E2F5603221D51D98EBF8852C08DA5CC2307D0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Preferences
- Size 6KB
- SHA256 64e3993214ccd9743750b40cb3bbadd89b5d09db553c6a04ba4f37a6b28399b8
- MD5 cd4800b4419bf323a51ead26f1a1c636
- SHA1 ef47afa318d069565dadbe718c04c3ee54f969d3
- SHA512 b1857a9edeca7f0241651c6b1c01eac1a9d2b00acc7382eed9189c27fe32ff2594d93772a1e9f4f2f2a578dfd1c29890ab64ddacc93a2f303e48b8fcefe6d7af
- SSDEEP 96:stD/d4tTGHab9vgk+xo5h16ZPWs7/x+6MhmuecpIFSErjeeK+gZYZQI8XM1C7K:st7yo7No+WsV+FNI8qj++Qg6K
- TLSH T11ED1A5426E24697B4CD6E119BA39BB17E2F5603265D41E58EBF8851C08DB6DC2207D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Local State
- Size 2KB
- SHA256 1076ea0a3d7a1d17769981de2764e2d51fd1e3dd107a340c8cc0bb0c911e0d8d
- MD5 704a85a8e25eb6bcfc9d4d041d4a6d54
- SHA1 1493f0a36525dc79b446dabda93514fbbe620031
- SHA512 dc8ad6ae8d57a4bdd6489e7710efc76b7bec0a78794bfc11ed2ffef4cbf1eae5ee86791e729b967ed0bb5ed480f2da6053cc220d1f1355df49a12fb81d2229d3
- TLSH T199517573B9256A778AF28705798B3A23CE75A1A297522F609BDD4B1C41C718C1301C27
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Local State
- Size 15KB
- SHA256 ad037a17c7c29242f8b1bb48d4f3276241a6f9cf338410c4d9c815d21ab0074c
- MD5 783e94e8c952c4df0d7ccf3ea9077008
- SHA1 ed72aa31c6f906272b47002f64c41cff72599d0c
- SHA512 5ed6293f12dc721c0d3aa801ee4522b76b574573c27ba61e2a69cd212358d05150a1f645d047f6f013410faebfbfe4f6f2de27db9e47a375e2d525f4f5e7cb3f
- SSDEEP 384:Y+aQikB+z/xvxjg/qhEpNBS8djmmI3AVdpzqK9zA:X/UxvxjgC+hxmF3UzqKFA
- TLSH T1AF729E2BA5793D33A6F7EA05395D074BCBB494B291812EB84AED9F0D06C72D80302C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Local State
- Size 3KB
- SHA256 5d154347e8b5624c2516075a9b98aa39ed8378d703e44b156c0130916ef9bf0f
- MD5 c036a2aa188de338e4ea6166e2db214f
- SHA1 5a5bff9eb533bf2db678e64d89a0bd120e2990bb
- SHA512 4c4e12a6f6a2c365f79b534470eab6e88e8c1165081406b5b69617bf9d70cffbca0a9cf414ad37a881b18dce085ffb3329351547e9cf82631e64e0c6ff01a009
- TLSH T14F617576B975A9774EF2DB0578863B12ABA5A163E6953FA4C6EC0F0C01D72CC1341C17
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Local State
- Size 17KB
- SHA256 181fac309c037ef7619437697f6950b02aff1c5e900684aee37466b4b4a3dcab
- MD5 17a0fcefe543ca0713c65951d6a174db
- SHA1 f9ef19ebff6b0e0900b0324bc82e48a87afa233d
- SHA512 aa86308e993b35a4aebbb14be57c2b57b90a003231f38e879fa48afec9287c96ba6fd90db22faef2832cdf86cdf7a707f25fa738db8e2c4ce5b9f9d5459a1cdc
- SSDEEP 384:o+aQikB+z/xvxjg/qhEe3Nl8dw2ymyD8ffM/1AVdpzqK9zA:n/UxvxjgC+ewmDYffY1UzqKFA
- TLSH T157828D36E875BE23A8F7EB45264A678BCAF4856251C11EE48ADD5F0D06C72ED0302C1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\com.keepmusic.musicone.installer\EBWebView\Local State~RFe594d3c.TMP
- Size 1KB
- SHA256 80f171eb644b696f25686d4808c27b3f341e51beb2244b0715258be3a30146d1
- MD5 158996adc943f57241e9a50fbfb53b7c
- SHA1 080ed02111c91f224cdf1edaff15822796c7706e
- SHA512 03d59fed3d931514068f8dd12afd9e7aaee7f539dac65e923e56c40745c4182d9c49b6f478dd781f5083d592c47ada36815b8c9cb939d951c101799f4517b5ab
- TLSH T1B62162F2F5346F72AEB2A74631877A679E70A0A7D2124F5066CE8B1D02D718C9216C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\306b7feb-79c6-45af-b3e1-93723b9f6a1f.tmp.node
- Size 1.6MB
- SHA256 7f45264f3e2c5fa13a38a0a1aba18de157060444bfef29cefd3937e93d9a556a
- MD5 85fb978b89929582ec634ba1070a0d58
- SHA1 6e1d1fa864c7128afee17af8d1a15c81a6bf1891
- SHA512 715d682a9763a79c01a3b639e0a5cf7ba54bc8337d5c54ec98a396b1b23b30b7e27342dffaca8333d78cae2c2051218419a723b3bad9d605f695963ce623d687
- SSDEEP 12288:7F7yRqmTcADc8SAjFbnQW/+5JQgPMnn9gmAKriLXiAzzSJ+Fj5Vw:RyRqmTnTPFdm+AX1z
- TLSH T19F7521535C8F54DEF9CA05B29C0AE2F13B0C7B09082DD8A3DF653B4AD1A5157AD9B283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\KeepMusic Installer.exe
- Size 10.5MB
- SHA256 23a7f2291b3dd4eaea95d0186135be3251b4f2ee8470d65307945f7e33514d08
- MD5 1bdb5dee48c3c04d222468603c663438
- SHA1 710e6bc47b25bfaee702cf3253f13837787fb289
- SHA512 b69c1b4abb2456d10bb411812b6f4992c64acbeaff4a7dc18bd71a64b6e282d8816757ea8dac33f9bdc83c349f5ecb8558607aa1a5cecb87c315e9068dc44e99
- SSDEEP 196608:AzCegSj9IYG2fUwctaJ0VN8R25/C53dc0nlDyVN:AzCeXj9VNf/c8J0Vp56E0AN
- TLSH T1ECB68E03B712D0FBC98742B0E02E97389EB3595853158DE3C694ADB899B93D12D37B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj3F15.tmp\nsis_tauri_utils.dll
- Size 29KB
- SHA256 c0f2b928bc4c81cc5ca30a8932a6dc8cd617dd016679c057e23355fe732b2333
- MD5 8def0196223484f8aed4106148dd3f08
- SHA1 e0fc0951deb0e5e741df10328f95c7d6678ad3aa
- SHA512 9ffa66181bce5aa5210da0fe5edc6c80aa9e46e2bd1fafd840f468965f4d06bc03f9a77e04b975ffc9f25c886c274196e3fedae6cfb57f366ef39f1e31e1ada7
- SSDEEP 768:97F3QRyGmiZZ1FCeu2rcFKpnq0jdhK7W+qdxi:hJQRtmaF7YMX/q
- TLSH T11FD23A18FCC97EBAC7DF05B119088D6E529FC8180754CEABE3B25E52D5A23322ED514E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nszE3EB.tmp\System.dll
- Size 11KB
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- MD5 75ed96254fbf894e42058062b4b4f0d1
- SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
- SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
- TLSH T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nszE3EB.tmp\nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nszE3EB.tmp\res\bg2.png
- Size 39KB
- SHA256 cb66af0a8cb27a3419e74e42b4d57d9e840f0fa67195b630f9e96cd9a7995de6
- MD5 77587cb52bb89af5ae95c713d99e5260
- SHA1 5e22f85a9893bf56177981d6355798081cdf2707
- SHA512 013a5b0de7e80de3670b0b531b7d1614a699b947ba57a897ce4eef809e360751090db9eff82ef1c5b29d1b7403f278eb269b0e8c44fbb274207f13797a599d5d
- SSDEEP 768:gxLlO+JdlRmCjjgzCpTL49SfHdSkIrual2eDkGH0o6XMzCVy50c:glldDxjkmhNfxICal2Ski0rXM90c
- TLSH T11803AD9E2C66899C8A0B6C0A17080AF1FFDAB6499C168CF1D0D7E726B51894B47236DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nszE3EB.tmp\res\[email protected]
- Size 102KB
- SHA256 dcfc6209653e376ab5c2b302318042d1efdf24fa21efbb6e730d3c4644e03c53
- MD5 20aec870390b196a6be62edeec074ac9
- SHA1 f3c9ff503470d4f87a7f3291d902cf62ad9f282c
- SHA512 e617ce3a162349e0ae5b93887dc7c9689fcd1571580bec9ab8919ee078f862f41da53722c8f0ce4691c428660d5fde9ad9aa014e1fa8f6cb30d83576709d8c69
- SSDEEP 3072:a2TN8bBxaVUnRfbNv/FIdh0M9ATJ1M81jznW3:ai+BUCnh3MeTDw
- TLSH T138A3F190D1701A2FFA958FF7DB2C07527E3B54D09AE86A04E97B6E20DA281D85D3433D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\_LOCAL_GUID
- Size 36B
- SHA256 88624c1f4b7ae882966bab758f27b694a72740b8836cf6330d62b19650eb4f2d
- MD5 9930edcfa89041c4c5f9c7a4f382c157
- SHA1 dca5534294431aabce5d86cd0e90195baf53a1a2
- SHA512 a5916d2234a097ab589af51936e3a9106ce36f9bed24c6bb1f7844609a8915dd19fdf1fd71f2d43f495d059f6636e551b7da56a9fe31284f8cd704c89932036f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.keepmusic.musicone\_LOCAL_REGINFO
- Size 436B
- SHA256 dca44a42613c29a9306c204aad21018b7ac106c3278f03d25f9f6391651f49c1
- MD5 a52948f837ca8171a9c2178f0259d3cf
- SHA1 e1bd19fd7ac4c1904fb64519dc48958e22b98813
- SHA512 e512331998314b68cf23889dafc415cbbcfff70b133ff4c59522a885565d1c06a75e61f94e13a6b204b1cf0ab8aa60a750eea9e77c30489617e6be1d3867c65c
- TLSH T182E0AB5616205D02000A887DD21AF9F3F598BF90A827930A6D78209B1B0E95CFEBA42F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\Code Cache\wasm\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\Local State
- Size 599B
- SHA256 6a90bbe017cf5d914f9a1c4e2c7117da927f2c39b0d1e361a6dbf25f8fc187e2
- MD5 ab62eb56a3c5cb8752d66e11a3cbc914
- SHA1 afa76ce333b7a2a8fb279035db068c2f6c6bcdc3
- SHA512 de6e4df6fa5eb558097d9adc7f058b8c0139d15bbac11c0cfd934cf90e89869ff8b589012b7134bc4e4e63a69e552f735057fcbd5cc96e2878ec13cb2992384f
- TLSH T110F02674F00D9CBA47E489140735B41B4D56691F83875B8418746C4816FEDD5641BD6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\Local State~RFe5e603e.TMP
- Size 445B
- SHA256 179c7bbda6a8ae1bce12a342c2f942b4761406179cd884c5f877fa4b582e91f2
- MD5 f8e1a6267988d0c857240bd1c56d5d92
- SHA1 b2b555a81c45fdc13a6ce9d1cac461e1286d24fd
- SHA512 b5d2865cef97c4e9dade4717aa442df9e66ff629176eae619cae560400e03109cf5ed17c94f9a92c83bfdeb1e2228e1b94189bd8d6918092040520aca500e712
- TLSH T141F02BB2E00CAC6D83E080000A72A8070C64682FC383670D2824008023EED80002BAA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\Network\Network Persistent State
- Size 370B
- SHA256 ec6a4acd094874777a75ed8ae3e767e78d1fd732b3151dc275294f43898c8fdd
- MD5 400928fd65598a824b171263414e3a09
- SHA1 06968c50b927a5e51c0da21667e67970d0988ab9
- SHA512 2e54e533029bf8ad6c631158c9cea3fe399ceee8852033e34594c57a334738156658fab0945ac2dcd74faaecd8fb9c54a370999a99f6d28c33babadd1fb80615
- TLSH T1A4E068A7C2E45CFF0746C3B46A253613D2FE044942183E0EC9D8671E42A28B9540044F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\Preferences
- Size 57B
- SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
- MD5 58127c59cb9e1da127904c341d15372b
- SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
- SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
- TLSH T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\Preferences~RFe5d6758.TMP
- Size 86B
- SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
- MD5 d11dedf80b85d8d9be3fec6bb292f64b
- SHA1 aab8783454819cd66ddf7871e887abdba138aef3
- SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
- TLSH T113A0124350152476150F2A2400474E5618E801301D1BF945C1E035A1756685C084700E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\com.keepmusic.musicone\main\main.jsc
- Size 6.5MB
- SHA256 2ef2e9144b99237a5aa940591ef89363188de6b3076e43f8a892cff2d53f877f
- MD5 4290ebf7a30fdcbdef8af887830fbe12
- SHA1 1d10f599c2e648cf3642bad14b9796ce5efb466c
- SHA512 5c9181d271faa0ddb231a1caf3850380763e2c52ef8de8fc10bbe04ffd34c3b4623b381a44290a1521c1f02fad6bb0c3e326135e2421794ae4114bed4a70179e
- SSDEEP 49152:hCurVaQaa1RobqJWlV+Y0DsmARq1S2bVUX:hdVaQaa1RouJItqS2RO
- TLSH T1AB663884D7098F6FEA97C3F027D7519A393486503F9F832A4F90523929883ED4F599CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\com.keepmusic.musicone\node_modules.asar
- Size 44.4MB
- SHA256 db8bdd6d7730a4d5799688643d3d9672a6c631109ae63b044f72eae2026b5c1c
- MD5 8ff7ae4f4182daa88bee38124863f21b
- SHA1 142638f9956a2b2650f2d2079d4892bfa62b0901
- SHA512 ba94359cc089342d8b66eaa4f72d7871c8d5965a0d9f77e8319b296d6eb59813143a615e3470afc8cc542d68da6de064f7579271c60b16829a35b8bf36dc6eb8
- SSDEEP 393216:efZ/Ia+E8/SfYAuqxGiNTj4SNFvZg0gM6V3:efZIa+qpJ5+V3
- TLSH T129A77B096EE66062C267B0B68E5F9045F239C003111CD8D5BE9C8BA41F94B7897FBFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\com.keepmusic.musicone\resource\img\light\radio\[email protected]
- Size 1000B
- SHA256 b8cbd6461c75512d565b6d7e698457ec24cd2c761b9d5455d6af9c3a819d688a
- MD5 01652546c9f11b2b1ba3e6b8a30a82c6
- SHA1 f49bec8b4deff489f04cbd8eef3055aa2e880f4d
- SHA512 dfbacefed0fe04f859a8d15c5de310da5783705fa63021e54045d68cfbde4c02640297a6e5db68d3a07fd64b0e967b68005a79e5ca186fd350a67808ffe64f1d
- TLSH T1B711C8F523A61CB67AEB0BFC965C042355766559131A4940E4C116BCD31C5C20B0EA4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\componments.json
- Size 1020B
- SHA256 94c090241b6d64d069c303fd3aaf92c85abb8ec4fcba844fd5bb8d3a26c81f6f
- MD5 d6942017743b79de385e255afa0b8688
- SHA1 6b0028591617e48cac372927ac22df7cb773a61c
- SHA512 14cba518098ce6a1409f4f39b1c7631bbaf470f07b408b8f3611ed9275c20cbc0cee6cfabb9c83f8eee5d175deac12dc9c4703fc6f6f256c7d6e4330a4040dc6
- TLSH T162118C2261A5FE7FBB10F21192B0A6C961BE31C474F42F08CED0A5FCED58A755411A05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\config.json
- Size 7KB
- SHA256 e3089bba89debc51d4844eb8385fafb249037c0fd9a08d31aeac3d5c0c83cb76
- MD5 55d051e7b71755ad29eded3ee17c99de
- SHA1 8c5e7f672ab8427a197ba58fcba7e9b96e7c5d1f
- SHA512 2e137616482bbb9571c2508ad749a4ffa4357944180b031d8131605351e4d27895fb16249e027ea32e562a59e201eede55c9837c43a1c855e416ccd976769959
- SSDEEP 96:+mAcPBB36++JrVTc4nWMQN9Hme7CvACBzVE/zqRFNVwlCMz1CUtYrdiWrmET+naJ:CWOmme7CvACBzVE/zqRFNVw4Mz0rA4BZ
- TLSH T17FE1E147C135857BF6CA9B2C042C92C65BB842D11BD6AEFFCC903D95EA6DE71004BB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\installer-cache\main.zip
- Size 9.8MB
- SHA256 64161ed5dfb0a51146f7d443263938c6a11923e2627405e7b5dc4d3668c93799
- MD5 a81f6f13acf7b939634ba3781faf53b2
- SHA1 06853b23b1d9fa262d6c52af5b762b653debeec4
- SHA512 156a572ea1fc09fd59bc6eef239f03af23fd65119c7b6ebf7aba5cb0f2d10b1051a194581a96be69d93f5a8088fa19858b59d41e76dcebe04e67c152bcd92657
- SSDEEP 196608:9uAAeL+we19dZqox7LLUhReRelFaUVsbtZhbUbz5UCCTKUbxABRkZk+p2x3Sp:YAAB19fqo1tR3PpbwbnCTKwxABa6A
- TLSH T1B3A6332BD949739733BD5E5067C69CE03FA03DD53BC22AC09A8B26D70047F12BB99A51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\installer-cache\node_modules.zip
- Size 5.9MB
- SHA256 65bc5ba31cd7e07a797c7eb1ecf7b0c81617051cf6d5d8a212f3137e5a63aa05
- MD5 e285bf2e373af6297c765b21f0959bdb
- SHA1 fd9711afd21974774d64327c67771fd7d9842288
- SHA512 3831744692320c9fc6fbe9b2c98b1eda5220f22ed0e3d3bccd92a6219b3f1237572681ae1dc6f621cd2fa1f4e7af5b8bdc388c6ece4ff8e747601a1b97e8d881
- SSDEEP 98304:q2vdXmmG3z+h1qrnF2FGGKwM2F/jq1VfUrf+lbxiem3fV+rDjSL:q25y3WgLF26jXTfif0bxq+rvs
- TLSH T19A56339B787E615AB100649FC4B32CE7AFC7E0BA91F6932BD321922D8DC465759302F4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\installer-cache\renderer.zip
- Size 9.6MB
- SHA256 a583037793ed257ab678c36a7f981d7195cef1604ec1a6d8ac58456d1a4c973a
- MD5 986dc0627d0e3585ae4c490743f6c390
- SHA1 2bc992040115a62eaa05d4d33adb78b2ccb2e2f0
- SHA512 0b90e37400b624e248f278e1fff51a21f35649bd26132b0574dd7092da2b7a8bccc9f7ec8cdec23657ca3d59a8538e4e46f137c95e7da1cdb8544e81aef0397c
- SSDEEP 196608:mDdFFKEG9tcpWtWCrwV6Xl1nF+7yyxcpQqOBM0d5NV70kAO1tf1tl/al01:m/FBiep6WCzXLg7BMMBM0d5NVv1tttlj
- TLSH T113A63347549CB099587FDB724E2039B7E8E6BD435B0B861CAE3C1D04B7B9CE8B916720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\installer-cache\resource.zip
- Size 23.9MB
- SHA256 81b76dcc837f5ad77816dd1a1a315b9547bff69d0a92f1f55594bcdb1731f123
- MD5 2c7df5b055456bfd4664f008ed3b2470
- SHA1 b01698ff16c739ab70129962915525deb94b0953
- SHA512 3c338fb35e7cbc175c34fac6f7981b39b0f3ddbc53a20b6eb85dcace1711e0ee7334d540f4325be508f5180bc7ca1bfd88657b9b7c2f6e368cda741395a68ea3
- SSDEEP 393216:K0r/H8jDhIUFX5DlDDs50sqc0HozDVvnKboPVvTDli41R6oQVU1wBHALUmUsAQl0:K0rv8BIUFXTDoqczXV7PRZjQVlBHALU7
- TLSH T1154733FAC579315BE93FDB3F61571BD1A24AE585F1E49CC3E90222A6670C10B380B1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\KeepMusic\logs\KeepMusic.log
- Size 676B
- SHA256 44702eea4db0163ca28058ffd78e9b327a5250c50c8c996fb7a2940fe2144027
- MD5 e960994488c94a4788a3c88caccde017
- SHA1 47845f70ac7501a51b8cb23d1e8a852ab8350175
- SHA512 ea4a841aff1e3619efe4574a55ae0a6379ac5e68052a901a20f2cf53f3741daba16c52d9bc620aec8446f7926facc550c07a5fb680b1686cdb6632b25b84826c
- TLSH T1C5018C4800BAD1E73A03028DCB83AE59552B35DE634FF5E8F765464A22C35238E2F845
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512