Overview

overview

8

Static

static

3

b760e7d2-c...5e.exe

windows10-2004-x64

8

b760e7d2-c...5e.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ip.dll

windows10-2004-x64

3

$PLUGINSDI...ip.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...mp.dll

windows10-2004-x64

3

$PLUGINSDI...mp.dll

windows11-ltsc_2024-x64

3

Components/ssdp.dll

windows10-2004-x64

3

Components/ssdp.dll

windows11-ltsc_2024-x64

3

Microsoft....90.dll

windows10-2004-x64

3

Microsoft....90.dll

windows11-ltsc_2024-x64

3

Microsoft....90.dll

windows10-2004-x64

3

Microsoft....90.dll

windows11-ltsc_2024-x64

3

Plugins/Fr...pe.dll

windows10-2004-x64

3

Plugins/Fr...pe.dll

windows11-ltsc_2024-x64

3

Plugins/dsp_sps.dll

windows10-2004-x64

3

Plugins/dsp_sps.dll

windows11-ltsc_2024-x64

3

Plugins/enc_flac.dll

windows10-2004-x64

3

Plugins/enc_flac.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b760e7d2-c267-4972-b8e4-5cb21020e75e.exe
  • Size 7.8MB
  • Sample260925-pl2agaxy5n
  • SHA256 115ad6a4be58320c98f992b1dae26e162976158c3cced251584a2b78f059b822
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\b760e7d2-c267-4972-b8e4-5cb21020e75e.exe
    "C:\Users\Admin\AppData\Local\Temp\b760e7d2-c267-4972-b8e4-5cb21020e75e.exe"
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Program Files (x86)\Winamp\elevator.exe
      "C:\Program Files (x86)\Winamp\elevator.exe" /RegServer
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:5508
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files (x86)\Winamp\winamp.exe" profile=private,public protocol=TCP new action=allow enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4320
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Winamp" dir=in action=allow program="C:\Program Files (x86)\Winamp\winamp.exe" enable=yes profile=private,public protocol=TCP
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4848
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files (x86)\Winamp\winamp.exe" profile=private,public protocol=UDP new action=allow enable=yes
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2340
    • C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="Winamp" dir=in action=allow program="C:\Program Files (x86)\Winamp\winamp.exe" enable=yes profile=private,public protocol=UDP
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:5620
    • C:\Windows\SysWOW64\ping.exe
      ping -n 1 -w 400 www.google.com
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Runs ping.exe
      PID:2764
    • C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\wadxsetup.exe
      C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\wadxsetup.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\d3dx9_31_42_x86\dxsetup.exe
        C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\d3dx9_31_42_x86\dxsetup.exe /silent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:2768
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\SHELLD~1.DLL,RunDll_ShellExecute "open" "C:\Program Files (x86)\Winamp\winamp.exe" "/NEW /REG=S" "C:\Program Files (x86)\Winamp" 1
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3652
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3280
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5104
  • C:\Program Files (x86)\Winamp\winamp.exe
    "C:\Program Files (x86)\Winamp\winamp.exe" /NEW /REG=S
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4192

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ssdp.w6c
        • Path C:\Program Files (x86)\Winamp\Components\ssdp.w6c
        • Size 17KB
        • SHA256 4b06e904543ba45cdbfa7eb093cb276c44eae2bec5470b5de38d31ef51281995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gen_crasher.dll
        • Path C:\Program Files (x86)\Winamp\Plugins\gen_crasher.dll
        • Size 41KB
        • SHA256 4268e0f4417914b0fe76936d560b9aa794fb7e27cb55d69800962518aeef3871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevatorps.dll
        • Path C:\Program Files (x86)\Winamp\Shared\elevatorps.dll
        • Size 50KB
        • SHA256 481e9731a0c5581d02233d2c23851020ed554702b30d55723f8ea88bf47a5ef6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jnetlib.dll
        • Path C:\Program Files (x86)\Winamp\Shared\jnetlib.dll
        • Size 512KB
        • SHA256 93f728584c438c572fec33204d523033367d861d5289e3cee35f64f500519541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jnetlib.dll
        • Path C:\Program Files (x86)\Winamp\Shared\jnetlib.dll
        • Size 847KB
        • SHA256 97de57e2cdd202e13d6b102619b6e76f190d506f544ad824574822cd3a558ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libmp4v2.dll
        • Path C:\Program Files (x86)\Winamp\Shared\libmp4v2.dll
        • Size 208KB
        • SHA256 9ded54d06321aba5741915f1c56e5bae0248a4a97cd0be13a179b6fca585bb91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nde.dll
        • Path C:\Program Files (x86)\Winamp\Shared\nde.dll
        • Size 84KB
        • SHA256 8d489de569a2486c9879e4f57f582e8549971a9f5b877d6472af8be54eb31413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsutil.dll
        • Path C:\Program Files (x86)\Winamp\Shared\nsutil.dll
        • Size 408KB
        • SHA256 cfd763f43952288d9be8f0d76d857b2675856a44bea2d5d7c89133b39ce9bc99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nxlite.dll
        • Path C:\Program Files (x86)\Winamp\Shared\nxlite.dll
        • Size 29KB
        • SHA256 6f3783342624d1c4193fc5a93e508acde9e1241044cc22b1906e41cc9bb1764d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib.dll
        • Path C:\Program Files (x86)\Winamp\Shared\zlib.dll
        • Size 50KB
        • SHA256 3dd45a5a477199fc91580414f6751fda47d3c8bc537a3e4232ccc08a5e0fb5a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aacdec.w5s
        • Path C:\Program Files (x86)\Winamp\System\aacdec.w5s
        • Size 29KB
        • SHA256 6f9817b9e95e7b9428ee13d9ddf8f6a0bd5f5b1ca77ca313a1af0f842e383a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        adpcm.wbm
        • Path C:\Program Files (x86)\Winamp\System\adpcm.wbm
        • Size 90B
        • SHA256 fbd9d49c94d98f0de4d07370d94ad002a670c15937be86005c627f377174be85
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        alac.wbm
        • Path C:\Program Files (x86)\Winamp\System\alac.wbm
        • Size 44B
        • SHA256 4b728d5a18f24095b5e2faa23406fdc5ed99f50a11be113422ef8a372399c4cf
        • MD5 SHA1 SHA512
        Submit Download

        albumart.w5s
        • Path C:\Program Files (x86)\Winamp\System\albumart.w5s
        • Size 25KB
        • SHA256 ae710a189c661ecb5b047398f159bfb2120eb07e4d334a003bb9496a98ea4300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bmp.w5s
        • Path C:\Program Files (x86)\Winamp\System\bmp.w5s
        • Size 18KB
        • SHA256 96c817bd1173de60a9f0e6bd8737414bc999d218e8e5322ea3cba037641b0fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wasabi2.w5s
        • Path C:\Program Files (x86)\Winamp\System\wasabi2.w5s
        • Size 47KB
        • SHA256 50a1041d761e50d4d4ef4ead3ac3e9f679665eacf82f06aa19bbfc9a08c72a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevator.exe
        • Path C:\Program Files (x86)\Winamp\elevator.exe
        • Size 91KB
        • SHA256 961144fc083132d5fcbafb87f69d0e3d5cd559f0e69c5692b10ec266f87259f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        paths.ini
        • Path C:\Program Files (x86)\Winamp\paths.ini
        • Size 30B
        • SHA256 fb7293e289aa918d2cbc3c362cea48dd061b0e12616924460466f26df28ff05c
        • MD5 SHA1 SHA512
        Submit Download

        winamp.exe
        • Path C:\Program Files (x86)\Winamp\winamp.exe
        • Size 2.2MB
        • SHA256 bf895bdee6b4c6db180a9eee6b47e2cfbff40e8d1914d319d1efb67c95ce8f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AUG2009_d3dx9_42_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DX9A62.tmp\AUG2009_d3dx9_42_x86.inf
        • Size 1KB
        • SHA256 5989dc367a8f84815bcfa1c46ff756527c6250c62973220d1af354b70027eaf2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        d3dx9_31.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DX9A62.tmp\d3dx9_31.dll
        • Size 2.3MB
        • SHA256 e2065619fe6eb0034833b1dc0369deb4a6edc3110e38a1132eeafcf430c578a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dx9_42.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DX9A62.tmp\d3dx9_42.dll
        • Size 1.8MB
        • SHA256 f8b9cfab7fffbc8f98e41aa439d72921dc180634a1febca2a9d41a0df35d3472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxdllreg_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DX9A62.tmp\dxdllreg_x86.inf
        • Size 724B
        • SHA256 54e098294ef0ad3b14b9c77642838b5992fe4573099d8397a1ef566d9e36da40
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dxupdate.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DX9A62.tmp\dxupdate.dll
        • Size 169KB
        • SHA256 4910d5e9970407c6f4db57c04a07655f01ef00bbf213e1e71a5bd9bc4a6a1c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxupdate.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DX9A62.tmp\dxupdate.inf
        • Size 11KB
        • SHA256 fa2880f64c17254de87dd088261f9f25e7552551c6360857ac6682ffab58dadf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        oct2006_d3dx9_31_x86.inf
        • Path C:\Users\Admin\AppData\Local\Temp\DX9A62.tmp\oct2006_d3dx9_31_x86.inf
        • Size 1KB
        • SHA256 a1c61096019a6ae1a9f31e3fe67aa2bb7e9e451967959d7088344f3f20ab572e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Aug2009_d3dx9_42_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\D3DX9_~1\Aug2009_d3dx9_42_x86.cab
        • Size 711KB
        • SHA256 50428a21e1e1f647586c59b9b3825812355cae5ff99d9c95c346823289691025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Oct2006_d3dx9_31_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\D3DX9_~1\Oct2006_d3dx9_31_x86.cab
        • Size 1.1MB
        • SHA256 35ec07756bdd05aa196f06350b51e3d958d39e342169a1b9168be04548ad02e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxdllreg_x86.cab
        • Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\D3DX9_~1\dxdllreg_x86.cab
        • Size 43KB
        • SHA256 e3812531b6a056ec274af869d222d86d5e95e720d14d59778972c79a8444708c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dxupdate.cab
        • Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\D3DX9_~1\dxupdate.cab
        • Size 93KB
        • SHA256 dd2a20aedc84ab4844c69d4fd144a2eb661f7597faa0fa25269cb69d1b867f9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DSETUP.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\d3dx9_31_42_x86\DSETUP.dll
        • Size 91KB
        • SHA256 2d44d36146a3982087bcdcb923bfd9213846917eea99f1e709d156ca99a68753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DXSETUP.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\d3dx9_31_42_x86\DXSETUP.exe
        • Size 513KB
        • SHA256 9c9335d2b4aaeea8e780eae30959825aa3412b15257f931d17ad8a78fccde128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dsetup32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsc5414.tmp\d3dx9_31_42_x86\dsetup32.dll
        • Size 1.6MB
        • SHA256 db85fffec4c78d3796c2a07824fd94f7ebc58d70a4fc4a18099655f016c2bbae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Dialer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\Dialer.dll
        • Size 3KB
        • SHA256 50000fc294ceee47b02cfe46c3fa8d84d7bec637a0ec45cc228c9f6127e90fef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        SHELLD~1.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\SHELLD~1.DLL
        • Size 4KB
        • SHA256 ea7800b89e49e7d7214c1405b4906f366096dfadff28d0732acb90ab2e9a99bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\System.dll
        • Size 11KB
        • SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        execDos.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\execDos.dll
        • Size 5KB
        • SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\install.ini
        • Size 984B
        • SHA256 b84c6ddb656cb5ca2ca01a417fa0463b9017b72de6ff54f0a96b3829b6515973
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 a7c5516478ab02b5d6c1684b3c2b31ee03331712bcd9f9a8ef8309d2b72c8ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\nsExec.dll
        • Size 6KB
        • SHA256 193d396fc7be5fed9d585de3c43e23d640c1dce725499f0274b3898c248545aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis_winamp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\nsis_winamp.dll
        • Size 4KB
        • SHA256 5946278545abbd0b0f5188752fe095e200c85abe0783632a00726d090c0753ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsisdl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\nsisdl.dll
        • Size 15KB
        • SHA256 1dd9cf437ce9a98db66d1132c8e116531d0b0c08b06226045652382918a23dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wadxsetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\wadxsetup.exe
        • Size 2.1MB
        • SHA256 3cc08f9d13e787779195fa04e0fc940247ff8db29f7a34108ab16f2f6c02d452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        welcomeImage.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\nshFAB9.tmp\welcomeImage.bmp
        • Size 136KB
        • SHA256 8f1c642638f7cbc829a38a2fbfea023b19492eacf96030d2d42d8538f0dc8026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        feedback.ini
        • Path C:\Users\Admin\AppData\Roaming\Winamp\Plugins\feedback.ini
        • Size 884B
        • SHA256 b481b979a63b97651e2231b684e8d98f7c8a8e77163beeea49710a90da03c566
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Winamp.ini
        • Path C:\Users\Admin\AppData\Roaming\Winamp\Winamp.ini
        • Size 238B
        • SHA256 8f930da0d27734e3dafc42f2aff3c054e31ef941a10c40548da9ba3d9a6e4584
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Winamp.q1
        • Path C:\Users\Admin\AppData\Roaming\Winamp\Winamp.q1
        • Size 4KB
        • SHA256 58065811d8e881a5087af0c9a44d2baaa9628dc3cd1b1847533dad2c35a02cf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winamp.ini
        • Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
        • Size 278B
        • SHA256 f32e1fdbbf7f51ef61642a4327ad435153164a26f233e1816b6289d1a0e67fce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        winamp.ini
        • Path C:\Users\Admin\AppData\Roaming\Winamp\winamp.ini
        • Size 301B
        • SHA256 cb4a218e8063534bb581cab0b7d80db588192f0b862bdc77cc3a4717542e1147
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DirectX.log
        • Path C:\Windows\Logs\DirectX.log
        • Size 9KB
        • SHA256 64f41648204699dd669945aefe69c185262051e40889585b0278f014ce8144a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1124-37-0x00000000069B0000-0x00000000069C1000-memory.dmp
        Download

        memory/4192-3008-0x0000000003170000-0x00000000031A7000-memory.dmp
        Download

        memory/4192-3026-0x0000000003CB0000-0x0000000003CE3000-memory.dmp
        Download

        memory/4192-3113-0x0000000003D20000-0x0000000003D42000-memory.dmp
        Download

        memory/4192-3111-0x0000000003CF0000-0x0000000003D14000-memory.dmp
        Download

        memory/4192-3122-0x0000000003D70000-0x0000000003D8C000-memory.dmp
        Download

        memory/4192-3149-0x0000000003DA0000-0x0000000003DE0000-memory.dmp
        Download

        memory/4192-3155-0x0000000003E00000-0x0000000003E17000-memory.dmp
        Download

        memory/4192-3159-0x0000000003E30000-0x0000000003E74000-memory.dmp
        Download

        memory/4192-3166-0x0000000003EA0000-0x0000000003EBE000-memory.dmp
        Download

        memory/4192-3164-0x0000000003E80000-0x0000000003E9D000-memory.dmp
        Download

        memory/4192-3197-0x0000000003F30000-0x0000000003F50000-memory.dmp
        Download

        memory/4192-3194-0x0000000003EE0000-0x0000000003F25000-memory.dmp
        Download

        memory/4192-3158-0x0000000003E20000-0x0000000003E2F000-memory.dmp
        Download

        memory/4192-3153-0x0000000003DE0000-0x0000000003DF1000-memory.dmp
        Download

        memory/4192-3120-0x0000000003D60000-0x0000000003D6E000-memory.dmp
        Download

        memory/4192-3254-0x0000000003F70000-0x0000000003F81000-memory.dmp
        Download

        memory/4192-3024-0x0000000003240000-0x0000000003259000-memory.dmp
        Download

        memory/4192-3021-0x0000000003200000-0x0000000003219000-memory.dmp
        Download

        memory/4192-3023-0x0000000003230000-0x000000000323C000-memory.dmp
        Download

        memory/4192-3018-0x00000000031E0000-0x00000000031FB000-memory.dmp
        Download

        memory/4192-3015-0x00000000008A0000-0x00000000008AA000-memory.dmp
        Download

        memory/4192-3501-0x0000000004000000-0x00000000041CF000-memory.dmp
        Download

        memory/4192-3507-0x0000000003FB0000-0x0000000003FBB000-memory.dmp
        Download

        memory/4192-3505-0x0000000004000000-0x0000000004054000-memory.dmp
        Download

        memory/4192-3510-0x0000000003FB0000-0x0000000003FC2000-memory.dmp
        Download

        memory/4192-3512-0x0000000003FB0000-0x0000000003FC2000-memory.dmp
        Download

        memory/4192-3513-0x0000000004060000-0x00000000040BB000-memory.dmp
        Download

        memory/4192-3515-0x0000000003FB0000-0x0000000003FD6000-memory.dmp
        Download

        memory/4192-3517-0x0000000003FB0000-0x0000000003FD0000-memory.dmp
        Download

        memory/4192-3518-0x0000000004060000-0x00000000040AB000-memory.dmp
        Download

        memory/4192-3521-0x0000000003FB0000-0x0000000003FBC000-memory.dmp
        Download

        memory/4192-3522-0x0000000003FB0000-0x0000000003FD5000-memory.dmp
        Download

        memory/4192-3520-0x0000000003FB0000-0x0000000003FBD000-memory.dmp
        Download

        memory/4192-3511-0x0000000003FB0000-0x0000000003FC2000-memory.dmp
        Download

        memory/4192-3509-0x0000000003FB0000-0x0000000003FDC000-memory.dmp
        Download

        memory/4192-3508-0x0000000003FB0000-0x0000000003FEB000-memory.dmp
        Download

        memory/4192-3503-0x0000000003FB0000-0x0000000003FDB000-memory.dmp
        Download

        memory/4192-3017-0x00000000031B0000-0x00000000031D9000-memory.dmp
        Download

        memory/4192-2963-0x0000000000CD0000-0x0000000000CE6000-memory.dmp
        Download

        memory/4192-2992-0x0000000002D80000-0x0000000002DEA000-memory.dmp
        Download