File name:

minilyrics.exe

Full analysis: https://app.any.run/tasks/f6644667-1e61-40f6-a07a-b56c1e6ea7bc
Verdict: Malicious activity
Analysis date: July 27, 2025, 10:50:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

9D1FBD46B34A9DEF27AAF10DA70D411A

SHA1:

A7F4AA4C24C56937E2D8B8E2FF0B73CA5BE6E634

SHA256:

2E79ED96EB81B188007508370B88351A61A32BD1EA03A711C9F4ECB58B6975C7

SSDEEP:

98304:TsMLakHvtn0mtnFIuVRYlt5l1qyQr+6uQ6AuMNHdXsCJZnLwHjOfmGOlE9p4dvme:XvSJOUaI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • MiniLyrics.exe (PID: 4540)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • minilyrics.exe (PID: 2220)

    • There is functionality for taking screenshot (YARA)

      • minilyrics.exe (PID: 2220)

    • Executable content was dropped or overwritten

      • minilyrics.exe (PID: 2220)
      • MiniLyrics.exe (PID: 4540)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6504)
      • regsvr32.exe (PID: 1800)
      • regsvr32.exe (PID: 1036)
      • regsvr32.exe (PID: 2400)

    • Creates file in the systems drive root

      • MiniLyrics.exe (PID: 4540)

  • INFO

    • Reads the computer name

      • minilyrics.exe (PID: 2220)
      • MiniLyrics.exe (PID: 4540)

    • Checks supported languages

      • minilyrics.exe (PID: 2220)
      • MiniLyrics.exe (PID: 4540)

    • Creates files in the program directory

      • minilyrics.exe (PID: 2220)
      • MiniLyrics.exe (PID: 4540)

    • Creates files or folders in the user directory

      • minilyrics.exe (PID: 2220)
      • MiniLyrics.exe (PID: 4540)

    • Create files in a temporary directory

      • minilyrics.exe (PID: 2220)

    • Checks proxy server information

      • MiniLyrics.exe (PID: 4540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 22:50:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 119808
UninitializedDataSize: 1024
EntryPoint: 0x323c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.7.49.0
ProductVersionNumber: 7.7.49.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
CompanyName: Crintsoft
FileDescription: Automatic lyrics display for your favorite songs.
FileVersion: 7.7.49
LegalCopyright: Crintsoft
ProductName: MiniLyrics
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start minilyrics.exe minilyrics.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs minilyrics.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1036 /s "C:\Program Files (x86)\MiniLyrics\Player-Plugins\x64\PluginWMPVis.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1128regsvr32 /s "C:\Program Files (x86)\MiniLyrics\Player-Plugins\x64\WMPLyrics.dll"C:\Windows\SysWOW64\regsvr32.exe—MiniLyrics.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1204regsvr32 /s "C:\Program Files (x86)\MiniLyrics\Player-Plugins\x64\PluginWMPVis.dll"C:\Windows\SysWOW64\regsvr32.exe—MiniLyrics.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1800 /s "C:\Program Files (x86)\MiniLyrics\Player-Plugins\x64\WMPLyrics.dll"C:\Windows\System32\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2220"C:\Users\admin\AppData\Local\Temp\minilyrics.exe" C:\Users\admin\AppData\Local\Temp\minilyrics.exe
explorer.exe
User:
admin
Company:
Crintsoft
Integrity Level:
HIGH
Description:
Automatic lyrics display for your favorite songs.
Exit code:
0
Version:
7.7.49
Modules
Images
c:\users\admin\appdata\local\temp\minilyrics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2400regsvr32 /s "C:\Program Files (x86)\MiniLyrics\Player-Plugins\PluginWMPVis.dll"C:\Windows\SysWOW64\regsvr32.exe—MiniLyrics.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4540"C:\Program Files (x86)\MiniLyrics\MiniLyrics.exe" /SetupC:\Program Files (x86)\MiniLyrics\MiniLyrics.exe
minilyrics.exe
User:
admin
Company:
Crintsoft
Integrity Level:
HIGH
Description:
MiniLyrics - Display lyrics automatically
Exit code:
1
Version:
7.7.49
Modules
Images
c:\program files (x86)\minilyrics\minilyrics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
6264"C:\Users\admin\AppData\Local\Temp\minilyrics.exe" C:\Users\admin\AppData\Local\Temp\minilyrics.exe—explorer.exe
User:
admin
Company:
Crintsoft
Integrity Level:
MEDIUM
Description:
Automatic lyrics display for your favorite songs.
Exit code:
3221226540
Version:
7.7.49
Modules
Images
c:\users\admin\appdata\local\temp\minilyrics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6504regsvr32 /s "C:\Program Files (x86)\MiniLyrics\Player-Plugins\WMPLyrics.dll"C:\Windows\SysWOW64\regsvr32.exe—MiniLyrics.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
3 062
Read events
3 038
Write events
24
Delete events
0

Modification events

(PID) Process:(2220) minilyrics.exeKey:HKEY_CURRENT_USER\MUI_LANGDLL_REGISTRY_KEY
Operation:writeName:MUI_LANGDLL_REGISTRY_VALUENAME
Value:
1033
(PID) Process:(2220) minilyrics.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MiniLyrics
Operation:writeName:DisplayName
Value:
MiniLyrics
(PID) Process:(2220) minilyrics.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MiniLyrics
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\MiniLyrics\uninst-ml.exe
(PID) Process:(2220) minilyrics.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MiniLyrics
Operation:writeName:DisplayVersion
Value:
7.7.49
(PID) Process:(2220) minilyrics.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MiniLyrics
Operation:writeName:Publisher
Value:
Crintsoft
(PID) Process:(2220) minilyrics.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MiniLyrics
Operation:writeName:InstallSource
Value:
C:\Users\admin\AppData\Local\Temp\
(PID) Process:(2220) minilyrics.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MiniLyrics
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\MiniLyrics\uninst-ml.exe"
(PID) Process:(2220) minilyrics.exeKey:HKEY_CURRENT_USER\SOFTWARE\MiniLyrics
Operation:writeName:InstallerLanguage
Value:
1033
(PID) Process:(2400) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4580AB54-3C2F-4970-9A77-8628FA182F03}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2400) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\MediaPlayer\Objects\Effects\PluginWMPVis\Properties
Operation:writeName:classid
Value:
{4580AB54-3C2F-4970-9A77-8628FA182F03}
Executable files
22
Suspicious files
10
Text files
211
Unknown types
0

Dropped files

PID
Process
Filename
Type
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\MB_MiniLyrics.dllexecutable
MD5:359D308F559BE896CED0A55AEA1670B9
SHA256:F2E9DE4EECF4BABFD0EB6251C38B625E1E14BD14AB62AB70D5F2A81F1BF14D24
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\iTunesMinilyrics.dllexecutable
MD5:0E27FDA1407ACFC255AF43FAB578DC04
SHA256:A8078D8CD3CE5E753C18841DDCE410B66C94E4D916E467FBC9F464D97E29D193
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\MiniLyrics' Homepage.url.urlbinary
MD5:0C457D9E6ACA39ACF9C8F9EE213143F9
SHA256:8280C57AE542EE7595153CE463FD0A3F022A439EA00ACBBA6487C173FDB76318
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\MiniLyrics.exeexecutable
MD5:1659A5B5A1CD49D3CBA379C6CBDC8C02
SHA256:528CF6328D74C1C670E61A627FBB3102BAD8018DC0ECD685489AD1706B00F8F1
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\xmp-ml.dllexecutable
MD5:63F94433CE2C961A0BDA0CA98F2B69F4
SHA256:38BB899795AC09A13A95C87CAFF7098391F5064EBEFEEDBF09AA74429C8191C1
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\MLPluginBsp.dllexecutable
MD5:663BFD15308B01DF83851E3DA057EC12
SHA256:1B5C3CFCEB9A561186CF5CE7A93F350D100E8B8F209372CCB1758AF128AFEB89
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\foo_ui_minilyrics.dllexecutable
MD5:D12DC025E1EEF77923590D939F06EAC8
SHA256:31E111583C24089F1CA08DAE06153761EAE4751C872E759684D77A993ED5FB85
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\QCDMinilyrics.dllexecutable
MD5:9446602CDB812882549B04E1ADFDEE13
SHA256:81CEE5A67C51C8D9777826F61D85FAA553F77A65269F224DA44379815C6393B9
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\WmpLyrics.dllexecutable
MD5:489970541BD8841C26809362703AAF61
SHA256:5B7DA7CD7E000CDA1C9057510644D250E479B557F576C2E1446DDD6FA9438E90
2220minilyrics.exeC:\Program Files (x86)\MiniLyrics\Player-Plugins\PluginSilverjuke.dllexecutable
MD5:6D7D8F74ACEFE23F4E02D5CCC07CC209
SHA256:75E41488500B13756E2ADAD69DDAA0F22790E576B0A3A775EF85235A1072649D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
14
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1468
svchost.exe
GET
200
184.24.0.227:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.10.249.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.19.221.196:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2992
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1468
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1468
svchost.exe
184.24.0.227:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.10.249.17:80
crl.microsoft.com
Akamai International B.V.
CH
whitelisted
1268
svchost.exe
2.19.221.196:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.78
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.130
  • 20.190.159.128
  • 20.190.159.131
  • 40.126.31.130
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 184.24.0.227
whitelisted
crl.microsoft.com
  • 23.10.249.17
  • 23.10.249.24
whitelisted
www.microsoft.com
  • 2.19.221.196
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
minilyrics.exe