File name:

d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe

Full analysis: https://app.any.run/tasks/be151452-d5e6-405b-80f7-552f85fa3378
Verdict: Malicious activity
Analysis date: May 07, 2024, 13:26:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5E2C2A07D288B2A67A24C5C819638FA3

SHA1:

F42CB38B5E484488BDD246A6F2BF232C759145C0

SHA256:

D3FB6988C1115FE615D695F938FFBD67AD0E9D7D33C48015F2C6F96604321AE2

SSDEEP:

98304:55S1YRutPVtWwOrAkjE3kPfEhJwFW6lErK+EvOWrn6T3R+7xb+4SNp28X1eRRWBW:stseLgIaBc4wybVSInj2WIv9kGehD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe (PID: 6524)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • msiexec.exe (PID: 4148)
      • vcredist_x86.exe (PID: 5520)

    • Creates a writable file in the system directory

      • msiexec.exe (PID: 4148)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6544)

    • Reads security settings of Internet Explorer

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6544)
      • Setup.exe (PID: 5836)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • MP3jam.exe (PID: 3912)

    • Executable content was dropped or overwritten

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe (PID: 6524)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • vcredist_x86.exe (PID: 5520)

    • Reads the Windows owner or organization settings

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • msiexec.exe (PID: 4148)

    • Process drops legitimate windows executable

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • vcredist_x86.exe (PID: 5520)
      • msiexec.exe (PID: 4148)

    • Starts a Microsoft application from unusual location

      • vcredist_x86.exe (PID: 5520)

    • Blank space has been found in the path

      • Setup.exe (PID: 5836)
      • msiexec.exe (PID: 4148)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 4148)
      • Setup.exe (PID: 5836)
      • MP3jam.exe (PID: 3912)

    • Creates file in the systems drive root

      • vcredist_x86.exe (PID: 5520)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 4148)

    • Process requests binary or script from the Internet

      • MP3jam.exe (PID: 3912)

    • Adds/modifies Windows certificates

      • MP3jam.exe (PID: 3912)

  • INFO

    • Create files in a temporary directory

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe (PID: 6524)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe (PID: 6616)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • Setup.exe (PID: 5836)

    • Checks supported languages

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe (PID: 6524)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6544)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe (PID: 6616)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • vcredist_x86.exe (PID: 5520)
      • msiexec.exe (PID: 4148)
      • Setup.exe (PID: 5836)
      • MP3jam.exe (PID: 3912)
      • FM.Player.EService.exe (PID: 7212)
      • identity_helper.exe (PID: 7476)

    • Reads the computer name

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6544)
      • vcredist_x86.exe (PID: 5520)
      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • msiexec.exe (PID: 4148)
      • Setup.exe (PID: 5836)
      • MP3jam.exe (PID: 3912)
      • FM.Player.EService.exe (PID: 7212)
      • identity_helper.exe (PID: 7476)

    • Process checks computer location settings

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6544)

    • Creates a software uninstall entry

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • msiexec.exe (PID: 4148)

    • Creates files or folders in the user directory

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • msiexec.exe (PID: 4148)
      • MP3jam.exe (PID: 3912)

    • Creates files in the program directory

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)

    • Reads the machine GUID from the registry

      • vcredist_x86.exe (PID: 5520)
      • Setup.exe (PID: 5836)
      • msiexec.exe (PID: 4148)
      • MP3jam.exe (PID: 3912)
      • FM.Player.EService.exe (PID: 7212)

    • Reads CPU info

      • Setup.exe (PID: 5836)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4148)

    • Reads the software policy settings

      • Setup.exe (PID: 5836)
      • msiexec.exe (PID: 4148)
      • MP3jam.exe (PID: 3912)
      • slui.exe (PID: 5528)

    • Reads Microsoft Office registry keys

      • d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp (PID: 6648)
      • msedge.exe (PID: 6592)
      • msedge.exe (PID: 3728)

    • Application launched itself

      • msedge.exe (PID: 6592)
      • msedge.exe (PID: 3728)

    • Manual execution by a user

      • msedge.exe (PID: 3728)

    • Reads Environment values

      • MP3jam.exe (PID: 3912)
      • FM.Player.EService.exe (PID: 7212)

    • Checks proxy server information

      • MP3jam.exe (PID: 3912)
      • FM.Player.EService.exe (PID: 7212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:01:30 14:21:56+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 65024
InitializedDataSize: 142336
UninitializedDataSize: -
EntryPoint: 0x113bc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.1.6.10
ProductVersionNumber: 1.1.6.10
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: MP3jam
FileDescription: MP3jam Setup
FileVersion: 1.1.6.10
LegalCopyright:
ProductName: MP3jam
ProductVersion: 1.1.6.10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
58
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp no specs d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp vcredist_x86.exe sppextcomobj.exe no specs setup.exe slui.exe msiexec.exe mp3jam.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs fm.player.eservice.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs filecoauth.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
428"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3500 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7128 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1272"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5504 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1964"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5300 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1984"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3520 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2104"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6804 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5260 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2484"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2460 --field-trial-handle=2384,i,4297177819669840763,15603346202592096211,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument http://www.mp3jam.org/installation.php?v=1.1.6.10&hl=en&net=1&invited_id=7f5ecb45-0c75-11ef-b4e0-18f7786f96e&user_guid=049b96f4-2271-4f48-8f5e-1822b707a7a1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3912"C:\Program Files (x86)\MP3jam\MP3jam.exe"C:\Program Files (x86)\MP3jam\MP3jam.exe
d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp
User:
admin
Company:
MP3jam
Integrity Level:
HIGH
Description:
MP3jam
Version:
1.1.6.10
Modules
Images
c:\program files (x86)\mp3jam\mp3jam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
34 412
Read events
33 967
Write events
421
Delete events
24

Modification events

(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
F8190000553C7B3F82A0DA01
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
E5998A7B0F105270BE95662F692F8EEAD036762CC35C0E11AE4BCE373DD244F1
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{130F8154-E804-4BD5-A07B-35BE69039715}\{
Operation:writeName:{59868CD9-FD8B-473E-82CA-BF4A3CDAC1BB}
Value:
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAKHER/5NRlUyTj8xNqlDxBgAAAAACAAAA AAAQZgAAAAEAACAAAACpy+cXeyHLeIJWkGr4ril8mxBHXJTiAQiGbCDAV3DmOQAA AAAOgAAAAAIAACAAAAA7Y12A/ALWYOdTV+Q7Fzqb5Pb7O3ZPytGZ3i1Oe92KhDAA AADJDALgZ/0Abp8c2f8Rx0ONCCtAzH8tiVInrvW9bpzCzhGtvhrT3UbJ6SQJDrEV NKBAAAAAcTwWU/uT1trkesMSC3344TtFrWDTS5vwHyvVZsR4lVnA8e6ps2pvnlNW V5dMg3+Xyji5JdD24Q1vcbXwJAfgRQ==
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\MP3Jam\SystemSettings
Operation:writeName:UserId
Value:
049b96f4-2271-4f48-8f5e-1822b707a7a1
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files (x86)\MP3jam\bass.dll
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
1E3273AC339FC8EB439005C0A21A342F13D63997E3A188A8D3E9360D31E14B8D
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\MP3Jam\UserSettings
Operation:writeName:Culture
Value:
en-US
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\MP3Jam\SystemSettings
Operation:writeName:IsYoutubeContentEnabled
Value:
True
(PID) Process:(6648) d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpKey:HKEY_CURRENT_USER\SOFTWARE\MP3Jam\SystemSettings
Operation:writeName:IsVkContentEnabled
Value:
True
Executable files
104
Suspicious files
112
Text files
97
Unknown types
7

Dropped files

PID
Process
Filename
Type
6616d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exeC:\Users\admin\AppData\Local\Temp\is-3638R.tmp\d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmp —
MD5:—
SHA256:—
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Program Files (x86)\MP3jam\unins000.exe —
MD5:—
SHA256:—
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Program Files (x86)\MP3jam\is-FEOFJ.tmp —
MD5:—
SHA256:—
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Program Files (x86)\MP3jam\is-3SHUM.tmp —
MD5:—
SHA256:—
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Program Files (x86)\MP3jam\FM.Miscellaneous.dll —
MD5:—
SHA256:—
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Program Files (x86)\MP3jam\is-0QIUV.tmp —
MD5:—
SHA256:—
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Users\admin\AppData\Local\Temp\is-E8F39.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Program Files (x86)\MP3jam\FM.Player.AudioExtractor.dll —
MD5:—
SHA256:—
6648d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpC:\Program Files (x86)\MP3jam\is-MFLL1.tmp —
MD5:—
SHA256:—
6524d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exeC:\Users\admin\AppData\Local\Temp\is-EMC8C.tmp\d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.tmpexecutable
MD5:A1DB3BFE17FF1C412EBBC225B78C142B
SHA256:2C57CB18206F55845A4C39AA14F2B0203E5882602EE280CC7F8D62B55E2C3A7D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
96
DNS requests
86
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7880
svchost.exe
HEAD
200
2.18.31.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2160a134-ce8c-414e-9f8c-def62796bce9?P1=1715382046&P2=404&P3=2&P4=TMSz78akqk2XQVmCX1SHTneygw9HRUoN7VNoC48ZmF1bB4X3Dy8QLc5k%2fRYyWSy340gop9AfZruXVj%2f8kNBA9A%3d%3d
unknown
—
—
unknown
7880
svchost.exe
GET
206
2.18.31.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2135bc6b-a3ff-466d-9f49-24f84965e4d6?P1=1715382046&P2=404&P3=2&P4=nMnqgW3mypiO7oaBak%2fOzWy0Xdw3LfMOLe%2bcMhhFS%2bdi2%2bBQu6hxexMqqqzjsN%2b5BnDzXRn5insHwR%2bJRygSEQ%3d%3d
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
5204
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
6868
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
4148
msiexec.exe
GET
200
23.38.123.213:80
http://crl.microsoft.com/pki/crl/products/CSPCA.crl
unknown
—
—
unknown
3912
MP3jam.exe
GET
200
188.114.97.3:80
http://download2.mp3jam.org/configs/lastfm_keys.json
unknown
—
—
unknown
6204
SIHClient.exe
GET
200
23.202.106.44:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
6204
SIHClient.exe
GET
200
23.202.106.44:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
3912
MP3jam.exe
GET
200
52.73.251.235:80
http://decipher.mp3jam.org/SignatureDecoder/decoder.php?getDecipherCode
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5140
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4680
SearchApp.exe
23.38.123.147:443
www.bing.com
AKAMAI-AS
US
unknown
4680
SearchApp.exe
23.38.123.159:443
www.bing.com
AKAMAI-AS
US
unknown
4680
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5204
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5204
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 23.38.123.159
  • 23.38.123.158
  • 23.38.123.152
  • 23.38.123.154
  • 23.38.123.150
  • 23.38.123.153
  • 23.38.123.147
  • 23.38.123.160
  • 23.38.123.157
  • 23.38.123.171
  • 23.38.123.176
  • 23.38.123.179
  • 23.38.123.170
  • 23.38.123.178
  • 23.38.123.185
  • 23.38.123.181
  • 23.38.123.174
  • 23.38.123.172
  • 23.38.123.135
  • 23.38.123.187
  • 23.38.123.132
  • 23.38.123.136
  • 23.38.123.134
  • 23.38.123.130
  • 23.38.123.184
  • 23.38.123.133
whitelisted
r.bing.com
  • 23.38.123.147
  • 23.38.123.153
  • 23.38.123.159
  • 23.38.123.150
  • 23.38.123.152
  • 23.38.123.154
  • 23.38.123.158
  • 23.38.123.157
  • 23.38.123.160
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.20
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.202.105.221
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.38.123.213
  • 23.38.123.236
whitelisted

Threats

No threats detected
Process
Message
Setup.exe
The operation completed successfully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d3fb6988c1115fe615d695f938ffbd67ad0e9d7d33c48015f2c6f96604321ae2.exe