File name:

winamp_latest_full.exe

Full analysis: https://app.any.run/tasks/5a9b57be-f322-4158-9fc9-8bc46aeeace0
Verdict: Malicious activity
Analysis date: January 11, 2024, 18:54:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

39B72E2CBF2FB8DA961538DE3E892EBA

SHA1:

237CE8611CB8E2EDE8A5D6B982597F7E93B2CD81

SHA256:

FA09D24D7481DBDFC1CFF6AAA92D2AEC908E037A22A02346F6FEEEE5D6BA688E

SSDEEP:

393216:udNH1gz1+ZUUG9NWpHYV6ohIBfqHts7UU2wP3:udZk1vUG964V6ysUs7U/u3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Uses NETSH.EXE to change the status of the firewall

      • winamp_latest_full.exe (PID: 2084)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • winamp_latest_full.exe (PID: 2084)

    • The process creates files with name similar to system file names

      • winamp_latest_full.exe (PID: 2084)

    • Starts application with an unusual extension

      • winamp_latest_full.exe (PID: 2084)

    • Uses RUNDLL32.EXE to load library

      • winamp_latest_full.exe (PID: 2084)

    • Reads the Internet Settings

      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 2748)

  • INFO

    • Create files in a temporary directory

      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 2748)

    • Checks supported languages

      • winamp_latest_full.exe (PID: 2084)
      • Elevator.exe (PID: 1392)
      • ns1E8E.tmp (PID: 2300)
      • winamp.exe (PID: 1768)
      • Elevator.exe (PID: 2316)
      • winamp.exe (PID: 2748)

    • Reads the computer name

      • winamp_latest_full.exe (PID: 2084)
      • Elevator.exe (PID: 1392)
      • winamp.exe (PID: 1768)
      • Elevator.exe (PID: 2316)
      • winamp.exe (PID: 2748)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • winamp_latest_full.exe (PID: 2084)

    • Process drops legitimate windows executable

      • winamp_latest_full.exe (PID: 2084)

    • The process drops C-runtime libraries

      • winamp_latest_full.exe (PID: 2084)

    • Creates files in the program directory

      • winamp_latest_full.exe (PID: 2084)

    • Checks proxy server information

      • winamp_latest_full.exe (PID: 2084)

    • Process requests binary or script from the Internet

      • winamp_latest_full.exe (PID: 2084)

    • Creates files or folders in the user directory

      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 1768)
      • winamp.exe (PID: 2748)

    • Manual execution by a user

      • winamp.exe (PID: 1768)

    • Checks transactions between databases Windows and Oracle

      • winamp.exe (PID: 1768)
      • winamp.exe (PID: 2748)

    • Reads the machine GUID from the registry

      • winamp.exe (PID: 1768)
      • Elevator.exe (PID: 2316)
      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 2748)

    • Application launched itself

      • winamp.exe (PID: 1768)
      • msedge.exe (PID: 3308)

    • Drops the executable file immediately after the start

      • winamp_latest_full.exe (PID: 2084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 23:56:47+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.92.0.10042
ProductVersionNumber: 5.92.0.10042
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Visit http://www.winamp.com/ for updates.
CompanyName: Winamp SA
FileDescription: Winamp Installer
FileVersion: 5.92.0.10042
LegalCopyright: Copyright © 1997-2023 Winamp SA
LegalTrademarks: Nullsoft and Winamp are trademarks of Winamp SA
ProductName: Winamp Installer
ProductVersion: 5.92.0 Build 10042
SpecialBuild: full
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
29
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winamp_latest_full.exe elevator.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs ns1e8e.tmp no specs ping.exe no specs rundll32.exe no specs winamp.exe elevator.exe no specs winamp.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winamp_latest_full.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1584 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
532"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2680 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
668netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files\Winamp\winamp.exe" profile=private,public protocol=TCP new action=allow enable=yesC:\Windows\System32\netsh.exe—winamp_latest_full.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3836 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1552 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1392"C:\Program Files\Winamp\elevator.exe" /RegServerC:\Program Files\Winamp\Elevator.exe—winamp_latest_full.exe
User:
admin
Company:
Winamp SA
Integrity Level:
HIGH
Description:
Winamp Elevator
Exit code:
0
Version:
5,9,2,10042
Modules
Images
c:\program files\winamp\elevator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1588"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3476 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1636"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3996 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1656"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
7 527
Read events
7 250
Write events
272
Delete events
5

Modification events

(PID) Process:(668) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1772) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1936) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1816) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2084) winamp_latest_full.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\execDos.dll
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.m3u
Operation:writeName:Content Type
Value:
audio/x-mpegurl
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpegurl
Operation:delete valueName:CLSID
Value:
{cd3afa78-b84f-48f0-9393-7edc34128127}
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpegurl
Operation:writeName:Extension
Value:
.m3u
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl
Operation:delete valueName:CLSID
Value:
{cd3afa78-b84f-48f0-9393-7edc34128127}
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl
Operation:writeName:Extension
Value:
.m3u
Executable files
132
Suspicious files
341
Text files
1 045
Unknown types
3

Dropped files

PID
Process
Filename
Type
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\modern-wizard.bmpimage
MD5:2D63E33FA1CF672338A22C88FA45E6A0
SHA256:7AE875CFCB6E3B1F4A06460FBDA99D8014DC4674EE256B0B79EC656777C7E292
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\LangDLL.dllexecutable
MD5:68B287F4067BA013E34A1339AFDB1EA8
SHA256:18E8B40BA22C7A1687BD16E8D585380BC2773FFF5002D7D67E9485FCC0C51026
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\msvcp140_2.dllexecutable
MD5:06DEEA1786C951D3CC7E24A3E714FF03
SHA256:EAC4C95CD7B013E110F2CF28C08342126FE1658EF16010541F05B234D23272DD
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\vccorlib140.dllexecutable
MD5:2FB4C4168E379F13B15D4E299ECF3429
SHA256:8CD7BE490AD502C9980CB47C9A7162AFCCC088D9A2159D3BBBCED23A9BCBDA7F
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\msvcp140_atomic_wait.dllexecutable
MD5:FFB8C73E6E3769D5D8715E694707C792
SHA256:1DD7D3417FFFC321A67AAE2CA7E89A7D75203F8A3586CD829C56766F313F7931
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\nsis_winamp.dllexecutable
MD5:1E1DED1CF1C69852F2074693459FB3B5
SHA256:5946278545ABBD0B0F5188752FE095E200C85ABE0783632A00726D090C0753EC
2084winamp_latest_full.exeC:\Program Files\Winamp\paths.initext
MD5:8AD85A252352AA655F18D1B9300667B1
SHA256:FB7293E289AA918D2CBC3C362CEA48DD061B0E12616924460466F26DF28FF05C
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\vcruntime140.dllexecutable
MD5:1A84957B6E681FCA057160CD04E26B27
SHA256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
21
DNS requests
35
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2748
winamp.exe
GET
200
51.210.155.142:80
http://client.winamp.com/update/client_session.php?v=5.9.2&ID=FCFCE63B684B6D4298D6437F26BEA8D9&st1=0&st2=0&st3=0&st4=0&st5=0&st6=0&st7=0&st8=0&st9=0&st10=0&st11=0&st12=-1&st13=0&st14=0&st15=0&st16=0&st17=0&st18=0&st19=0&st20=0&st21=0&st22=0&st23=0&st24=0&st25=0&st26=0&lang=en-US
unknown
—
—
unknown
2748
winamp.exe
GET
200
51.210.155.142:80
http://client.winamp.com/update/latest-version.php?v=5.9.2.10042&ID=FCFCE63B684B6D4298D6437F26BEA8D9&lang=en-US&osver=6.1.7601&allowedchannel=0
unknown
text
111 b
unknown
2084
winamp_latest_full.exe
GET
404
5.39.58.65:80
http://download.nullsoft.com/redist/dx/d3dx9_31_42_x86_embed.exe
unknown
html
162 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2084
winamp_latest_full.exe
5.39.58.65:80
download.nullsoft.com
OVH SAS
FR
unknown
2748
winamp.exe
51.210.155.142:80
client.winamp.com
OVH SAS
GB
unknown
3516
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3308
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3516
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3516
msedge.exe
20.105.95.163:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3516
msedge.exe
23.32.238.73:443
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.16.196
whitelisted
download.nullsoft.com
  • 5.39.58.65
unknown
client.winamp.com
  • 51.210.155.142
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
services.winamp.com
  • —
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
google.com
  • 142.250.185.174
  • 172.217.18.14
whitelisted
data-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 23.32.238.73
  • 2.19.198.203
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
Process
Message
winamp_latest_full.exe
Directory page leave!!!
winamp.exe
>
winamp.exe
>
winamp.exe
winamp.exe
MP2
winamp.exe
AIFF
winamp.exe
NSA
winamp.exe
MP3
winamp.exe
AAC
winamp.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winamp_latest_full.exe