File name:

winamp_latest_full.exe

Full analysis: https://app.any.run/tasks/5a9b57be-f322-4158-9fc9-8bc46aeeace0
Verdict: Malicious activity
Analysis date: January 11, 2024, 18:54:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

39B72E2CBF2FB8DA961538DE3E892EBA

SHA1:

237CE8611CB8E2EDE8A5D6B982597F7E93B2CD81

SHA256:

FA09D24D7481DBDFC1CFF6AAA92D2AEC908E037A22A02346F6FEEEE5D6BA688E

SSDEEP:

393216:udNH1gz1+ZUUG9NWpHYV6ohIBfqHts7UU2wP3:udZk1vUG964V6ysUs7U/u3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • winamp_latest_full.exe (PID: 2084)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • winamp_latest_full.exe (PID: 2084)

    • Reads the Internet Settings

      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 2748)

    • Uses RUNDLL32.EXE to load library

      • winamp_latest_full.exe (PID: 2084)

    • Uses NETSH.EXE to change the status of the firewall

      • winamp_latest_full.exe (PID: 2084)

    • Starts application with an unusual extension

      • winamp_latest_full.exe (PID: 2084)

  • INFO

    • Create files in a temporary directory

      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 2748)

    • Checks supported languages

      • winamp_latest_full.exe (PID: 2084)
      • Elevator.exe (PID: 1392)
      • ns1E8E.tmp (PID: 2300)
      • winamp.exe (PID: 1768)
      • Elevator.exe (PID: 2316)
      • winamp.exe (PID: 2748)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • winamp_latest_full.exe (PID: 2084)

    • Reads the computer name

      • winamp_latest_full.exe (PID: 2084)
      • Elevator.exe (PID: 1392)
      • winamp.exe (PID: 1768)
      • Elevator.exe (PID: 2316)
      • winamp.exe (PID: 2748)

    • Process drops legitimate windows executable

      • winamp_latest_full.exe (PID: 2084)

    • Checks proxy server information

      • winamp_latest_full.exe (PID: 2084)

    • The process drops C-runtime libraries

      • winamp_latest_full.exe (PID: 2084)

    • Creates files in the program directory

      • winamp_latest_full.exe (PID: 2084)

    • Process requests binary or script from the Internet

      • winamp_latest_full.exe (PID: 2084)

    • Creates files or folders in the user directory

      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 1768)
      • winamp.exe (PID: 2748)

    • Manual execution by a user

      • winamp.exe (PID: 1768)

    • Application launched itself

      • winamp.exe (PID: 1768)
      • msedge.exe (PID: 3308)

    • Reads the machine GUID from the registry

      • winamp.exe (PID: 1768)
      • Elevator.exe (PID: 2316)
      • winamp_latest_full.exe (PID: 2084)
      • winamp.exe (PID: 2748)

    • Checks transactions between databases Windows and Oracle

      • winamp.exe (PID: 1768)
      • winamp.exe (PID: 2748)

    • Drops the executable file immediately after the start

      • winamp_latest_full.exe (PID: 2084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 23:56:47+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.92.0.10042
ProductVersionNumber: 5.92.0.10042
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Visit http://www.winamp.com/ for updates.
CompanyName: Winamp SA
FileDescription: Winamp Installer
FileVersion: 5.92.0.10042
LegalCopyright: Copyright © 1997-2023 Winamp SA
LegalTrademarks: Nullsoft and Winamp are trademarks of Winamp SA
ProductName: Winamp Installer
ProductVersion: 5.92.0 Build 10042
SpecialBuild: full
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
29
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winamp_latest_full.exe elevator.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs ns1e8e.tmp no specs ping.exe no specs rundll32.exe no specs winamp.exe elevator.exe no specs winamp.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winamp_latest_full.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1584 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
532"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2680 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
668netsh advfirewall firewall set rule name="Winamp" dir=in program="C:\Program Files\Winamp\winamp.exe" profile=private,public protocol=TCP new action=allow enable=yesC:\Windows\System32\netsh.exe—winamp_latest_full.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3836 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1552 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1392"C:\Program Files\Winamp\elevator.exe" /RegServerC:\Program Files\Winamp\Elevator.exe—winamp_latest_full.exe
User:
admin
Company:
Winamp SA
Integrity Level:
HIGH
Description:
Winamp Elevator
Exit code:
0
Version:
5,9,2,10042
Modules
Images
c:\program files\winamp\elevator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1588"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3476 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1636"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3996 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1656"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1276,i,17501393353621442856,6040614210085997104,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
7 527
Read events
7 250
Write events
272
Delete events
5

Modification events

(PID) Process:(668) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1772) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1936) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1816) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2084) winamp_latest_full.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\execDos.dll
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.m3u
Operation:writeName:Content Type
Value:
audio/x-mpegurl
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpegurl
Operation:delete valueName:CLSID
Value:
{cd3afa78-b84f-48f0-9393-7edc34128127}
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpegurl
Operation:writeName:Extension
Value:
.m3u
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl
Operation:delete valueName:CLSID
Value:
{cd3afa78-b84f-48f0-9393-7edc34128127}
(PID) Process:(2316) Elevator.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl
Operation:writeName:Extension
Value:
.m3u
Executable files
132
Suspicious files
341
Text files
1 045
Unknown types
3

Dropped files

PID
Process
Filename
Type
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\vcruntime140.dllexecutable
MD5:1A84957B6E681FCA057160CD04E26B27
SHA256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\nsis_winamp.dllexecutable
MD5:1E1DED1CF1C69852F2074693459FB3B5
SHA256:5946278545ABBD0B0F5188752FE095E200C85ABE0783632A00726D090C0753EC
2084winamp_latest_full.exeC:\Program Files\Winamp\paths.initext
MD5:8AD85A252352AA655F18D1B9300667B1
SHA256:FB7293E289AA918D2CBC3C362CEA48DD061B0E12616924460466F26DF28FF05C
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\msvcp140_1.dllexecutable
MD5:C946A9E4170F6B16D25C822DA616DC6A
SHA256:65BDADB5562B9473471740B1DCD8B064459A40D71A1A11FC5AEDAA855FE7635A
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\msvcp140.dllexecutable
MD5:8FF1898897F3F4391803C7253366A87B
SHA256:51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC90.CRT\msvcr90.dllexecutable
MD5:CDBE9690CF2B8409FACAD94FAC9479C9
SHA256:8E7FE1A1F3550C479FFD86A77BC9D10686D47F8727025BB891D8F4F0259354C8
2084winamp_latest_full.exeC:\Users\admin\AppData\Local\Temp\nsx1C3.tmp\install.initext
MD5:385081D5FEEE87A4ED1A6E5DCEE85F36
SHA256:BDC6FB93206C1E7A590F2D4E97D0DAB7D3BADAF8B4E1A7B8487E9CF59F05EDDC
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\msvcp140_atomic_wait.dllexecutable
MD5:FFB8C73E6E3769D5D8715E694707C792
SHA256:1DD7D3417FFFC321A67AAE2CA7E89A7D75203F8A3586CD829C56766F313F7931
2084winamp_latest_full.exeC:\Program Files\Winamp\Microsoft.VC142.CRT\msvcp140_2.dllexecutable
MD5:06DEEA1786C951D3CC7E24A3E714FF03
SHA256:EAC4C95CD7B013E110F2CF28C08342126FE1658EF16010541F05B234D23272DD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
21
DNS requests
35
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2748
winamp.exe
GET
200
51.210.155.142:80
http://client.winamp.com/update/latest-version.php?v=5.9.2.10042&ID=FCFCE63B684B6D4298D6437F26BEA8D9&lang=en-US&osver=6.1.7601&allowedchannel=0
unknown
text
111 b
unknown
2748
winamp.exe
GET
200
51.210.155.142:80
http://client.winamp.com/update/client_session.php?v=5.9.2&ID=FCFCE63B684B6D4298D6437F26BEA8D9&st1=0&st2=0&st3=0&st4=0&st5=0&st6=0&st7=0&st8=0&st9=0&st10=0&st11=0&st12=-1&st13=0&st14=0&st15=0&st16=0&st17=0&st18=0&st19=0&st20=0&st21=0&st22=0&st23=0&st24=0&st25=0&st26=0&lang=en-US
unknown
—
—
unknown
2084
winamp_latest_full.exe
GET
404
5.39.58.65:80
http://download.nullsoft.com/redist/dx/d3dx9_31_42_x86_embed.exe
unknown
html
162 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2084
winamp_latest_full.exe
5.39.58.65:80
download.nullsoft.com
OVH SAS
FR
unknown
2748
winamp.exe
51.210.155.142:80
client.winamp.com
OVH SAS
GB
unknown
3516
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3308
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3516
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3516
msedge.exe
20.105.95.163:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3516
msedge.exe
23.32.238.73:443
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 172.217.16.196
whitelisted
download.nullsoft.com
  • 5.39.58.65
unknown
client.winamp.com
  • 51.210.155.142
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
services.winamp.com
  • —
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
google.com
  • 142.250.185.174
  • 172.217.18.14
whitelisted
data-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 23.32.238.73
  • 2.19.198.203
whitelisted

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
Process
Message
winamp_latest_full.exe
Directory page leave!!!
winamp.exe
>
winamp.exe
>
winamp.exe
winamp.exe
MP2
winamp.exe
AIFF
winamp.exe
NSA
winamp.exe
MP3
winamp.exe
AAC
winamp.exe
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winamp_latest_full.exe