752d952260fe13a1f8dfaf75f6463efbe8f9aa66fa5f46e6b98add5790aa9787

Analysis

max time kernel
139s
max time network
221s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
25/02/2024, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer_9.0.66.3.exe
Size 652.0MB
Sample240225-vxajsagg98
SHA256 752d952260fe13a1f8dfaf75f6463efbe8f9aa66fa5f46e6b98add5790aa9787
MD5 443e4281ac364c647109557995e0facc
SHA1 1b55ecba28da03d40c68080853799a16922ba5b1
SHA512 5405d8791a7f764f35016cb09d575f8ff5f8b8cf6ce5b888e228612be57e0fd111a54ab8f64fc76e86f25e685f544a282a3b820d8502358dd50956f68b2ceb91
SSDEEP 12582912:ZbIjCC/+e6Qjo65Vo70B0iPWJvoxF6ohfsKlUxFXcuqzMh:ttCCKVomGhCzlYeAh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.3\DefaultId = "{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000\FuncName = "WVTAsn1SpcSpAgencyInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2\FuncName = "WVTAsn1IntentToSealAttributeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPCreateIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003\FuncName = "WVTAsn1SpcIndirectDataContentDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustFinalPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004\FuncName = "WVTAsn1SpcPeImageDataEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002\FuncName = "WVTAsn1SpcFinancialCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002\FuncName = "WVTAsn1SpcFinancialCriteriaInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3\Dll = "WINTRUST.DLL"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLREMOVESIGNEDDATAMSG\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\FuncName = "WVTAsn1CatNameValueDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubDumpStructure"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\FuncName = "DecodeRecipientID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007\FuncName = "WVTAsn1SpcSpOpusInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLVERIFYINDIRECTDATA\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
1532	icacls.exe
1412	takeown.exe
3360	icacls.exe
2112	takeown.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1412	takeown.exe
3360	icacls.exe
2112	takeown.exe
1532	icacls.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\VBoxSVGA3D.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ldutils.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxNetLwf.inf	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-synch-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-multibyte-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-conio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\dpinst_86.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-interlocked-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-util-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPLoggerCtl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-synch-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-process-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libOpenglRender.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetFltUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxGuestControlSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_V2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-math-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_CM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxNetLwf.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxRT-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-rtlsupport-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\regsvr32_x64.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxGuestPropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcp100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-file-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuth.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-conio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxSup.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-synch-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-stdio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup-PreW10.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-multibyte-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletion.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-runtime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-utility-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\EGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-rtlsupport-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\dasync.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\ossltest.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9VMMR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxCAPI.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxRT.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-util-l1-1-0.dll	dnrepairer.exe
File opened for modification	C:\Program Files\ldplayer9box\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdp6Install.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxBugReport.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetNAT.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-heap-l1-1-0.dll	dnrepairer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Executes dropped EXE 3 IoCs

pid	Process
4336	dnrepairer.exe
468	dismhost.exe
4324	Ld9BoxSVC.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1792	sc.exe
1016	sc.exe
4552	sc.exe
4264	sc.exe
3092	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
4336	dnrepairer.exe
4336	dnrepairer.exe
4336	dnrepairer.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
468	dismhost.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
4324	Ld9BoxSVC.exe
1448	regsvr32.exe
1448	regsvr32.exe
1448	regsvr32.exe
1448	regsvr32.exe
1448	regsvr32.exe
1448	regsvr32.exe
1448	regsvr32.exe
1448	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
3656	regsvr32.exe
1280	regsvr32.exe
1280	regsvr32.exe
1280	regsvr32.exe
1280	regsvr32.exe
1280	regsvr32.exe
1280	regsvr32.exe
1280	regsvr32.exe
1280	regsvr32.exe
2544	regsvr32.exe
2544	regsvr32.exe

Registers COM server for autorun 1 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxProxyStub.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32\ = "\"C:\\Program Files\\ldplayer9box\\Ld9BoxSVC.exe\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133533555196581496"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0979-486C-BAA1-3ABB144DC82D}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1F04-4191-AA2F-1FAC9646AE4C}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7193-426C-A41F-522E8F537FA0}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-929C-40E8-BF16-FEA557CD8E7E}\ = "ISystemProperties"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-80E1-4A8A-93A1-67C5F92A838A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80E1-4A8A-93A1-67C5F92A838A}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7F29-4AAE-A627-5A282C83092C}\ = "INATNetworkSettingEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9849-4F47-813E-24A75DC85615}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6588-40A3-9B0A-68C05BA52C4B}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-929C-40E8-BF16-FEA557CD8E7E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F7B7-4B05-900E-2A9253C00F51}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F4F4-4DD0-9D30-C89B873247EC}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8079-447A-A33E-47A69C7980DB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-BF98-47FB-AB2F-B5177533F493}\ = "IStorageController"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-DAD4-4496-85CF-3F76BCB3B5FA}\NumMethods\ = "30"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3CF5-4C0A-BC90-9B8D4CC94D89}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-416B-4181-8C4A-45EC95177AEF}\NumMethods\ = "19"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-48DF-438D-85EB-98FFD70D18C9}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-2F1A-4D6C-81FC-E3FA843F49AE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6038-422C-B45E-6D4A0503D9F1}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0979-486C-BAA1-3ABB144DC82D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1207-4179-94CF-CA250036308F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6679-422A-B629-51B06B0C6D93}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E8A-11E9-8082-DB8AE479EF87}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-00C2-4484-0077-C057003D9C90}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CC87-4F6E-A0E9-47BB7F2D4BE5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1EC0-4C0F-857F-FBE2A737A256}\ = "IGuestUserStateChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8079-447A-A33E-47A69C7980DB}\NumMethods\ = "15"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FEBE-4049-B476-1292A8E45B09}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-BF98-47FB-AB2F-B5177533F493}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C6FA-430E-6020-6A505D086387}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0C60-11EA-A0EA-07EB0D1C4EAD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CC87-4F6E-A0E9-47BB7F2D4BE5}\NumMethods	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBoxClient.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-FD1C-411A-95C5-E9BB1414E632}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox\CLSID\ = "{20191216-47b9-4a1e-82b2-07ccd5323c3f}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Ld9BoxSVC.exe\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-A161-41F1-B583-4892F4A9D5D5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C196-4D26-B8DB-4C8C389F1F82}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0002-4B81-0077-1DCB004571BA}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-2F1A-4D6C-81FC-E3FA843F49AE}\ = "IFile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8A02-45F3-A07D-A67AA72756AA}\ = "IProcess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3EE4-11E9-B872-CB9447AAD965}\ = "IVirtualSystemDescriptionForm"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1207-4179-94CF-CA250036308F}\ = "IGuestFileOffsetChangedEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1EC0-4C0F-857F-FBE2A737A256}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CD54-400C-B858-797BCB82570E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7193-426C-A41F-522E8F537FA0}\NumMethods\ = "83"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0002-4B81-0077-1DCB004571BA}\NumMethods\ = "48"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1A29-4A19-92CF-02285773F3B5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3E8A-11E9-825C-AB7B2CABCE23}\ = "IChoiceFormValue"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-2FD3-47E2-A5DC-2C2431D833CC}\NumMethods\ = "15"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2FD3-47E2-A5DC-2C2431D833CC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-48DF-438D-85EB-98FFD70D18C9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4A9E-43F4-B7A7-54BD285E22F4}\ = "ISnapshotDeletedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-647D-45AC-8FE9-F49B3183BA37}\ = "IGuestSessionEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3FF2-4F2E-8F09-07382EE25088}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486E-472F-481B-969746AF2480}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9B2D-4377-BFE6-9702E881516B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6B76-4805-8FAB-00A9DCF4732B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4430-499F-92C8-8BED814A567A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8F30-401B-A8CD-FE31DBE839C0}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6588-40A3-9B0A-68C05BA52C4B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4022-DC80-5535-6FB116815604}\ProxyStubClsid32	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
228	chrome.exe
228	chrome.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
492	LDPlayer_9.0.66.3.exe
4336	dnrepairer.exe
4336	dnrepairer.exe
1496	powershell.exe
1496	powershell.exe
2276	powershell.exe
2276	powershell.exe
856	powershell.exe
856	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
228	chrome.exe
228	chrome.exe
228	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeTakeOwnershipPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe
Token: SeDebugPrivilege	492	LDPlayer_9.0.66.3.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe
228	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 2364	228	chrome.exe	85
PID 228 wrote to memory of 2364	228	chrome.exe	85
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4536	228	chrome.exe	87
PID 228 wrote to memory of 4340	228	chrome.exe	88
PID 228 wrote to memory of 4340	228	chrome.exe	88
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89
PID 228 wrote to memory of 1048	228	chrome.exe	89

C:\Users\Admin\AppData\Local\Temp\LDPlayer_9.0.66.3.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer_9.0.66.3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:492
- C:\LDPlayer\LDPlayer9\dnrepairer.exe
  "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=262664
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- - C:\Windows\SysWOW64\net.exe
    "net" start cryptsvc
    3⤵
    PID:3088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start cryptsvc
      4⤵
      PID:4804
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" Softpub.dll /s
    3⤵
    - Manipulates Digital Signatures
    PID:1792
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" Wintrust.dll /s
    3⤵
    - Manipulates Digital Signatures
    PID:2016
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" Initpki.dll /s
    3⤵
    PID:464
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32" Initpki.dll /s
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" dssenh.dll /s
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" rsaenh.dll /s
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" cryptdlg.dll /s
    3⤵
    - Manipulates Digital Signatures
    PID:400
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2112
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1532
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1412
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3360
- - C:\Windows\SysWOW64\dism.exe
    C:\Windows\system32\dism.exe /Online /English /Get-Features
    3⤵
    - Drops file in Windows directory
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\dismhost.exe {D00101A5-2CC9-4C64-86F6-B8A4C17D8BCE}
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      PID:468
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    PID:3092
- - C:\Windows\SysWOW64\sc.exe
    sc query vmcompute
    3⤵
    - Launches sc.exe
    PID:1792
- - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
    "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4324
- - C:\Windows\SYSTEM32\regsvr32.exe
    "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
    3⤵
    - Loads dropped DLL
    PID:1448
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
    3⤵
    - Loads dropped DLL
    PID:3656
- - C:\Windows\SYSTEM32\regsvr32.exe
    "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:1280
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2544
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
    3⤵
    - Launches sc.exe
    PID:1016
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\system32\sc" start Ld9BoxSup
    3⤵
    - Launches sc.exe
    PID:4552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce0529758,0x7ffce0529768,0x7ffce0529778
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4488 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 --field-trial-handle=1760,i,11198833757511353329,15274362718498700451,131072 /prefetch:8
  2⤵
  PID:976

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP120.dll

Path C:\LDPlayer\LDPlayer9\MSVCP120.dll
Size 444KB
SHA256 891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9
MD5 50260b0f19aaa7e37c4082fecef8ff41
SHA1 ce672489b29baa7119881497ed5044b21ad8fe30
SHA512 6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d
SSDEEP 12288:aZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77m:a/8wVwHZFTwFOOos3Ooc8DHkC2e77m
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 51KB
SHA256 e7e8225ea6879d0e24be299dfb07b42876157b221e2c01ede29b6da675e830e0
MD5 66320b2085eaef1c436f6940b4bb8822
SHA1 6e92774138f43129a209c3fc80839c7726e9644d
SHA512 2a66ed15503c57059dab50128c5d1167f8afd152d5cc84383472db41224bddc4552a9a69a3f59bd820d42fe68a73f45cc5f00a3df3f8172ac744cc432cea4b54
SSDEEP 1536:xPGyMprkvxXb0HOafaHlQM4H7Hxfd7ZkxC:0yVpVayFQM4H7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 15.8MB
SHA256 216beb780c313f2ad59ee235ce1d64e65e905ebc34904c079c862038e09f5ae8
MD5 0595056e10723ed702944f9b315aab4b
SHA1 4bdb5d7d8871385b15cf64913216f5d8819f94d7
SHA512 ce2137d7ddf0b4529822a3edd03292a2a209e8ccae6f69ae374033e271084f7d930f88a1359f866c7a108819ddef850b96cd73c7fde99a9c85099fdf46b6a81e
SSDEEP 393216:WVpDWYfKsISMEnK04giYYYc/HgFIQU3yt:W/DWYCsXMCK3g9cHgE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 19.2MB
SHA256 e1582711f3eb08265b5f9c3e64acd903b9a2aafd363d34e3b5af455739660e06
MD5 ea09b1aabf0d86fa4b65b51a8e54944e
SHA1 f82e4910ca8ba3543efa1080a4db178a5724d9cc
SHA512 b5c3d8ad50d8d376d5ab8323738fd693c0ebdb5cdf15479f9bc774fce2859ea8e14e16d67c69e9ec4ea78f1b306e77f280858faa419e84e36446571aed7de51f
SSDEEP 393216:WVpDWYfKsISMEnK04giYYYc/HgFIQU3ytUCo5a:W/DWYCsXMCK3g9cHgEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.0MB
SHA256 a19a6c0c644ce0e655eaf38a8dbddf05e55048ba52309366a5333e1b50bde990
MD5 f845753af4cc7b94f180fb76787e3bc2
SHA1 76ca7babbb655d749c9ed69e0b8875370320cc5a
SHA512 0a3062057622ffcff80c9c5f872abdf59a36131bfc60532c853ea858774d89fed27343f838dfe341dafe8444538fc6e2103d3aa19ef9d264e0f8e761c4bfce81
SSDEEP 98304:N3/nvxWblvGnmbHS5O0S30MlaOLzdEMeJBreiLneW938:N3nxWb0MEMgcC3rCWeB
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\LDPlayer\LDPlayer9\msvcr120.dll
Size 947KB
SHA256 2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112
MD5 50097ec217ce0ebb9b4caa09cd2cd73a
SHA1 8cd3018c4170072464fbcd7cba563df1fc2b884c
SHA512 ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058
SSDEEP 12288:6BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJSH:SmFyjLF847eiWWcoGZVOIxh/WxIAIbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.vmdk

Path C:\LDPlayer\LDPlayer9\system.vmdk
Size 16.9MB
SHA256 cf6f1a45a9e7749808a35786a59689007bcbf782c954e22ffe62bb7642ec8c83
MD5 64282b4db8742af6f2d73729b597febe
SHA1 12d52d55109127d8af3ba751468880e268733045
SHA512 e2ee3717bd8f41bb90a54531c89b7bc550e157f52722581297089ab91397ad0003caf62659a80adf445f23ccf45eb4ea07ff82600c3dd344b2060549ca2cc4e0
SSDEEP 393216:VM+VlF4YQVsM19L5Ksyo+BsrD6emdQEd/QabUMRsqL:iVso5vyZSrqo0UMR1
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.vmdk

Path C:\LDPlayer\LDPlayer9\system.vmdk
Size 18.9MB
SHA256 611506f9972a032a90ba10603b2e163d754197029fb92132b5e3be0bafca4d77
MD5 ef6e794f74e995dbf3b34d6b435aede3
SHA1 ec8c6856543ea91479f3ebc205a508f728ccadf3
SHA512 16e07f63b547dd166a35e5563d47d41d44f6eb92cad5fd0e6da1ad3a693bc762b39d492ddd3989c244a6ac4537760db4e69daee8d0a8fc947eefb647151ca3ab
SSDEEP 393216:VM+VlF4YQVsM19L5Ksyo+BsrD6emdQEd/QabUMRsqg94PNW:iVso5vyZSrqo0UMRS97
MD5 SHA1 SHA512 SSDEEP

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 641B
SHA256 b60c56471d96123f83a05f6d2d313137ac7692d7b5c2599efa447ba1dbc14b08
MD5 bd509545016ecfe138d9ab5d2bc68149
SHA1 96e075fc5db89a0575e2d57bfb762974a19b806f
SHA512 1370703a309a88b5daec3246e8cae5d48a3a00776495d185b026033f7473f42c0871b1039e45a41349a254656ab7176c919f001afbbc86bbc3b9d009424cf559
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6bb48f14474269aa1ee244395f0fd224402c350233b2fa95e20cee6aac7666fc
MD5 6155a126f0d44aa35fb5b2467db2ab71
SHA1 c27599e3c9d0e86bc0bc86889ad7cb321625f4ca
SHA512 ef2f088bc546aef8d18b8539b8c46090cb274a7da69a2bf25d7294cbaffdd67a7d9e9086ff70f6a1971fcd20e0e27bb12593ed8b885fb009b0dbef99ce4970ac
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 a93296c43e74cfcfc0d136650a7a304e53ad6c16363667bc2de38362ee5810cb
MD5 30385ec1a42bdee14576892167d64699
SHA1 214a473e787c3021d2a9c7db282b6a0b5e296a4a
SHA512 d1c61c3389f5c3689c791453df67178e234380f0c8ed2344373011053872c4ed312daafae2e8176567afc6f66454ff8088f6af4d2c58fbfb7ed3294455f13e66
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 93c5e5c33928c90aeb1dc910a924502e8ee0d1d19805738865e0339840542b9c
MD5 af71667a37abd7e35820d23a712759a8
SHA1 7f52338531d0215f1abd4268007b3cc79c122654
SHA512 0b22c7b69b3ae79a28d6943618d2ba21a3c3c6a8d586fba7348af92c675a4f5e04121ba21e275186945bafb9a321915729bace7aa5466c374eaf52bc431eb009
SSDEEP 192:SZ+GB1kCH6rfO8syy+FSbhNKRwDi2tjEsXtScPS:4+GBas6rsyxStNKWDbtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 f32d5e24ca6b1482729ed393894a5cc1d7e53614f1138a25fe4c0d691b48f6b3
MD5 a61d281531b2f873e57eafe9df20a92c
SHA1 d3272f2dae132092e772592ea90e06e542ed7fc0
SHA512 a649a841655b575d6dd9fe8b59ee472e149338da33d2484d82d6ddb3a2331b056100273bc927dc02904115a4ca3efa6d7702d932314bbee1297d33997a987296
SSDEEP 384:NSx1LPLeFTXSt1kXqKf/pUZNCgVLH2HfkRzrUuaHG04XAO/KW:0LPLyq1kXqKf/pUZNCgVLH2HfqrUDGV7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 f4ed276846b3e0efb5d73f1aceac0405999a05cdde7f498d2bad95bf14e430a2
MD5 e7ba7857700f154625eeb57aac9ac670
SHA1 7b76b03671779346f5b20446466a16e7f0ecf873
SHA512 0f3f623c0eabcfe16c283169f741bd0242554dfac8cdfda350c7cc43930d2b9b009abca2c455f3e54ad352af88b69026abf5808f84d11ae06603a39b34d306ad
SSDEEP 6144:xdqLs95t8cO7uuKKSrqJ6d7Yj3Ua9jHThM8fNHK9K5f:xdMsbpO7uKIsbUYHTqwNqo5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

AssocProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\AssocProvider.dll
Size 136KB
SHA256 21ad24a767aeb22d27d356bc8381f103ab620de1a47e374b9f961e44b543a358
MD5 702f9c8fb68fd19514c106e749ec357d
SHA1 7c141106e4ae8f3a0e5f75d8277ec830fc79eccc
SHA512 2e7d403c89dacdda623ed1a107bac53aafde089fdd66088d578d6b55bcfe0a4fc7b54733642162bd62d0ca3f1696667a6f0cb4b572d81a6eefd6792d6003c0d9
SSDEEP 3072:kaiR7O/lP9mL/w/Js/I0gldE+QU+JMh3wTHCno:kasi/l19/JmgldNPhmx
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCorePS.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\DismCorePS.dll
Size 200KB
SHA256 db995f4f55d8654fc1245da0df9d1d9d52b02d75131bc3bce501b141888232fc
MD5 7f751738de9ac0f2544b2722f3a19eb0
SHA1 7187c57cd1bd378ef73ba9ad686a758b892c89dc
SHA512 0891c2dedb420e10d8528996bc9202c9f5f96a855997f71b73023448867d7d03abee4a9a7e2e19ebe2811e7d09497bce1ea4e9097fcb810481af10860ff43dfb
SSDEEP 1536:nDiqbsdYfXhuE8RouT/FdJMs9xlYkP1yhi1n17+EqtoqCIE06cNHP0G:tUEIouT/FdJP1Mi1vqto7v0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismHost.exe

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\DismHost.exe
Size 168KB
SHA256 dead0ebd5b5bf5d4b0e68ba975e9a70f98820e85d056b0a6b3775fc4df4da0f6
MD5 17275206102d1cf6f17346fd73300030
SHA1 bbec93f6fb2ae56c705efd6e58d6b3cc68bf1166
SHA512 ce14a4f95328bb9ce437c5d79084e9d647cb89b66cde86a540b200b1667edc76aa27a36061b6e2ceccecb70b9a011b4bd54040e2a480b8546888ba5cc84a01b3
SSDEEP 3072:u6bLa/eoNP/VYbxYxVipvxx9hXD0L6/Dk6F62G0rrqw:u6q/eMYbxYxAVxr1DY6v62G0l
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismProv.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\DismProv.dll
Size 292KB
SHA256 006464f42a487ab765e1e97cf2d15bfa7db76752946de52ff7e518bc5bbb9a44
MD5 2ac64cc617d144ae4f37677b5cdbb9b6
SHA1 13fe83d7489d302de9ccefbf02c7737e7f9442f9
SHA512 acdb2c9727f53889aa4f1ca519e1991a5d9f08ef161fb6680265804c99487386ca6207d0a22f6c3e02f34eaeb5ded076655ee3f6b4b4e1f5fab5555d73addfd7
SSDEEP 6144:G5cwM105c71F1yLcmi13uBo8Sxdxym3gqOU2Wu:G5cz105cBF0LcmiPf3Xij
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\DmiProvider.dll
Size 436KB
SHA256 b5fb1a5eb4090598d5f878cdd37ed8eca82962d85995dd2280b8849fba816b54
MD5 e54120aa50f14e0d3d257e77db46ece5
SHA1 922203542962ec5f938dcb3c876f060ecf17f9dc
SHA512 fbce5d707f6a66d451165608520be9d7174a8c22eb9827dfe94d98718e2c961f15ac45583b1743f3b8078b3fe675992d4b97bfc5e4b893b60328d94665f71dc9
SSDEEP 12288:nSxZX+QTrwaw1qzU6mJMo41a0Dx1ITgsXnz:nSTX+QTrwaw1qzU6mJCBBsXz
MD5 SHA1 SHA512 SSDEEP

Submit Download

EdgeProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\EdgeProvider.dll
Size 200KB
SHA256 eb68c7d48f78b46933acba617cf3b5fcb5b8695c8a29295a9fa075f36910825b
MD5 c22cc16103ee51ba59b765c6b449bddb
SHA1 b0683f837e1e44c46c9a050e0a3753893ece24ad
SHA512 2c382aaddeca4efda63162584c4a2338ffcc1f4828362ce7e927e0b39c470f1f66a7933ae2210d63afb5a2ae25412266fde2ee6bdb896c3c030bdc08b67ec54e
SSDEEP 3072:LLmV5hyl8O5hBi38PFbh/NWHhNqF6yYLeBd9d9d92i+F3vljfWJjJ8fd:LLmbIl/5hk38PFvWBNqFXYLeUiddJi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffuprovider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\Ffuprovider.dll
Size 680KB
SHA256 57ce7761531058f3c4289b1240bea6dc06355c9c4b4e88b9c9c0df8012edc5b3
MD5 a41b0e08419de4d9874893b813dccb5c
SHA1 2390e00f2c2bc9779e99a669193666688064ea77
SHA512 bd370e49da266148d50144c621f6415bdd5358e6274b1d471b8d4ee1888d93774331c3f75e6cb99782f1c8e772981cbc5a4baf5592c6400f340407dc670e547a
SSDEEP 12288:2Bc7EGpjRrvwg1oYZao+A5MYU1uaZZPunSvGpVQzsVo:2OQGpjRrvb1oYvnUc0HuV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\GenericProvider.dll
Size 172KB
SHA256 6a940ba16154c4a1729b8560b03efb5f2558d66b10da4a5ec26c1299ea713bc4
MD5 20fb116831396d9477e352d42097741c
SHA1 7e063ac9bc173a81dc56dc5864f912041e2c725a
SHA512 851843da748555eba735e1f5457044f24f225bd029534019814a6d1baf2e0bd1f171d297c362cfed5977274b266e823b7ad131ae2512568f7a5f2e3ea498b69a
SSDEEP 3072:I2Tdd6qHLk0M+E3H6pi7pxyw2EJVdRuOsAudhpNiaD+4iQmuMbr+McvQ:I2T36gk0Ml3HxrJXRuOsrdh7cJrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\IBSProvider.dll
Size 84KB
SHA256 8f4e3f600917d49ada481ff0ed125fef4a316b659bb1197dc3036fc8c21a5a61
MD5 f6b7301c18f651567a5f816c2eb7384d
SHA1 40cd6efc28aa7efe86b265af208b0e49bec09ae4
SHA512 4087d819706c64a5d2eed546163c55caacc553b02dc4db0d067b8815d3a24fb06ea08de3de86aac058ff2907f200e4e89eef2357ca23328aaacbe29501ea3286
SSDEEP 1536:EgCKPmVv6U7gDwlM41SrITCXQkP8gq+oa4PUyLPGJG5Q+:EgAx6U7gDcMCSEOj8gq+74PUyLeJuQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImagingProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\ImagingProvider.dll
Size 248KB
SHA256 f1bbab35b2602d04d096c8de060b2a5cf802499a937fd1ffe749ff7f54852137
MD5 4c6d681704e3070df2a9d3f42d3a58a2
SHA1 a9f6286ac25f17b6b2acd1fce6459b0bc94c6c81
SHA512 daa0c723312680256c24457162e0ef026b753ba267f3e2755f838e2864a163802c078d8668dd2c2064cb8887f4e382a73d6402a5533b6ac5c3cbf662ad83db86
SSDEEP 6144:I/8j1wVGBFsGk1S/FjRSPIg4wFlbCW+GZANJ:I/8ZhsD1S/Fjsb+4C
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntlProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\IntlProvider.dll
Size 312KB
SHA256 aac13ddb9ab5a165a38611f1b61229268a40d416f07740d4eefba1a8fcf7c731
MD5 34035aed2021763bec1a7112d53732f1
SHA1 7132595f73755c3ae20a01b6863ac9518f7b75a4
SHA512 ea045aa46713133a5d0ad20514cc2a8c8fffb99b4e19c4d5262f86167cfce08a31d336222fd3c91e6efbfd90312bb2325337aa02a8489e047b616085fdf46c1d
SSDEEP 6144:pF4xGRPfWkASBdeutMLQ2u3WTxTBgzEZiIExLYvSmEjZ9SOL/:pQGRPf7ASBQ7humDcEZ3mYqftL/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\LogProvider.dll
Size 108KB
SHA256 56aca41c62c8d0d1b26db3a01ef6c2da4a6a51fc963eb28411f8f7f029f1bfde
MD5 c63f6b6d4498f2ec95de15645c48e086
SHA1 29f71180feed44f023da9b119ba112f2e23e6a10
SHA512 3a634340d8c66cbc1bef19f701d8bdb034449c28afecce4e8744d18181a20f85a17af3b66c8853cecb8be53f69ae73f85b70e45deac29debab084a25eb3c69dc
SSDEEP 3072:OcWhdZh3LH2F6dxcd5+suyufoMX0Igx7DAJoNQrw:OcWfHbWF6dxM5nuwMX0Igx7DAJoNP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\MsiProvider.dll
Size 208KB
SHA256 56a8527d267116af39864feca528be5b7a88c3b5df94750154b2efcf2fda5d55
MD5 eb171b7a41a7dd48940f7521da61feb0
SHA1 9f2a5ddac7b78615f5a7af753d835aaa41e788fc
SHA512 5917266aed1a79ee4cb16bb532ccae99782d0ee8af27cb42a6b39496c3de61c12a30ce524a1a66cc063101ebcfac957d1b129aae0b491c0587f40171ba6bae12
SSDEEP 3072:EdjQGkIsrvpV46BA54HtgnH8SvVEfHzlRLHxN3ShMofF+TGOJ20bpZRxevXQlUoh:EdcfHjg54NgnH8SvETfHxNmModXYT
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\OSProvider.dll
Size 180KB
SHA256 ec137f9caebcea735a9386112cf68f78b92b6a5a38008ce6415485f565e5cf85
MD5 e9833a54c1a1bfdab3e5189f3f740ff9
SHA1 ffb999c781161d9a694a841728995fda5b6da6d3
SHA512 0b18932b24c0257c80225c99be70c5125d2207f9b92681fd623870e7a62599a18fa46bcb5f2b4b01889be73aeb084e1b7e00a4968c699c7fdb3c083ef17a49f9
SSDEEP 3072:BB8yo2sMg0UGPZiWmiIjt/c+84+AJV7woP97Pn8HdMWij:BB8R2sMptajhcH4LtJPn8HE
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfflineSetupProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\OfflineSetupProvider.dll
Size 213KB
SHA256 8b247665218f5151f0d19f59ea902a7c28f745d67a5d51b63b77242ffb4bdd74
MD5 3437087e6819614a8d54c9bc59a23139
SHA1 ae84efe44b02bacdb9da876e18715100a18362be
SHA512 018e88f6c121dd4ecaceb44794e2fa7a44b52ddb22e7a5a30a332905e02065cbc1d1dcddc197676277b22f741195c1b7c4c185d328b096b6560b84e9749d6dde
SSDEEP 6144:uknE5hYZ4yjhHDWLcKKCCc3Kh5b5L3ru1VGDtBx:uknE5hYZdHdKs3KSZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProvProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\ProvProvider.dll
Size 800KB
SHA256 4915b0c9cd8dc8a29dd649739974d244f9105dc58725f1da0d592af3b546e2bf
MD5 2ef388f7769205ca319630dd328dcef1
SHA1 6dc9ed84e72af4d3e7793c07cfb244626470f3b6
SHA512 b465917424dd98125d080c135c7e222a9485ed7ec89004f9a70e335b800e5b9419fbc932c8069bae9ff126494174cf48e2790030dd22aa2d75b7b9d8ccff752b
SSDEEP 24576:3cnsk1TMoJLkGQhmEoQL8gpBAyPW5EJEuv+9Uipg8URQ:3cnsk1TMoJLkGQht3L8gp1W5Eium9Ui1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ServicingCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\ServicingCommon.dll
Size 944KB
SHA256 be75afbbc30cad7235adf03dcc07fcee3c0c330c89b00e326ebbef2e57df5935
MD5 07231bdae9d15bfca7d97f571de3a521
SHA1 04aec0f1afcf7732bc4cd1f7aab36e460c325ba6
SHA512 2a46e0657e84481faf5c9d3de410884cb5c6e7b35039f5be04183cdac6c088cc42b12d0097e27836af14699e7815d794ca1cec80960833ab093b8dc6d44e2129
SSDEEP 24576:bCW97/8sbipN+B/bN6lmX1xSUMOIrWaaY90I8dDHPR7UvPT:bCW97/8sbi2B/pRHIrWaaY6I8lJ7UvPT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\SmiProvider.dll
Size 272KB
SHA256 5a0f1279013d1d379cb3a3e30f1d5be22549728cd9dc92ed5643eacf46199339
MD5 46e3e59dbf300ae56292dea398197837
SHA1 78636b25fdb32c8fcdf5fe73cac611213f13a8be
SHA512 e0584da3c302ea6ffa85932fa185500543f15237d029fdc4b084aee971ec13967f9e83cad250bea36b31f1a3efb1cc556da7dd231e5b06884809d0af51ebdf8c
SSDEEP 6144:XgQde1SAxa2PISxvL3q7B4U7ILK7Q9jJ9U8xLveLa:Xxde1SAtPImz3qV7sb9l
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysprepProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\SysprepProvider.dll
Size 820KB
SHA256 901cea68c7a158a1d9c030d3939f8f72057d1cf2f902aec1bc1b22a0000c0494
MD5 4dfa1eeec0822bfcfb95e4fa8ec6c143
SHA1 54251e697e289020a72e1fd412e34713f2e292cf
SHA512 5f3f710bef75da8cddb6e40686d6a19f59fbc7d8a6842eaceb9a002ab284a91ecf48c352171e13f6a75366610988e67710439f1dde579311ebbb3cd9e4751aa4
SSDEEP 12288:z7iAEht8j7iaTzcPi1Bf5WAqr151lrrhTyqTyvj6jljcjFdC6:zOAEht8jOaPc4fi13lXw/j6jljcjFf
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransmogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\TransmogProvider.dll
Size 1.3MB
SHA256 b20b3eb2df22998fd7f9ff6898ba707d6b8833a8274719a5e09d5148d868faaf
MD5 c1c56a9c6ea636dbca49cfcc45a188c3
SHA1 d852e49978a08e662804bf3d7ec93d8f6401a174
SHA512 f6db05e4644d734f81c2461e4ad49c4e81880c9e4beee13dbbda923360ef6cf4821fccd9040671b86ab2cd8c85fc313c951c1a69e4df14d94268753ce7ae5b2e
SSDEEP 12288:pEFAXpw+9lMTYwnY/ksZhniBDJUzlkbIa0DCYclUC:bXpw+9lhwnAi1JQkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnattendProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\UnattendProvider.dll
Size 256KB
SHA256 3665872e68264bbf3827c2bf0cfa60124ea1d87912728f2fc3685dce32855cb8
MD5 7c61284580a6bc4a4c9c92a39bd9ea08
SHA1 4579294e3f3b6c03b03b15c249b9cac66e730d2a
SHA512 b30b89d0d5e065042811d6ff397d226877ff698aeb1153681692aedabe3730e2f3746ad9d70e3120e336552bab880644f9ead0c91a451197a8f0977a2126a0fe
SSDEEP 6144:I7s9GR9JzcVCGNJSHSSu3zne0/hbT1vxtATg:I7s9GR9J70JSyb7b1vxog
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vhdprovider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\Vhdprovider.dll
Size 596KB
SHA256 d3a2dd7d47bfbb3897b927d1b7230b5b12e5fd7315d687458de15fbb08fb7e27
MD5 8a655555544b2915b5d8676cbf3d77ab
SHA1 5a7529f8a6d50d3f4e13b2e3a0585f08eb0511a2
SHA512 c6da649ae3c3688065b37bccfb5525ade25ba7bc3b163ad7d61f3b3d1c4957c8fd6c9f2bf23b0dbc4fffe32e980acb5a5d3895b8a012c5ed086e3e38caee2e93
SSDEEP 12288:NpYtyy4AHBveMJR+ko2fixilfF/FTup0C3EPuvsbobBxvoOG6mqTmHIp0dhLIJF9:/gyy4AHBveMboZxKfF/Jup0QEPgsbonZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WimProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\CBE6E8B8-FF5A-4EEF-B423-7413AFA035E9\WimProvider.dll
Size 672KB
SHA256 78b742deddee8305ea06d77f296ad9fe0f4b4a27d71b34dcdff8ae199364790c
MD5 bcf8735528bb89555fc687b1ed358844
SHA1 5ef5b24631d2f447c58b0973f61cb02118ae4adc
SHA512 8b2be4e9a4334a5fc7f7c58579c20974c9194b771f7a872fd8e411d79f45fc5b7657df4c57ad11acb915d5ea5d1f0583c8a981b2c05104e3303b3ee1469b93f5
SSDEEP 12288:eiudpGAJaCfLUeZigXV+P4rY68YLhNH9wnHjdjfM4P7a:eiubGAJaCoeZigFXrWYr9wHjdQOa
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5tq1c4pa.u0k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5tq1c4pa.u0k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 18KB
SHA256 d96bda414ab904a0bf71033b33605f40eeffd5c81ea36871b7d6fc8d614f6f2e
MD5 7c2f96d484b68166614fd275607effde
SHA1 e5eed38a1c51b31a846d787c0e6e1c53c7666f71
SHA512 244300e39a70c118c61354bf352d8f252813af1a2280bc6e6176bf5340554d204d47590b7519fc87c64259756292aa4d9db42508c3e0a0a8639743da830c17b8
SSDEEP 384:K5tC4SJrt9C7E17VUqC1AWFAgtbJ6xqiGqJ:K0Xn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 23KB
SHA256 13392df8da7be1b5dd78befed16d8f40582265f54d65c1ed5b82f5a2b433033a
MD5 c44899a72e5f7759634b72988593ede5
SHA1 a09714bd315f63cd8924565f877574c918907986
SHA512 3a334896be37b5bb3984c453c8896dcc92669926a5bc56c88bdfe15b655bf5c93f63c3043871574dbab6938ac9a5cf7c2c9598439809b2afd0e68afce7f7f013
SSDEEP 384:K5tC4SJrt9C7E17VUqC1AWFAgtbJ6xqiGqEtkVeXwwX6RccyVi:K0XD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/856-840-0x0000000073640000-0x0000000073DF1000-memory.dmp

Download

memory/856-838-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/856-837-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/856-828-0x00000000735F0000-0x000000007363C000-memory.dmp

Download

memory/856-819-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/856-818-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/856-817-0x0000000073640000-0x0000000073DF1000-memory.dmp

Download

memory/1496-748-0x0000000003080000-0x00000000030B6000-memory.dmp

Download

memory/1496-788-0x0000000007EF0000-0x0000000007F0A000-memory.dmp

Download

memory/1496-765-0x0000000006870000-0x000000000688E000-memory.dmp

Download

memory/1496-766-0x00000000068C0000-0x000000000690C000-memory.dmp

Download

memory/1496-767-0x000000007F890000-0x000000007F8A0000-memory.dmp

Download

memory/1496-768-0x0000000007830000-0x0000000007864000-memory.dmp

Download

memory/1496-778-0x0000000007A70000-0x0000000007A8E000-memory.dmp

Download

memory/1496-769-0x00000000735F0000-0x000000007363C000-memory.dmp

Download

memory/1496-780-0x0000000007A90000-0x0000000007B34000-memory.dmp

Download

memory/1496-781-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/1496-779-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/1496-782-0x0000000008210000-0x000000000888A000-memory.dmp

Download

memory/1496-783-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Download

memory/1496-784-0x0000000007C40000-0x0000000007C4A000-memory.dmp

Download

memory/1496-785-0x0000000007E50000-0x0000000007EE6000-memory.dmp

Download

memory/1496-786-0x0000000007DD0000-0x0000000007DE1000-memory.dmp

Download

memory/1496-787-0x0000000007E10000-0x0000000007E1E000-memory.dmp

Download

memory/1496-764-0x0000000006390000-0x00000000066E7000-memory.dmp

Download

memory/1496-789-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/1496-792-0x0000000073640000-0x0000000073DF1000-memory.dmp

Download

memory/1496-749-0x0000000073640000-0x0000000073DF1000-memory.dmp

Download

memory/1496-751-0x0000000005B10000-0x000000000613A000-memory.dmp

Download

memory/1496-750-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/1496-752-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/1496-753-0x0000000005A50000-0x0000000005A72000-memory.dmp

Download

memory/1496-754-0x00000000062B0000-0x0000000006316000-memory.dmp

Download

memory/1496-755-0x0000000006320000-0x0000000006386000-memory.dmp

Download

memory/2276-816-0x0000000073640000-0x0000000073DF1000-memory.dmp

Download

memory/2276-814-0x0000000004720000-0x0000000004730000-memory.dmp

Download

memory/2276-813-0x0000000004720000-0x0000000004730000-memory.dmp

Download

memory/2276-804-0x00000000735F0000-0x000000007363C000-memory.dmp

Download

memory/2276-803-0x000000007F070000-0x000000007F080000-memory.dmp

Download

memory/2276-794-0x0000000004720000-0x0000000004730000-memory.dmp

Download

memory/2276-793-0x0000000073640000-0x0000000073DF1000-memory.dmp

Download