Malware Analysis Report

2024-09-11 03:50

Sample ID 240605-p4mj2afh5s
Target AcuraHooking.exe
SHA256 93cce1576619aee76238c580b31cff19cffaa09d7b3241354c27b43fc8402b1d
Tags
pyinstaller discovery execution exploit persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

93cce1576619aee76238c580b31cff19cffaa09d7b3241354c27b43fc8402b1d

Threat Level: Likely malicious

The file AcuraHooking.exe was found to be: Likely malicious.

Malicious Activity Summary

pyinstaller discovery execution exploit persistence

Creates new service(s)

Downloads MZ/PE file

Possible privilege escalation attempt

Manipulates Digital Signatures

Loads dropped DLL

Registers COM server for autorun

Modifies file permissions

Executes dropped EXE

Checks installed software on the system

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Detects Pyinstaller

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Runs net.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Kills process with taskkill

NTFS ADS

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
System Services
T1569
Service Execution
T1569.002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Subvert Trust Controls
T1553
SIP and Trust Provider Hijacking
T1553.003
File and Directory Permissions Modification
T1222
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-05 12:53

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-05 12:53

Reported

2024-06-05 12:56

Platform

win7-20240508-en

Max time kernel

122s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe
PID 2244 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe
PID 2244 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe

"C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe"

C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe

"C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-timezone-l1-1-0.dll

MD5 d12403ee11359259ba2b0706e5e5111c
SHA1 03cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA512 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-file-l1-2-0.dll

MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

C:\Users\Admin\AppData\Local\Temp\_MEI22442\python312.dll

MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-processthreads-l1-1-1.dll

MD5 517eb9e2cb671ae49f99173d7f7ce43f
SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

\Users\Admin\AppData\Local\Temp\_MEI22442\api-ms-win-core-localization-l1-2-0.dll

MD5 724223109e49cb01d61d63a8be926b8f
SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

\Users\Admin\AppData\Local\Temp\_MEI22442\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-05 12:53

Reported

2024-06-05 13:11

Platform

win10v2004-20240508-en

Max time kernel

1043s

Max time network

1051s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe"

Signatures

Creates new service(s)

persistence execution

Downloads MZ/PE file

Manipulates Digital Signatures

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS\{C689AAB9-8E78-11D0-8C47-00C04FC295EE} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\FuncName = "DecodeAttrSequence" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubCheckCert" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubInitialize" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130\FuncName = "WVTAsn1SpcSigInfoEncode" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004\FuncName = "WVTAsn1SpcPeImageDataDecode" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubCheckCert" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubCheckCert" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32\Dll = "cryptdlg.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "HTTPSFinalProv" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadMessage" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "HTTPSCertificateTrust" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubCheckCert" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\CallbackAllocFunction = "SoftpubLoadDefUsageCallData" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "WintrustCertificateTrust" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15\FuncName = "WVTAsn1SpcPeImageDataEncode" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222\FuncName = "WVTAsn1CatMemberInfoEncode" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPCreateIndirectData" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10\FuncName = "WVTAsn1SpcSpAgencyInfoDecode" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011\Dll = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeEncode" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "WintrustCertificateTrust" C:\Windows\SysWOW64\regsvr32.exe N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\driverconfig.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnplayer.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\vbox-img.exe N/A
N/A N/A C:\Program Files\ldplayer9box\vbox-img.exe N/A
N/A N/A C:\Program Files\ldplayer9box\vbox-img.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe N/A
N/A N/A C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe N/A
N/A N/A C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
N/A N/A C:\Windows\SYSTEM32\regsvr32.exe N/A
N/A N/A C:\Windows\SYSTEM32\regsvr32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020423-0000-0000-C000-000000000046}\InprocServer32 C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxC.dll" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxC.dll" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\InprocServer32 C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\InprocServer32 C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32 C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32 C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32 C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32\ThreadingModel = "Both" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32 C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32\ThreadingModel = "Free" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32\ = "\"C:\\Program Files\\ldplayer9box\\Ld9BoxSVC.exe\"" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32 C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32\ThreadingModel = "Free" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\InprocServer32 C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\InprocServer32 C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\InprocServer32 C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32 C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxProxyStub.dll" C:\Windows\SYSTEM32\regsvr32.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\ldplayer9box\vccorlib140.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\USBTest.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxAutostartSvc.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxSharedFolders.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-crt-stdio-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxGuestPropSvc.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxPlaygroundDevice.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxSharedClipboard.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\ossltest.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-core-namedpipe-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-crt-heap-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-core-heap-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-core-rtlsupport-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-core-util-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\GLES_V2_utils2.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxBalloonCtrl.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-crt-time-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-1.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-crt-runtime-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxAuthSimple.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\concrt140.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-core-file-l1-2-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxDbg.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-core-debug-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxEFI32.fd C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\Ld9BoxSVC.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\Qt5Widgets.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxSupLib.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\libcurl.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\Qt5OpenGL.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\SDL.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-crt-utility-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-crt-math-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\GLES_CM.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxGuestControlSvc.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxHostChannel.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\VBoxRT-x86.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\fastpipe2.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-2-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-core-processthreads-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-crt-multibyte-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\msvcr100.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\dpinst_64.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\SUPLoggerCtl.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-crt-string-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxSup.cat C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\tstPDMAsyncCompletion.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-crt-environment-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\host_manager.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxNetLwf.inf C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\NetFltUninstall.exe C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\platforms\qoffscreen.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxDD2.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-crt-locale-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\EGL.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\dasync.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-crt-locale-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-core-console-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\GLES_V2.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\Ld9BoxSup.sys C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\VBoxC.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A
File created C:\Program Files\ldplayer9box\x86\api-ms-win-crt-math-l1-1-0.dll C:\LDPlayer\LDPlayer9\dnrepairer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\DISM\dism.log C:\Windows\SysWOW64\dism.exe N/A
File opened for modification C:\Windows\Logs\DISM\dism.log C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\LDPlayer\LDPlayer9\dnplayer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\LDPlayer\LDPlayer9\dnplayer.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001" C:\LDPlayer\LDPlayer9\dnplayer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION C:\LDPlayer\LDPlayer9\dnplayer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001" C:\LDPlayer\LDPlayer9\dnplayer.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-EBF9-4D5C-7AEA-877BFC4256BA}\ = "IDHCPGroupConfig" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-61D9-4940-A084-E6BB29AF3D83}\TypeLib\Version = "1.3" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E191-400B-840E-970F3DAD7296}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7619-41AA-AECE-B21AC5C1A7E6}\TypeLib\Version = "1.3" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-402E-022E-6180-C3944DE3F9C8}\NumMethods\ = "51" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CB8D-4382-90BA-B7DA78A74573}\NumMethods C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9B2D-4377-BFE6-9702E881516B}\NumMethods C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FD1C-411A-95C5-E9BB1414E632}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\ = "IMouse" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CF37-453B-9289-3B0F521CAF27}\TypeLib\Version = "1.3" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-61D9-4940-A084-E6BB29AF3D83}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9849-4F47-813E-24A75DC85615} C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-DAD4-4496-85CF-3F76BCB3B5FA}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}\ProxyStubClsid32 C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4737-457B-99FC-BC52C851A44F}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4A75-437E-B0BB-7E7C90D0DF2A}\ = "IGuestSession" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F1F8-4590-941A-CDB66075C5BF}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CC87-4F6E-A0E9-47BB7F2D4BE5}\ProxyStubClsid32 C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-647D-45AC-8FE9-F49B3183BA37}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CD54-400C-B858-797BCB82570E} C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E191-400B-840E-970F3DAD7296} C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-604D-11E9-92D3-53CB473DB9FB}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5A1D-43F1-6F27-6A0DB298A9A8}\TypeLib C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1F04-4191-AA2F-1FAC9646AE4C}\ = "IProgressEvent" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-44DE-1653-B717-2EBF0CA9B664}\NumMethods\ = "39" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-2F1A-4D6C-81FC-E3FA843F49AE} C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3346-49D6-8F1C-41B0C4784FF2}\NumMethods\ = "15" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CB63-47A1-84FB-02C4894B89A9}\ = "IHostNameResolutionConfigurationChangeEvent" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-929C-40E8-BF16-FEA557CD8E7E} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D612-47D3-89D4-DB3992533948} C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7E67-4144-BF34-41C38E8B4CC7}\NumMethods C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80F6-4266-8E20-16371F68FA25}\NumMethods C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7E67-4144-BF34-41C38E8B4CC7}\NumMethods\ = "40" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AEDF-461C-BE2C-99E91BDAD8A1}\NumMethods\ = "47" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4289-EF4E-8E6A-E5B07816B631}\TypeLib\Version = "1.3" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3534-4239-B2DE-8E1535D94C0B}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox\ = "VirtualBox Class" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2e88-4436-83d7-50f3e64d0503} C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4521-44CC-DF95-186E4D057C83}\TypeLib\Version = "1.3" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-23D0-430A-A7FF-7ED7F05534BC} C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9849-4F47-813E-24A75DC85615}\NumMethods\ = "13" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-AC97-4C16-B3E2-81BD8A57CC27}\NumMethods\ = "14" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3534-4239-B2DE-8E1535D94C0B}\ = "ISharedFolderChangedEvent" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4C1B-EDF7-FDF3-C1BE6827DC28}\TypeLib\Version = "1.3" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-44E0-CA69-E9E0-D4907CECCBE5}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8F30-401B-A8CD-FE31DBE839C0}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486F-40DB-9150-DEEE3FD24189}\TypeLib C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7006-40D4-B339-472EE3801844}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4430-499F-92C8-8BED814A567A}\NumMethods\ = "17" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CB8D-4382-90BA-B7DA78A74573}\NumMethods\ = "19" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-BF98-47FB-AB2F-B5177533F493}\NumMethods C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HKEY_LOCAL_MACHINE C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}\ = "IRuntimeErrorEvent" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E254-4E5B-A1F2-011CF991C38D} C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B855-40B8-AB0C-44D3515B4528}\ProxyStubClsid32 C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}\TypeLib C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-735F-4FDE-8A54-427D49409B5F}\ = "ICloudNetwork" C:\Windows\SYSTEM32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-799A-4489-86CD-FE8E45B2FF8E}\ProxyStubClsid32 C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F4C4-4020-A185-0D2881BCFA8B}\ProxyStubClsid32 C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\TypeLib\Version = "1.3" C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0C65-11EA-AD23-0FF257C71A7F}\NumMethods C:\Program Files\ldplayer9box\Ld9BoxSVC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5409-414B-BD16-77DF7BA3451E}\NumMethods\ = "25" C:\Windows\SYSTEM32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-DA7C-44C8-A7AC-9F173490446A}\NumMethods\ = "13" C:\Windows\SysWOW64\regsvr32.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 651784.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\LDPlayer\LDPlayer9\dnplayer.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A
Token: SeDebugPrivilege N/A C:\LDPlayer\LDPlayer9\LDPlayer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnplayer.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnplayer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnplayer.exe N/A
N/A N/A C:\LDPlayer\LDPlayer9\dnplayer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3100 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe
PID 3100 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe
PID 3084 wrote to memory of 3264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 3264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 2000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4452 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4452 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3084 wrote to memory of 4660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe

"C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe"

C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe

"C:\Users\Admin\AppData\Local\Temp\AcuraHooking.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9d30946f8,0x7ff9d3094708,0x7ff9d3094718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5064 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5648 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7300 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8284 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1196 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8764 /prefetch:1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7312 /prefetch:8

C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe

"C:\Users\Admin\Downloads\LDPlayer9_ens_1001_ld.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7632 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15551607122344979466,1707102415765859124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9564 /prefetch:1

C:\Windows\SysWOW64\taskkill.exe

"taskkill" /F /IM dnplayer.exe /T

C:\Windows\SysWOW64\taskkill.exe

"taskkill" /F /IM dnmultiplayer.exe /T

C:\Windows\SysWOW64\taskkill.exe

"taskkill" /F /IM dnmultiplayerex.exe /T

C:\Windows\SysWOW64\taskkill.exe

"taskkill" /F /IM bugreport.exe /T

C:\LDPlayer\LDPlayer9\LDPlayer.exe

"C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=1001 -language=en -path="C:\LDPlayer\LDPlayer9\"

C:\LDPlayer\LDPlayer9\dnrepairer.exe

"C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=459482

C:\Windows\SysWOW64\net.exe

"net" start cryptsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start cryptsvc

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" Softpub.dll /s

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" Wintrust.dll /s

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" Initpki.dll /s

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\system32\regsvr32" Initpki.dll /s

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" dssenh.dll /s

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" rsaenh.dll /s

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" cryptdlg.dll /s

C:\Windows\SysWOW64\takeown.exe

"takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y

C:\Windows\SysWOW64\icacls.exe

"icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t

C:\Windows\SysWOW64\takeown.exe

"takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"

C:\Windows\SysWOW64\icacls.exe

"icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t

C:\Windows\SysWOW64\dism.exe

C:\Windows\system32\dism.exe /Online /English /Get-Features

C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe

C:\Users\Admin\AppData\Local\Temp\192399BC-4054-4701-A2B4-90484C17D265\dismhost.exe {29E0B180-710F-4B77-8C89-BA2AF3CFFB94}

C:\Windows\SysWOW64\sc.exe

sc query HvHost

C:\Windows\SysWOW64\sc.exe

sc query vmms

C:\Windows\SysWOW64\sc.exe

sc query vmcompute

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe

"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer

C:\Windows\SYSTEM32\regsvr32.exe

"regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s

C:\Windows\SYSTEM32\regsvr32.exe

"regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s

C:\Windows\SysWOW64\regsvr32.exe

"regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s

C:\Windows\SysWOW64\sc.exe

"C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto

C:\Windows\SysWOW64\sc.exe

"C:\Windows\system32\sc" start Ld9BoxSup

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow

C:\LDPlayer\LDPlayer9\driverconfig.exe

"C:\LDPlayer\LDPlayer9\driverconfig.exe"

C:\Windows\SysWOW64\takeown.exe

"takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y

C:\Windows\SysWOW64\icacls.exe

"icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t

C:\LDPlayer\LDPlayer9\dnplayer.exe

"C:\LDPlayer\LDPlayer9\\dnplayer.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4e8 0x374

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe

"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding

C:\Windows\SysWOW64\sc.exe

sc query HvHost

C:\Windows\SysWOW64\sc.exe

sc query vmms

C:\Windows\SysWOW64\sc.exe

sc query vmcompute

C:\Program Files\ldplayer9box\vbox-img.exe

"C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000

C:\Program Files\ldplayer9box\vbox-img.exe

"C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000

C:\Program Files\ldplayer9box\vbox-img.exe

"C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000

C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe

"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config

C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe

"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config

C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe

"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config

C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe

"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config

C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe

"C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
BE 88.221.83.178:443 www.bing.com tcp
US 8.8.8.8:53 178.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
BE 2.17.107.114:443 www.bing.com tcp
US 8.8.8.8:53 114.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
BE 88.221.83.233:443 r.bing.com tcp
BE 88.221.83.233:443 r.bing.com tcp
BE 88.221.83.186:443 th.bing.com tcp
BE 88.221.83.186:443 th.bing.com tcp
US 8.8.8.8:53 233.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 186.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 20.190.159.0:443 login.microsoftonline.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 89.33.18.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
BE 88.221.83.186:443 www.bing.com tcp
US 8.8.8.8:53 bing.com udp
US 13.107.21.200:443 bing.com tcp
US 8.8.8.8:53 www.ldplayer.net udp
US 163.181.154.238:443 www.ldplayer.net tcp
US 163.181.154.238:443 www.ldplayer.net tcp
US 8.8.8.8:53 cdn.ldplayer.net udp
US 8.8.8.8:53 cmp.setupcmp.com udp
US 104.26.5.6:443 cmp.setupcmp.com tcp
US 104.26.5.6:443 cmp.setupcmp.com tcp
FR 3.162.38.2:443 cdn.ldplayer.net tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
US 104.26.5.6:443 cmp.setupcmp.com tcp
GB 142.250.187.238:443 fundingchoicesmessages.google.com tcp
GB 142.250.187.238:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 res.ldplayer.net udp
US 163.181.154.241:443 res.ldplayer.net tcp
US 8.8.8.8:53 238.154.181.163.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 6.5.26.104.in-addr.arpa udp
US 8.8.8.8:53 2.38.162.3.in-addr.arpa udp
US 8.8.8.8:53 50.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 241.154.181.163.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 apien.ldplayer.net udp
US 8.8.8.8:53 usersdk.ldmnq.com udp
US 8.8.8.8:53 play-lh.googleusercontent.com udp
GB 142.250.200.14:443 apis.google.com udp
GB 142.250.178.22:443 play-lh.googleusercontent.com tcp
FR 3.162.38.109:443 apien.ldplayer.net tcp
FR 3.162.38.109:443 apien.ldplayer.net tcp
FR 3.162.38.109:443 apien.ldplayer.net tcp
SG 8.219.223.66:443 usersdk.ldmnq.com tcp
SG 8.219.223.66:443 usersdk.ldmnq.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 22.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 109.38.162.3.in-addr.arpa udp
US 8.8.8.8:53 66.223.219.8.in-addr.arpa udp
US 8.8.8.8:53 ldcdn.ldmnq.com udp
NL 142.250.27.84:443 accounts.google.com udp
US 163.181.154.235:443 ldcdn.ldmnq.com tcp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 235.154.181.163.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 aefd.nelreports.net udp
US 2.17.251.10:443 aefd.nelreports.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 2.17.251.10:443 aefd.nelreports.net udp
US 8.8.8.8:53 10.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 stpd.cloud udp
US 104.18.31.49:443 stpd.cloud tcp
US 8.8.8.8:53 apps.identrust.com udp
BE 2.17.107.235:80 apps.identrust.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.googletagservices.com udp
GB 216.58.212.194:443 www.googletagservices.com tcp
US 8.8.8.8:53 49.31.18.104.in-addr.arpa udp
US 8.8.8.8:53 235.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 194.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 194.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net tcp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 tagan.adlightning.com udp
FR 99.86.91.39:443 tagan.adlightning.com tcp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 c.amazon-adsystem.com udp
US 8.8.8.8:53 script.4dex.io udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
DE 162.19.138.120:443 id5-sync.com tcp
US 104.26.8.169:443 script.4dex.io tcp
US 18.245.194.122:443 c.amazon-adsystem.com tcp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 prebid-stag.setupad.net udp
US 8.8.8.8:53 prebid-eu.creativecdn.com udp
US 8.8.8.8:53 bidder.criteo.com udp
US 8.8.8.8:53 mp.4dex.io udp
US 8.8.8.8:53 prebid.a-mo.net udp
US 8.8.8.8:53 rtb.openx.net udp
NL 185.184.8.90:443 prebid-eu.creativecdn.com tcp
US 172.64.153.78:443 mp.4dex.io tcp
US 8.8.8.8:53 prg.smartadserver.com udp
US 172.67.68.162:443 prebid-stag.setupad.net tcp
US 172.67.68.162:443 prebid-stag.setupad.net tcp
US 8.8.8.8:53 rtb.adxpremium.services udp
NL 145.40.97.66:443 prebid.a-mo.net tcp
US 8.8.8.8:53 adx.adform.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 35.186.253.211:443 rtb.openx.net tcp
NL 185.106.140.18:443 rtb.adxpremium.services tcp
DK 37.157.5.132:443 adx.adform.net tcp
NL 81.17.55.113:443 prg.smartadserver.com tcp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
DE 162.19.138.120:443 lb.eu-1-id5-sync.com tcp
US 104.26.8.169:443 script.4dex.io tcp
US 8.8.8.8:53 cadmus.script.ac udp
US 104.18.23.145:443 cadmus.script.ac tcp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 39.91.86.99.in-addr.arpa udp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 120.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 169.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 122.194.245.18.in-addr.arpa udp
US 8.8.8.8:53 11.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 78.153.64.172.in-addr.arpa udp
US 8.8.8.8:53 162.68.67.172.in-addr.arpa udp
US 8.8.8.8:53 66.97.40.145.in-addr.arpa udp
US 8.8.8.8:53 10.7.250.178.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 211.253.186.35.in-addr.arpa udp
US 8.8.8.8:53 18.140.106.185.in-addr.arpa udp
US 8.8.8.8:53 113.55.17.81.in-addr.arpa udp
US 8.8.8.8:53 132.5.157.37.in-addr.arpa udp
US 8.8.8.8:53 145.23.18.104.in-addr.arpa udp
US 8.8.8.8:53 storage.googleapis.com udp
GB 142.250.178.27:443 storage.googleapis.com tcp
GB 142.250.178.27:443 storage.googleapis.com tcp
GB 142.250.178.27:443 storage.googleapis.com tcp
GB 142.250.178.27:443 storage.googleapis.com tcp
US 8.8.8.8:53 u.openx.net udp
US 34.98.64.218:443 u.openx.net tcp
US 8.8.8.8:53 aax.amazon-adsystem.com udp
US 8.8.8.8:53 config.aps.amazon-adsystem.com udp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 ads.us.e-planning.net udp
US 8.8.8.8:53 secure.cdn.fastclick.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 cdn.hadronid.net udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 104.22.53.173:443 cdn.hadronid.net tcp
FR 3.162.36.191:443 aax.amazon-adsystem.com tcp
FR 18.155.129.56:443 tags.crwdcntrl.net tcp
US 172.67.38.106:443 cdn.id5-sync.com tcp
FR 52.84.174.75:443 config.aps.amazon-adsystem.com tcp
NL 193.3.178.3:443 ads.us.e-planning.net tcp
GB 23.53.174.156:443 secure.cdn.fastclick.net tcp
GB 23.53.174.156:443 secure.cdn.fastclick.net tcp
FR 178.250.7.13:443 dnacdn.net tcp
US 34.98.64.218:443 u.openx.net udp
FR 178.250.7.13:443 dnacdn.net tcp
FR 52.84.174.75:443 config.aps.amazon-adsystem.com tcp
FR 3.162.36.191:443 aax.amazon-adsystem.com tcp
NL 193.3.178.3:443 ads.us.e-planning.net tcp
US 8.8.8.8:53 27.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 218.64.98.34.in-addr.arpa udp
US 8.8.8.8:53 id.hadron.ad.gt udp
US 8.8.8.8:53 cm.adform.net udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 e0898e37458b2b778e19588fd26378ad.safeframe.googlesyndication.com udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
DK 37.157.5.132:443 cm.adform.net tcp
US 172.67.23.234:443 id.hadron.ad.gt tcp
IE 52.215.133.162:443 bcp.crwdcntrl.net tcp
GB 172.217.169.65:443 e0898e37458b2b778e19588fd26378ad.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 secure-assets.rubiconproject.com udp
US 8.8.8.8:53 ssbsync-global.smartadserver.com udp
US 8.8.8.8:53 proc.ad.cpe.dotomi.com udp
US 8.8.8.8:53 a.ad.gt udp
BE 104.68.78.171:443 secure-assets.rubiconproject.com tcp
NL 64.158.223.146:443 proc.ad.cpe.dotomi.com tcp
FR 217.182.178.228:443 ssbsync-global.smartadserver.com tcp
US 104.22.4.69:443 a.ad.gt tcp
US 8.8.8.8:53 static.criteo.net udp
US 8.8.8.8:53 eus.rubiconproject.com udp
NL 178.250.1.3:443 static.criteo.net tcp
BE 2.21.18.175:443 eus.rubiconproject.com tcp
US 8.8.8.8:53 106.38.67.172.in-addr.arpa udp
US 8.8.8.8:53 191.36.162.3.in-addr.arpa udp
US 8.8.8.8:53 173.53.22.104.in-addr.arpa udp
US 8.8.8.8:53 56.129.155.18.in-addr.arpa udp
US 8.8.8.8:53 75.174.84.52.in-addr.arpa udp
US 8.8.8.8:53 13.7.250.178.in-addr.arpa udp
US 8.8.8.8:53 156.174.53.23.in-addr.arpa udp
US 8.8.8.8:53 234.23.67.172.in-addr.arpa udp
US 8.8.8.8:53 65.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 162.133.215.52.in-addr.arpa udp
US 8.8.8.8:53 146.223.158.64.in-addr.arpa udp
US 8.8.8.8:53 171.78.68.104.in-addr.arpa udp
US 8.8.8.8:53 228.178.182.217.in-addr.arpa udp
US 8.8.8.8:53 69.4.22.104.in-addr.arpa udp
US 8.8.8.8:53 ice.360yield.com udp
IE 34.246.138.179:443 ice.360yield.com tcp
US 8.8.8.8:53 8proof.com udp
GB 142.250.178.27:443 storage.googleapis.com udp
US 52.116.53.150:443 8proof.com tcp
US 8.8.8.8:53 3.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 175.18.21.2.in-addr.arpa udp
US 8.8.8.8:53 179.138.246.34.in-addr.arpa udp
US 8.8.8.8:53 token.rubiconproject.com udp
NL 69.173.156.149:443 token.rubiconproject.com tcp
US 8.8.8.8:53 node.setupad.com udp
DE 159.89.25.223:443 node.setupad.com tcp
US 8.8.8.8:53 sync.a-mo.net udp
US 8.8.8.8:53 adxbid.info udp
US 8.8.8.8:53 setupad-d.openx.net udp
US 8.8.8.8:53 eu-u.openx.net udp
US 8.8.8.8:53 secure.adnxs.com udp
US 8.8.8.8:53 ad.turn.com udp
US 8.8.8.8:53 sync-tm.everesttech.net udp
US 8.8.8.8:53 sync.adotmob.com udp
US 172.67.138.13:443 adxbid.info tcp
FR 45.137.176.88:443 sync.adotmob.com tcp
US 151.101.2.49:443 sync-tm.everesttech.net tcp
DE 37.252.171.85:443 secure.adnxs.com tcp
NL 147.75.84.158:443 sync.a-mo.net tcp
NL 46.228.164.11:443 ad.turn.com tcp
US 8.8.8.8:53 rtb-csync.smartadserver.com udp
NL 81.17.55.117:443 rtb-csync.smartadserver.com tcp
NL 81.17.55.117:443 rtb-csync.smartadserver.com tcp
NL 81.17.55.117:443 rtb-csync.smartadserver.com tcp
NL 81.17.55.117:443 rtb-csync.smartadserver.com tcp
US 8.8.8.8:53 u.4dex.io udp
US 8.8.8.8:53 150.53.116.52.in-addr.arpa udp
US 8.8.8.8:53 149.156.173.69.in-addr.arpa udp
US 8.8.8.8:53 223.25.89.159.in-addr.arpa udp
US 8.8.8.8:53 13.138.67.172.in-addr.arpa udp
US 8.8.8.8:53 49.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 88.176.137.45.in-addr.arpa udp
US 8.8.8.8:53 158.84.75.147.in-addr.arpa udp
US 8.8.8.8:53 85.171.252.37.in-addr.arpa udp
US 8.8.8.8:53 11.164.228.46.in-addr.arpa udp
US 34.149.40.38:443 u.4dex.io tcp
US 8.8.8.8:53 ag.gbc.criteo.com udp
US 8.8.8.8:53 gem.gbc.criteo.com udp
FR 185.235.86.206:443 ag.gbc.criteo.com tcp
FR 185.235.86.195:443 gem.gbc.criteo.com tcp
US 8.8.8.8:53 eb2.3lift.com udp
US 76.223.111.18:443 eb2.3lift.com tcp
US 8.8.8.8:53 as.ck-ie.com udp
US 8.8.8.8:53 assets.a-mo.net udp
US 8.2.110.113:443 as.ck-ie.com tcp
US 104.19.158.19:443 assets.a-mo.net tcp
US 8.8.8.8:53 id.a-mx.com udp
US 8.8.8.8:53 ib.adnxs.com udp
NL 79.127.227.46:443 id.a-mx.com tcp
GB 89.187.167.3:443 vid.vidoomy.com tcp
US 8.8.8.8:53 crt.sectigo.com udp
US 104.18.38.233:80 crt.sectigo.com tcp
US 8.8.8.8:53 id.rtb.mx udp
US 8.8.8.8:53 ow.pubmatic.com udp
NL 185.64.189.116:443 ow.pubmatic.com tcp
DE 79.127.216.47:443 id.rtb.mx tcp
US 8.8.8.8:53 117.55.17.81.in-addr.arpa udp
US 8.8.8.8:53 38.40.149.34.in-addr.arpa udp
US 8.8.8.8:53 206.86.235.185.in-addr.arpa udp
US 8.8.8.8:53 195.86.235.185.in-addr.arpa udp
US 8.8.8.8:53 18.111.223.76.in-addr.arpa udp
US 8.8.8.8:53 19.158.19.104.in-addr.arpa udp
US 8.8.8.8:53 113.110.2.8.in-addr.arpa udp
US 8.8.8.8:53 46.227.127.79.in-addr.arpa udp
US 8.8.8.8:53 3.167.187.89.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 116.189.64.185.in-addr.arpa udp
US 8.8.8.8:53 ssum.casalemedia.com udp
US 172.64.151.101:443 ssum.casalemedia.com tcp
US 8.8.8.8:53 user-sync.adxpremium.services udp
US 209.192.201.180:443 user-sync.adxpremium.services tcp
US 8.8.8.8:53 vpaid.vidoomy.com udp
GB 89.187.167.4:443 vpaid.vidoomy.com tcp
US 8.8.8.8:53 ads.pubmatic.com udp
US 8.8.8.8:53 creativecdn.com udp
US 35.186.253.211:443 rtb.openx.net udp
GB 2.21.188.239:443 ads.pubmatic.com tcp
US 8.8.8.8:53 a.vidoomy.com udp
US 8.8.8.8:53 47.216.127.79.in-addr.arpa udp
US 8.8.8.8:53 101.151.64.172.in-addr.arpa udp
US 8.8.8.8:53 180.201.192.209.in-addr.arpa udp
US 8.8.8.8:53 4.167.187.89.in-addr.arpa udp
US 8.8.8.8:53 239.188.21.2.in-addr.arpa udp
ES 212.36.83.246:443 a.vidoomy.com tcp
US 8.8.8.8:53 ap.lijit.com udp
IE 54.154.136.16:443 ap.lijit.com tcp
US 8.8.8.8:53 pixel.rubiconproject.com udp
NL 69.173.156.149:443 pixel.rubiconproject.com tcp
US 8.8.8.8:53 246.83.36.212.in-addr.arpa udp
US 8.8.8.8:53 16.136.154.54.in-addr.arpa udp
NL 81.17.55.113:443 prg.smartadserver.com tcp
US 35.186.253.211:443 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 8.8.8.8:53 sync.1rx.io udp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
NL 46.228.174.117:443 sync.1rx.io tcp
US 34.149.40.38:443 u.4dex.io udp
US 8.8.8.8:53 117.174.228.46.in-addr.arpa udp
US 8.8.8.8:53 7.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 aax-eu.amazon-adsystem.com udp
IE 54.239.33.159:443 aax-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 d3n1ms4uhtqgov.cloudfront.net udp
FR 13.249.12.102:443 d3n1ms4uhtqgov.cloudfront.net tcp
US 8.8.8.8:53 159.33.239.54.in-addr.arpa udp
US 8.8.8.8:53 102.12.249.13.in-addr.arpa udp
US 8.8.8.8:53 d1arl2thrafelv.cloudfront.net udp
FR 18.155.128.116:443 d1arl2thrafelv.cloudfront.net tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 onetag-sys.com udp
DE 51.38.120.206:443 onetag-sys.com tcp
FR 18.155.128.116:443 d1arl2thrafelv.cloudfront.net tcp
US 8.8.8.8:53 rtb.mfadsrvr.com udp
US 8.8.8.8:53 sync.mathtag.com udp
US 74.121.140.211:443 sync.mathtag.com tcp
DE 18.157.153.25:443 rtb.mfadsrvr.com tcp
US 8.8.8.8:53 pixel-eu.rubiconproject.com udp
NL 69.173.156.148:443 pixel-eu.rubiconproject.com tcp
DE 51.38.120.206:443 onetag-sys.com udp
US 8.8.8.8:53 116.128.155.18.in-addr.arpa udp
US 8.8.8.8:53 206.120.38.51.in-addr.arpa udp
US 8.8.8.8:53 25.153.157.18.in-addr.arpa udp
US 8.8.8.8:53 211.140.121.74.in-addr.arpa udp
US 8.8.8.8:53 148.156.173.69.in-addr.arpa udp
DE 37.252.173.215:443 ib.adnxs.com tcp
US 8.8.8.8:53 ads.stickyadstv.com udp
FR 154.54.250.80:443 ads.stickyadstv.com tcp
GB 142.250.178.27:443 storage.googleapis.com udp
US 8.8.8.8:53 ssbsync.smartadserver.com udp
NL 89.149.192.245:443 ssbsync.smartadserver.com tcp
DE 159.89.25.223:443 node.setupad.com tcp
US 8.8.8.8:53 pxl.iqm.com udp
US 34.193.171.116:443 pxl.iqm.com tcp
NL 81.17.55.117:443 rtb-csync.smartadserver.com tcp
NL 69.173.156.149:443 pixel-eu.rubiconproject.com tcp
US 8.8.8.8:53 cs.admanmedia.com udp
US 80.77.87.166:443 cs.admanmedia.com tcp
US 8.8.8.8:53 s.company-target.com udp
US 8.8.8.8:53 t.adx.opera.com udp
US 34.96.71.22:443 s.company-target.com tcp
NL 82.145.213.8:443 t.adx.opera.com tcp
US 8.8.8.8:53 215.173.252.37.in-addr.arpa udp
US 8.8.8.8:53 80.250.54.154.in-addr.arpa udp
US 8.8.8.8:53 245.192.149.89.in-addr.arpa udp
US 8.8.8.8:53 22.71.96.34.in-addr.arpa udp
US 8.8.8.8:53 116.171.193.34.in-addr.arpa udp
DE 162.19.138.120:443 lb.eu-1-id5-sync.com tcp
US 8.8.8.8:53 cm.g.doubleclick.net udp
GB 142.250.187.226:443 cm.g.doubleclick.net tcp
GB 142.250.187.226:443 cm.g.doubleclick.net udp
US 8.8.8.8:53 8.213.145.82.in-addr.arpa udp
US 8.8.8.8:53 166.87.77.80.in-addr.arpa udp
US 8.8.8.8:53 226.187.250.142.in-addr.arpa udp
FR 217.182.178.228:443 ssbsync-global.smartadserver.com tcp
US 8.8.8.8:53 image8.pubmatic.com udp
NL 198.47.127.18:443 image8.pubmatic.com tcp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 52.46.155.104:443 s.amazon-adsystem.com tcp
US 8.8.8.8:53 spl.zeotap.com udp
US 172.67.40.173:443 spl.zeotap.com tcp
US 8.8.8.8:53 x.bidswitch.net udp
US 8.8.8.8:53 173.40.67.172.in-addr.arpa udp
US 8.8.8.8:53 18.127.47.198.in-addr.arpa udp
US 8.8.8.8:53 104.155.46.52.in-addr.arpa udp
NL 35.214.149.91:443 x.bidswitch.net tcp
US 8.8.8.8:53 91.149.214.35.in-addr.arpa udp
US 8.8.8.8:53 encdn.ldmnq.com udp
FR 18.155.129.119:443 encdn.ldmnq.com tcp
US 8.8.8.8:53 26.200.245.18.in-addr.arpa udp
US 8.8.8.8:53 119.129.155.18.in-addr.arpa udp
US 8.8.8.8:53 90.193.84.52.in-addr.arpa udp
US 8.8.8.8:53 middledata.ldplayer.net udp
SG 8.219.136.97:443 middledata.ldplayer.net tcp
US 8.8.8.8:53 97.136.219.8.in-addr.arpa udp
NL 81.17.55.113:443 prg.smartadserver.com tcp
US 8.8.8.8:53 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 8.8.8.8:53 www.ldplayer.net udp
US 35.227.252.103:443 rtb.openx.net udp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 103.252.227.35.in-addr.arpa udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 ssum-sec.casalemedia.com udp
NL 185.89.211.84:443 ib.adnxs.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 84.211.89.185.in-addr.arpa udp
US 8.8.8.8:53 ap.lijit.com udp
US 34.149.40.38:443 u.4dex.io udp
IE 54.73.1.184:443 ap.lijit.com tcp
US 8.8.8.8:53 ce.lijit.com udp
IE 52.30.41.229:443 ce.lijit.com tcp
IE 52.30.41.229:443 ce.lijit.com tcp
US 8.8.8.8:53 184.1.73.54.in-addr.arpa udp
DE 159.89.25.223:443 node.setupad.com tcp
DE 159.89.25.223:443 node.setupad.com tcp
US 8.8.8.8:53 229.41.30.52.in-addr.arpa udp
SG 8.219.136.97:443 middledata.ldplayer.net tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 81.17.55.113:443 prg.smartadserver.com tcp
US 34.98.64.218:443 eu-u.openx.net udp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
DE 159.89.25.223:443 node.setupad.com tcp
GB 216.58.213.14:80 www.google-analytics.com tcp
US 8.8.8.8:53 middledata.ldplayer.net udp
SG 8.219.136.97:443 middledata.ldplayer.net tcp
NL 81.17.55.113:443 prg.smartadserver.com tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 www.ldplayer.net udp
DE 159.89.25.223:443 node.setupad.com tcp
SG 8.219.136.97:443 middledata.ldplayer.net tcp
US 8.8.8.8:53 ad.ldplayer.net udp
US 8.8.8.8:53 en.ldplayer.net udp
US 8.8.8.8:53 cdn.ldplayer.net udp
FR 52.222.149.35:443 ad.ldplayer.net tcp
US 163.181.154.231:443 en.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
SG 8.219.136.97:443 middledata.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
US 8.8.8.8:53 advertise.ldplayer.net udp
US 163.181.154.248:443 advertise.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
US 8.8.8.8:53 35.149.222.52.in-addr.arpa udp
US 8.8.8.8:53 231.154.181.163.in-addr.arpa udp
US 8.8.8.8:53 36.38.162.3.in-addr.arpa udp
US 8.8.8.8:53 248.154.181.163.in-addr.arpa udp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
FR 18.155.129.82:443 encdn.ldmnq.com tcp
US 8.8.8.8:53 res.ldplayer.net udp
US 163.181.154.241:443 res.ldplayer.net tcp
SG 8.219.136.97:443 middledata.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
US 8.8.8.8:53 82.129.155.18.in-addr.arpa udp
US 163.181.154.241:443 res.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
US 163.181.154.248:443 advertise.ldplayer.net tcp
FR 52.222.149.35:443 ad.ldplayer.net tcp
FR 52.222.149.35:443 ad.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
US 163.181.154.241:443 res.ldplayer.net tcp
FR 3.162.38.36:443 cdn.ldplayer.net tcp
US 8.8.8.8:53 apien.ldmnq.com udp
FR 3.162.38.101:80 apien.ldmnq.com tcp
FR 52.222.149.35:443 ad.ldplayer.net tcp
FR 52.222.149.35:443 ad.ldplayer.net tcp
FR 3.162.38.101:443 apien.ldmnq.com tcp
US 8.8.8.8:53 101.38.162.3.in-addr.arpa udp
FR 3.162.38.101:443 apien.ldmnq.com tcp
FR 52.222.149.35:443 ad.ldplayer.net tcp
FR 52.222.149.35:443 ad.ldplayer.net tcp
US 35.227.252.103:443 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 8.8.8.8:53 prg.smartadserver.com udp
NL 89.149.193.96:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 96.193.149.89.in-addr.arpa udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
FR 52.222.149.35:443 ad.ldplayer.net tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 89.149.193.96:443 prg.smartadserver.com tcp
US 35.227.252.103:443 rtb.openx.net udp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp
NL 89.149.193.96:443 prg.smartadserver.com tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 35.227.252.103:443 rtb.openx.net udp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 89.149.193.96:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 www.ldplayer.net udp
DE 159.89.25.223:443 node.setupad.com tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 89.149.193.96:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 35.227.252.103:443 rtb.openx.net udp
US 8.8.8.8:53 prg.smartadserver.com udp
FR 178.250.7.10:443 bidder.criteo.com tcp
FR 51.178.195.208:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 208.195.178.51.in-addr.arpa udp
DE 159.89.25.223:443 node.setupad.com tcp
FR 51.178.195.208:443 prg.smartadserver.com tcp
US 35.227.252.103:443 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 node.setupad.com udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 226.179.250.142.in-addr.arpa udp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 8.8.8.8:53 rtb.openx.net udp
US 8.8.8.8:53 prg.smartadserver.com udp
US 35.186.253.211:443 rtb.openx.net udp
FR 185.86.138.16:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 16.138.86.185.in-addr.arpa udp
US 8.8.8.8:53 e0898e37458b2b778e19588fd26378ad.safeframe.googlesyndication.com udp
US 8.8.8.8:53 www.ldplayer.net udp
GB 172.217.169.65:443 e0898e37458b2b778e19588fd26378ad.safeframe.googlesyndication.com udp
US 52.116.53.150:443 8proof.com tcp
DE 159.89.25.223:443 node.setupad.com tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 35.186.253.211:443 rtb.openx.net udp
FR 185.86.138.16:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 8.8.8.8:53 prg.smartadserver.com udp
US 35.186.253.211:443 rtb.openx.net udp
FR 5.196.111.64:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 64.111.196.5.in-addr.arpa udp
US 8.8.8.8:53 www.ldplayer.net udp
DE 159.89.25.223:443 node.setupad.com tcp
FR 5.196.111.64:443 prg.smartadserver.com tcp
US 35.186.253.211:443 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 66.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 prg.smartadserver.com udp
US 35.186.253.211:443 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
FR 185.86.139.95:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 95.139.86.185.in-addr.arpa udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net udp
FR 185.86.139.95:443 prg.smartadserver.com tcp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 35.186.253.211:443 rtb.openx.net udp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 www.ldplayer.net udp
US 8.8.8.8:53 e0898e37458b2b778e19588fd26378ad.safeframe.googlesyndication.com udp
US 52.116.53.150:443 8proof.com tcp
US 8.8.8.8:53 node.setupad.com udp
DE 159.89.25.223:443 node.setupad.com tcp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 prg.smartadserver.com udp
US 35.186.253.211:443 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
NL 89.149.193.97:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 172.217.16.226:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 97.193.149.89.in-addr.arpa udp
US 8.8.8.8:53 226.16.217.172.in-addr.arpa udp
NL 89.149.193.97:443 prg.smartadserver.com tcp
US 8.8.8.8:53 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
US 35.186.253.211:443 rtb.openx.net udp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 www.ldplayer.net udp
GB 172.217.169.65:443 e0898e37458b2b778e19588fd26378ad.safeframe.googlesyndication.com udp
DE 159.89.25.223:443 node.setupad.com tcp
US 8.8.8.8:53 prg.smartadserver.com udp
US 35.186.253.211:443 rtb.openx.net udp
FR 178.250.7.10:443 bidder.criteo.com tcp
FR 185.86.139.59:443 prg.smartadserver.com tcp
NL 178.250.1.7:443 ssp-sync.criteo.com tcp
US 8.8.8.8:53 59.139.86.185.in-addr.arpa udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
DE 159.89.25.223:443 node.setupad.com tcp
GB 172.217.16.226:443 googleads.g.doubleclick.net udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI31002\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI31002\python312.dll

MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

C:\Users\Admin\AppData\Local\Temp\_MEI31002\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI31002\base_library.zip

MD5 8dad91add129dca41dd17a332a64d593
SHA1 70a4ec5a17ed63caf2407bd76dc116aca7765c0d
SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
SHA512 2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

C:\Users\Admin\AppData\Local\Temp\_MEI31002\python3.DLL

MD5 79b02450d6ca4852165036c8d4eaed1f
SHA1 ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4
SHA256 d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
SHA512 47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

C:\Users\Admin\AppData\Local\Temp\_MEI31002\_ctypes.pyd

MD5 bbd5533fc875a4a075097a7c6aba865e
SHA1 ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00
SHA256 be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570
SHA512 23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

C:\Users\Admin\AppData\Local\Temp\_MEI31002\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI31002\_lzma.pyd

MD5 05e8b2c429aff98b3ae6adc842fb56a3
SHA1 834ddbced68db4fe17c283ab63b2faa2e4163824
SHA256 a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c
SHA512 badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

C:\Users\Admin\AppData\Local\Temp\_MEI31002\VCRUNTIME140_1.dll

MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

C:\Users\Admin\AppData\Local\Temp\_MEI31002\unicodedata.pyd

MD5 16be9a6f941f1a2cb6b5fca766309b2c
SHA1 17b23ae0e6a11d5b8159c748073e36a936f3316a
SHA256 10ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04
SHA512 64b7ecc58ae7cf128f03a0d5d5428aaa0d4ad4ae7e7d19be0ea819bbbf99503836bfe4946df8ee3ab8a92331fdd002ab9a9de5146af3e86fef789ce46810796b

C:\Users\Admin\AppData\Local\Temp\_MEI31002\tk86t.dll

MD5 9fb68a0252e2b6cd99fd0cb6708c1606
SHA1 60ab372e8473fad0f03801b6719bf5cccfc2592e
SHA256 c6ffe2238134478d8cb1c695d57e794516f3790e211ff519f551e335230de7de
SHA512 f5de1b1a9dc2d71ae27dfaa7b01e079e4970319b6424b44c47f86360faf0b976ed49dab6ee9f811e766a2684b647711e567cbaa6660f53ba82d724441c4ddd06

C:\Users\Admin\AppData\Local\Temp\_MEI31002\tcl86t.dll

MD5 21dc82dd9cc445f92e0172d961162222
SHA1 73bc20b509e1545b16324480d9620ae25364ebf1
SHA256 c2966941f116fab99f48ab9617196b43a5ee2fd94a8c70761bda56cb334daa03
SHA512 3051a9d723fb7fc11f228e9f27bd2644ac5a0a95e7992d60c757240577b92fc31fa373987b338e6bc5707317d20089df4b48d1b188225ff370ad2a68d5ff7ba6

C:\Users\Admin\AppData\Local\Temp\_MEI31002\select.pyd

MD5 92b440ca45447ec33e884752e4c65b07
SHA1 5477e21bb511cc33c988140521a4f8c11a427bcc
SHA256 680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3
SHA512 40e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191

C:\Users\Admin\AppData\Local\Temp\_MEI31002\pyexpat.pyd

MD5 5e911ca0010d5c9dce50c58b703e0d80
SHA1 89be290bebab337417c41bab06f43effb4799671
SHA256 4779e19ee0f4f0be953805efa1174e127f6e91ad023bd33ac7127fef35e9087b
SHA512 e3f1db80748333f08f79f735a457246e015c10b353e1a52abe91ed9a69f7de5efa5f78a2ed209e97b16813cb74a87f8f0c63a5f44c8b59583851922f54a48cf5

C:\Users\Admin\AppData\Local\Temp\_MEI31002\libssl-3.dll

MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

C:\Users\Admin\AppData\Local\Temp\_MEI31002\libcrypto-3.dll

MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-utility-l1-1-0.dll

MD5 a0776b3a28f7246b4a24ff1b2867bdbf
SHA1 383c9a6afda7c1e855e25055aad00e92f9d6aaff
SHA256 2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9
SHA512 7c9f0f8e53b363ef5b2e56eec95e7b78ec50e9308f34974a287784a1c69c9106f49ea2d9ca037f0a7b3c57620fcbb1c7c372f207c68167df85797affc3d7f3ba

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-time-l1-1-0.dll

MD5 001e60f6bbf255a60a5ea542e6339706
SHA1 f9172ec37921432d5031758d0c644fe78cdb25fa
SHA256 82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945
SHA512 b1a6dc5a34968fbdc8147d8403adf8b800a06771cc9f15613f5ce874c29259a156bab875aae4caaec2117817ce79682a268aa6e037546aeca664cd4eea60adbf

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-string-l1-1-0.dll

MD5 115e8275eb570b02e72c0c8a156970b3
SHA1 c305868a014d8d7bbef9abbb1c49a70e8511d5a6
SHA256 415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004
SHA512 b97ef7c5203a0105386e4949445350d8ff1c83bdeaee71ccf8dc22f7f6d4f113cb0a9be136717895c36ee8455778549f629bf8d8364109185c0bf28f3cb2b2ca

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-stdio-l1-1-0.dll

MD5 96498dc4c2c879055a7aff2a1cc2451e
SHA1 fecbc0f854b1adf49ef07beacad3cec9358b4fb2
SHA256 273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d
SHA512 4e0b2ef0efe81a8289a447eb48898992692feee4739ceb9d87f5598e449e0059b4e6f4eb19794b9dcdce78c05c8871264797c14e4754fd73280f37ec3ea3c304

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-runtime-l1-1-0.dll

MD5 20c0afa78836b3f0b692c22f12bda70a
SHA1 60bb74615a71bd6b489c500e6e69722f357d283e
SHA256 962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc
SHA512 65f0e60136ab358661e5156b8ecd135182c8aaefd3ec320abdf9cfc8aeab7b68581890e0bbc56bad858b83d47b7a0143fa791195101dc3e2d78956f591641d16

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-process-l1-1-0.dll

MD5 272c0f80fd132e434cdcdd4e184bb1d8
SHA1 5bc8b7260e690b4d4039fe27b48b2cecec39652f
SHA256 bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d
SHA512 94892a934a92ef1630fbfea956d1fe3a3bfe687dec31092828960968cb321c4ab3af3caf191d4e28c8ca6b8927fbc1ec5d17d5c8a962c848f4373602ec982cd4

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-math-l1-1-0.dll

MD5 b8f0210c47847fc6ec9fbe2a1ad4debb
SHA1 e99d833ae730be1fedc826bf1569c26f30da0d17
SHA256 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7
SHA512 992d790e18ac7ae33958f53d458d15bff522a3c11a6bd7ee2f784ac16399de8b9f0a7ee896d9f2c96d1e2c8829b2f35ff11fc5d8d1b14c77e22d859a1387797c

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-locale-l1-1-0.dll

MD5 650435e39d38160abc3973514d6c6640
SHA1 9a5591c29e4d91eaa0f12ad603af05bb49708a2d
SHA256 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0
SHA512 7b4a8f86d583562956593d27b7ecb695cb24ab7192a94361f994fadba7a488375217755e7ed5071de1d0960f60f255aa305e9dd477c38b7bb70ac545082c9d5e

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-heap-l1-1-0.dll

MD5 d5d77669bd8d382ec474be0608afd03f
SHA1 1558f5a0f5facc79d3957ff1e72a608766e11a64
SHA256 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8
SHA512 8defa71772105fd9128a669f6ff19b6fe47745a0305beb9a8cadb672ed087077f7538cd56e39329f7daa37797a96469eae7cd5e4cca57c9a183b35bdc44182f3

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 5107487b726bdcc7b9f7e4c2ff7f907c
SHA1 ebc46221d3c81a409fab9815c4215ad5da62449c
SHA256 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade
SHA512 a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-environment-l1-1-0.dll

MD5 f9235935dd3ba2aa66d3aa3412accfbf
SHA1 281e548b526411bcb3813eb98462f48ffaf4b3eb
SHA256 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200
SHA512 ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-convert-l1-1-0.dll

MD5 edf71c5c232f5f6ef3849450f2100b54
SHA1 ed46da7d59811b566dd438fa1d09c20f5dc493ce
SHA256 b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc
SHA512 481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-crt-conio-l1-1-0.dll

MD5 d4fba5a92d68916ec17104e09d1d9d12
SHA1 247dbc625b72ffb0bf546b17fb4de10cad38d495
SHA256 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5
SHA512 d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-util-l1-1-0.dll

MD5 0f129611a4f1e7752f3671c9aa6ea736
SHA1 40c07a94045b17dae8a02c1d2b49301fad231152
SHA256 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f
SHA512 6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-timezone-l1-1-0.dll

MD5 d12403ee11359259ba2b0706e5e5111c
SHA1 03cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA512 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 fd46c3f6361e79b8616f56b22d935a53
SHA1 107f488ad966633579d8ec5eb1919541f07532ce
SHA256 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df
SHA512 3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-synch-l1-2-0.dll

MD5 1281e9d1750431d2fe3b480a8175d45c
SHA1 bc982d1c750b88dcb4410739e057a86ff02d07ef
SHA256 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa
SHA512 a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-synch-l1-1-0.dll

MD5 225d9f80f669ce452ca35e47af94893f
SHA1 37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50
SHA256 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232
SHA512 2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-string-l1-1-0.dll

MD5 2666581584ba60d48716420a6080abda
SHA1 c103f0ea32ebbc50f4c494bce7595f2b721cb5ad
SHA256 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328
SHA512 befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 a0c2dbe0f5e18d1add0d1ba22580893b
SHA1 29624df37151905467a223486500ed75617a1dfd
SHA256 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f
SHA512 3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-profile-l1-1-0.dll

MD5 f3ff2d544f5cd9e66bfb8d170b661673
SHA1 9e18107cfcd89f1bbb7fdaf65234c1dc8e614add
SHA256 e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f
SHA512 184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-processthreads-l1-1-1.dll

MD5 517eb9e2cb671ae49f99173d7f7ce43f
SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-processthreads-l1-1-0.dll

MD5 c3632083b312c184cbdd96551fed5519
SHA1 a93e8e0af42a144009727d2decb337f963a9312e
SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
SHA512 8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 0462e22f779295446cd0b63e61142ca5
SHA1 616a325cd5b0971821571b880907ce1b181126ae
SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
SHA512 07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 321a3ca50e80795018d55a19bf799197
SHA1 df2d3c95fb4cbb298d255d342f204121d9d7ef7f
SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
SHA512 3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-memory-l1-1-0.dll

MD5 3c38aac78b7ce7f94f4916372800e242
SHA1 c793186bcf8fdb55a1b74568102b4e073f6971d6
SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
SHA512 c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-localization-l1-2-0.dll

MD5 724223109e49cb01d61d63a8be926b8f
SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 1f2a00e72bc8fa2bd887bdb651ed6de5
SHA1 04d92e41ce002251cc09c297cf2b38c4263709ea
SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
SHA512 8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-interlocked-l1-1-0.dll

MD5 c6024cc04201312f7688a021d25b056d
SHA1 48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd
SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
SHA512 d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-heap-l1-1-0.dll

MD5 accc640d1b06fb8552fe02f823126ff5
SHA1 82ccc763d62660bfa8b8a09e566120d469f6ab67
SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
SHA512 6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-handle-l1-1-0.dll

MD5 e89cdcd4d95cda04e4abba8193a5b492
SHA1 5c0aee81f32d7f9ec9f0650239ee58880c9b0337
SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
SHA512 55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-file-l1-2-0.dll

MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-file-l1-1-0.dll

MD5 efad0ee0136532e8e8402770a64c71f9
SHA1 cda3774fe9781400792d8605869f4e6b08153e55
SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
SHA512 69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 eb0978a9213e7f6fdd63b2967f02d999
SHA1 9833f4134f7ac4766991c918aece900acfbf969f
SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
SHA512 6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-debug-l1-1-0.dll

MD5 33bbece432f8da57f17bf2e396ebaa58
SHA1 890df2dddfdf3eeccc698312d32407f3e2ec7eb1
SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
SHA512 619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-datetime-l1-1-0.dll

MD5 cfe0c1dfde224ea5fed9bd5ff778a6e0
SHA1 5150e7edd1293e29d2e4d6bb68067374b8a07ce6
SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
SHA512 b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

C:\Users\Admin\AppData\Local\Temp\_MEI31002\api-ms-win-core-console-l1-1-0.dll

MD5 e8b9d74bfd1f6d1cc1d99b24f44da796
SHA1 a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452
SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
SHA512 b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

C:\Users\Admin\AppData\Local\Temp\_MEI31002\_bz2.pyd

MD5 223fd6748cae86e8c2d5618085c768ac
SHA1 dcb589f2265728fe97156814cbe6ff3303cd05d3
SHA256 f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb
SHA512 9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

memory/5084-1069-0x00007FF9E4F30000-0x00007FF9E4F5A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 28bbc0e1efe14470a41ea4d297857a16
SHA1 cad377f379d123b7b0e62566637cec9e3cee3988
SHA256 da7d5ace6162aeccb5abd3d0bf214f4fb458234fa4674ec7f7b93fc8c148085f
SHA512 a7e617161e8ce860df3b5e00f3346632546ed12fbc8977ce0ab3b043fcafc6144c11d1ab8791f9afa6e3abc6bc048bcf433e842c21575d9a535bf104df50e623

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 133fb47a951323485349a75caa610d4e
SHA1 bd9937db06ea0ba60b11bd45d5aab02cb311c49e
SHA256 a0487409e1ce71887f677ecf4bb016d85c147c253ad6c76d9773d485425097ea
SHA512 3ffbbd162916ef399ee87261ee963a12d1b1601996c25f17a9f40bee619b1b027949f127028961ad07ee35863bab8a5a222c9c94fa3019773e20c3fc48dfacc9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e5b1bf36027b523e55da86fd16270336
SHA1 2cb0bdbe7c8d040f1f90cca9400bc5025a460aee
SHA256 30d86f52b3fc951ee8bef2318c42351af2dea627f687e047bcda8c753ea99e21
SHA512 00ae901f1e13c3fd53fcc9c7bdbcbe392cffccf6aa9aac5964fcc98dda8eaa2be3b881ab6116835796e5d8532d52f7c6bb7e122e37fa802f2fb870a4106a9721

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3d17cefdd72850950e73d53b5dbbc315
SHA1 b86635cc57b7e3a0fd5228e2322544eab53af2da
SHA256 44c7e33b5557d1851386e2876ac2b84e74fe5b67551e84d035ce97154e336a87
SHA512 cb4988ee993b898bcd9b328fad2b9b27f47cd72af28dcbabf7575a38d41493ff2a5856907a265ca093b821b1c16cb2aa9c074bd1fc0f38dbb02ddc5f3a5fb120

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3362cb49e0b9e4ac88bb84e9af14b94a
SHA1 4bc39548e07beddd249e80eb666f712b68d4a02e
SHA256 633ac08291252c584c03b9be05b54948c6e3359edbb98b3bd588277f45fcb8a6
SHA512 fd7eb03f55bf9689a901b89c0953bfbc9638fd32c423e49c7e78f4b8073fe325198fdb15beeb0f03c2a8dc2f8fa29796c4ab1608a55c5e28871bd2943ec51c49

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8743ea923cfa711aeedb5b0f5c7ad14e
SHA1 d30b8767939c083212b25913812f4aa779ca9e1d
SHA256 34ad9871153b63adedfb794071ca93a2a77a61558b0afb8544ff82b35fcdfb90
SHA512 4e242bf08697fc219c3ae66fc651a17bdf1f54b93f2935e589c40593ac635e6fdda8174ba89e92a706e8feb5a5d2caa7a33195df71478e9e5edf2d7864aad093

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5d4aa6f69bed7c3458665021f425102b
SHA1 ba8b524333e8046974c49f656ff26fda274323cd
SHA256 d6393357e55aa70dfa1618978184c784d2929cdfaeefb0978017d19f5e383729
SHA512 56a7a308f6cb42467e36504895f5e9eb2596667163d98031ec5031d4797503ca8bd9396dcce5151f10e869646f1ce6a379ba04bad51fd776c4aa0e33a1fa3581

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 038ef486360b058ff554c3bb41ac6d86
SHA1 cdf4a4c39bec842edd8abb657b5a2b5ff75ee62e
SHA256 3f925dbc3bf61c17060e1e0dd3b5c61ed96ce1c4c99879d464995bee8f743871
SHA512 e30344a20a0b66f46f6d6c064de87216e88eeda34850fa7e97a04196db26222f94ace8cd977eefe1939e49f5835824b7c60e5fbcb414081f81e82c03f7588aa3

C:\Users\Admin\Downloads\Unconfirmed 651784.crdownload

MD5 3470dad8219537a4b4d9f1ff73436893
SHA1 fc5ba88ce9719ad6ba6febbaab971801cd625933
SHA256 1f5cc5c2211c48f57acf7d4113a487fbbd74a423303102821c913139d7ff782a
SHA512 2cf931cf203650781ca27051cf58b61a26700cb492086ce04a8680a49126b63276c77241d5d3f31a8a948edf56e0accec57c78e620200d310af48fa076d33c94

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 295498b6cf743a23d22310913d060265
SHA1 49c989d19efcd189ab4fbef3fc63d4263a2eb038
SHA256 0aea261358d528cabdbf93bc251e10309fa3dddc9d275cfb95e52fb9eeb54e95
SHA512 a5dbb24d13d2bfac5ad90492ce397ddfdbea6f35a7ce7fa612eb8ca94934c8d1b65662fa71ba7e2b3534f6dadd4be1b1981babf02a34673ef90b5412989721e3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58fa59.TMP

MD5 3e4d6eff6b27400627317e1d8954895a
SHA1 a7884b8ce7969accf6d0c889e838b74bed62faee
SHA256 bf4f7187f96d2ff11e8da05c8c7455d88f9939e450127c2a724c1a3e8ec99b39
SHA512 9c9bde4116ea35047bb7a8482098effc72486ac7e914c53f4d02963df66f7676e8471e18bf19568cc3c08f9f2d8b42fc8b65bf587d0a6ad9d6bec7fd3cc51050

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0f6e1f09f3b96c7d32ada49c96c544c8
SHA1 53737a609a80b066a4a633adcf821a5e3ecfbe1b
SHA256 70c189d066a4aba42e1648d1a9ec339d5584c7c01c83631234fa0312bfdd7aa7
SHA512 7abeb72937db5caa0e707c45200b18892d48a7bc0ab57cd2e95c6f439049352cfd2429ae1a1dba53b3b39bdd0e806de7051e383a9b541d3a0f0157a6cb69b406

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3e3fbed502ab32d76b4e1d2673fd85e4
SHA1 51ebb8775c6fa059e64adb39fe62f99483a25169
SHA256 de665700db7614d76c873c89b5b0b23fd843e86ce1b8d3ef978270048a5c5b95
SHA512 d091889b541c6af9a8a284e0f0d9a6e427259509695178a5d9cf938f1500c39a012aebe578f938379acac04ea2a9698ba151e1b4df5adf4682ccb5d247cfffc5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2426baee092e11c44a11d668068fe85d
SHA1 00571e3a4778782496a35e518d9d06e5801fe866
SHA256 9f23bc29ed55d832548c97db0dae0ad4e2707517ca28456abddbb5e9b05b406d
SHA512 44818a1759e64ba946f173aebe58a3eb0132c47018f6fd947604a2b512230296686e2a34a6a625269a5f9ec6557be4ccdfefeeb98d4b0311ffe73f36ff597e37

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7956ca06cabb5b3bd93a7c9c370c3082
SHA1 bda58c69496b1970254af090afe594264dca1c3c
SHA256 ce09c5686ba814d19d35943cdee7d92694a81cdec95e72dfa973178f126fef5a
SHA512 46a6b3650bdc9aeb15c30809f52ae427bb2dad395caed35855ddd1219a1b2369e9d505bd58fb8f9f05a740058e47ffb6fe7020c8a629131f6b452ad1adc2bd80

C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll

MD5 7d5d3e2fcfa5ff53f5ae075ed4327b18
SHA1 3905104d8f7ba88b3b34f4997f3948b3183953f6
SHA256 e1fb95609f2757ce74cb531a5cf59674e411ea0a262b758371d7236c191910c4
SHA512 e67683331bb32ea4b2c38405be7f516db6935f883a1e4ae02a1700f5f36462c31b593e07c6fe06d8c0cb1c20c9f40a507c9eae245667c89f989e32765a89f589

memory/5436-1876-0x0000000005D90000-0x0000000005DA4000-memory.dmp

memory/5436-1877-0x00000000737C0000-0x00000000737D4000-memory.dmp

memory/5436-1878-0x0000000008AC0000-0x0000000009064000-memory.dmp

memory/5436-1879-0x00000000086B0000-0x0000000008742000-memory.dmp

memory/5436-1880-0x00000000095B0000-0x00000000095F4000-memory.dmp

memory/5436-1881-0x0000000009690000-0x000000000972C000-memory.dmp

memory/5436-1882-0x0000000009730000-0x0000000009796000-memory.dmp

memory/5436-1884-0x0000000009CD0000-0x000000000A1FC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ffe0fc0395aa043c09cab7b1a1bf6bad
SHA1 5efe32e86e27694bbb7360ff18a26706ddac27c1
SHA256 c0e93b868317f141ab7d416fecd5983c020334a94220b8851a01df6bc5c50324
SHA512 daaa829855a1bf585aca3c7b2e9cb1d56b6a5a7eec0b80e8d3bcdf12db81c3e3a43cfe43ad5e14b66bfc14717e5a39a24ca56ecdf0c558f1b78884ef1cc9a65c

memory/5436-1910-0x00000000060F0000-0x00000000060FA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1bfc8ee372866cbd2b537d072db7cc23
SHA1 1a8656545acf42cc5b28a680d646b55c3eda9681
SHA256 0a709cbd8a2ee749a9dc9d7e5774de401bbc298fc74bb08cb6a97a868d93e83b
SHA512 d76dc5cd74f064fb3edec335d8c01dd70ba63f813e22832cc9f668039b711b286ee5459536306c1ed7d41a0df9b1f74025542d7ac9eb7bcc25bc96a921f3ddb1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1b4caf80b17b97ce915382721383949f
SHA1 1db233bf99844dc9970c57fa2d02a8082e5c7fa5
SHA256 d9179d7873c44333d022bfb33c4f9ce17680be09224cadf724a8c8decf84f10f
SHA512 8c190f87aa830199ffd61b61f03aa42bb1376d0661bca158dac514b77195c6d53ef1019d97d699a7783326250a974b2e356396edda6074497c43b369dd90a4c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ad4ae4893a73b59dec4c1c4a3e8fe47b
SHA1 6046d9fc2e74e9f7010f57d0bbc0ce6f7c804a72
SHA256 c3b961b9356c7370f8532d096631e6072d28e2a379d271838613f9eb8d572209
SHA512 409d4a2009dd7a30219079bc37596da594b567d260dde7b05255fb1b1814580f534d92206506f8a2b572ac18108d71a0ab59d646bc5d3be901a01435cf210bc3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3647816f-1df9-4cb8-8109-66c886799f16.tmp

MD5 47e8f68fd6fb3bb14026fb8d6c050d0d
SHA1 500cd1877aaae3c69e187e39731bf5b59a0f43bc
SHA256 a6024d794a2e5d8c8c30a8a7454975cd00e9fa09075a406e004dbd63c7d8d488
SHA512 5fa4b8be7a2c1962ae8e224c9e78ec86cda2e68fe0607ed6e44bb62c79eda84a814adcb4313bd182e71e03bc19dea80c8c96756c77f620379192236667a0596d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2da4f953f29c193367f83e145d6fd1f2
SHA1 6898c5c43d0d594a535dc4727e1a4d4478784582
SHA256 5d371536fa4d5c1200719895e21818073c95a9dac6290fe73b760e3ef5130be2
SHA512 0122caf83aad5938e2da8ea63dc41c56ddc1bc251accefba2f729c08a5df83af509a876e33353c2ac97181b24ff18aa095948648f0174d1ac8faa2dd7d6627d2

C:\Windows\Logs\DISM\dism.log

MD5 34e573331ea884e04641d277fd7a9f82
SHA1 7c6499cece3b08c3ea39572a92d45d6c243cb287
SHA256 e730cc3ee0d04e6aec1689e07e3f0dc352e1630d87390bff35734ed8513febe0
SHA512 1ffc3be4b9e16bada3eda67ce7acebf4ef6796ec60cf59ae03bbf93cb98cc39ca54c323c36b2616b875ed332f6630c8560990a64fca7c9892ab3ae4f446165b8

memory/6624-2755-0x00000000020E0000-0x0000000002116000-memory.dmp

memory/6624-2756-0x0000000004D90000-0x00000000053B8000-memory.dmp

memory/6624-2758-0x0000000004BD0000-0x0000000004C36000-memory.dmp

memory/6624-2757-0x0000000004930000-0x0000000004952000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dlfvwnz3.jrp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/6624-2768-0x00000000053C0000-0x0000000005714000-memory.dmp

memory/6624-2769-0x0000000005A00000-0x0000000005A1E000-memory.dmp

memory/6624-2770-0x0000000005A20000-0x0000000005A6C000-memory.dmp

memory/6624-2772-0x000000006E3C0000-0x000000006E40C000-memory.dmp

memory/6624-2771-0x0000000005FD0000-0x0000000006002000-memory.dmp

memory/6624-2782-0x0000000006010000-0x000000000602E000-memory.dmp

memory/6624-2783-0x0000000006C30000-0x0000000006CD3000-memory.dmp

memory/6624-2784-0x0000000007370000-0x00000000079EA000-memory.dmp

memory/6624-2785-0x0000000006D20000-0x0000000006D3A000-memory.dmp

memory/6624-2786-0x0000000006D90000-0x0000000006D9A000-memory.dmp

memory/6624-2787-0x0000000006FA0000-0x0000000007036000-memory.dmp

memory/6624-2788-0x0000000006F20000-0x0000000006F31000-memory.dmp

memory/6624-2790-0x0000000006F60000-0x0000000006F6E000-memory.dmp

memory/6624-2791-0x0000000007040000-0x000000000705A000-memory.dmp

memory/3296-2794-0x00000000053A0000-0x00000000056F4000-memory.dmp

memory/3296-2804-0x000000006E3C0000-0x000000006E40C000-memory.dmp

memory/6952-2824-0x000000006E3C0000-0x000000006E40C000-memory.dmp

C:\LDPlayer\LDPlayer9\fonts\Roboto-Regular.otf

MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

C:\LDPlayer\LDPlayer9\fonts\NotoSans-Regular.otf

MD5 93b877811441a5ae311762a7cb6fb1e1
SHA1 339e033fd4fbb131c2d9b964354c68cd2cf18bd1
SHA256 b3899a2bb84ce5e0d61cc55c49df2d29ba90d301b71a84e8c648416ec96efc8b
SHA512 7f053cec61fbddae0184d858c3ef3e8bf298b4417d25b84ac1fc888c052eca252b24f7abfff7783442a1b80cc9fc2ce777dda323991cc4dc79039f4c17e21df4

C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll

MD5 0054560df6c69d2067689433172088ef
SHA1 a30042b77ebd7c704be0e986349030bcdb82857d
SHA256 72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750
SHA512 418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0

C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr120.dll

MD5 50097ec217ce0ebb9b4caa09cd2cd73a
SHA1 8cd3018c4170072464fbcd7cba563df1fc2b884c
SHA256 2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112
SHA512 ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll

MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6

C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp120.dll

MD5 50260b0f19aaa7e37c4082fecef8ff41
SHA1 ce672489b29baa7119881497ed5044b21ad8fe30
SHA256 891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9
SHA512 6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll

MD5 3e29914113ec4b968ba5eb1f6d194a0a
SHA1 557b67e372e85eb39989cb53cffd3ef1adabb9fe
SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
SHA512 75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43

C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll

MD5 e8fd6da54f056363b284608c3f6a832e
SHA1 32e88b82fd398568517ab03b33e9765b59c4946d
SHA256 b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd
SHA512 4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b

C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll

MD5 52c43baddd43be63fbfb398722f3b01d
SHA1 be1b1064fdda4dde4b72ef523b8e02c050ccd820
SHA256 8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f
SHA512 04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28

C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll

MD5 ba46e6e1c5861617b4d97de00149b905
SHA1 4affc8aab49c7dc3ceeca81391c4f737d7672b32
SHA256 2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e
SHA512 bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6

C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll

MD5 2d40f6c6a4f88c8c2685ee25b53ec00d
SHA1 faf96bac1e7665aa07029d8f94e1ac84014a863b
SHA256 1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334
SHA512 4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779

C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll

MD5 01c4246df55a5fff93d086bb56110d2b
SHA1 e2939375c4dd7b478913328b88eaa3c91913cfdc
SHA256 c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889
SHA512 39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196

C:\LDPlayer\LDPlayer9\ldmutiplayer\dnresource.rcc

MD5 70058f2d60daef1ccc7bbcba210f0ace
SHA1 ef214ade419a724272ac82e9de5233d7c0afa64b
SHA256 43b26f40e04ae6854569a01803541245abffcd130f1345191afd8bf6b0ca7873
SHA512 a0b3ca59ffad882fbff69012023eaa8aadb77d3ff1252562e5480e7dc3c9336afb3c5f58fb435246ec48c758d3c9d17ae9ea8a28f9d4766fad1a4c672cbf9b9a

C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll

MD5 66df6f7b7a98ff750aade522c22d239a
SHA1 f69464fe18ed03de597bb46482ae899f43c94617
SHA256 91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f
SHA512 48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e

C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe

MD5 ad9d7cbdb4b19fb65960d69126e3ff68
SHA1 dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d
SHA256 a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326
SHA512 f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7

C:\LDPlayer\LDPlayer9\dnmultiplayer.exe

MD5 f96c25bb4feee47fe4111660fa0706b3
SHA1 284126ce4f80b6bfd6037f6137dee90c941e4eec
SHA256 9b5d44c60b18b36bcc1cc0e28585ae168d92239beda197d739c3e64edb229867
SHA512 b4297728f031863ccfb50de52d18f443d6ae893322e2f6b315497e187329275fbf41828867e614b35e9ff60ac6e3e1ae77d876fa8e131336c2d6a1fb6ff7db36

C:\LDPlayer\LDPlayer9\dnplayer.exe

MD5 a723044f1c511790dd0ee3a3fa68c4cf
SHA1 670e6f907c2557c9685ad26c26d6d8fee5139942
SHA256 861be3e240b075752d52c7b50c41bf22eab9314db4f11a20362c648198a0f2e4
SHA512 0fa7da71864d1abdff83d3aa01597f5902c01899513b0333bcc5d756a15be02b8c5293b55c1d88e556010f53412a7dbd27b57b63b1074565f1f6de8e2952377c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e65f58e0882cac7d0fdc06d8d756acaf
SHA1 29a2c12a32407423d4cbbb7ff06f3a3717bce82f
SHA256 3fd3b9ea21a3eb3dc281310ef420c4590f87938ee028c655279de60aab3f0826
SHA512 053bd2def2a51fbe7830a1b265a33e938a334462b99af671536192050e9187a5ff7345dd33dac7c8f5ae08f289545c63052c7f42d50410c7935c507b3d140de5

C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll

MD5 6de0ef4a83aadebe5d7e07a64fc9d220
SHA1 f2162f30992ced0b882bfced0477ebf62b7ce186
SHA256 b7c4de833b0e2689724414802fbdda35d7cc1c4529eb95282fd0ffd175119008
SHA512 eebe007e0ece66c08138720bb46864470826a6b49a8edb1fd1593c4efade4bbf32c764d205383ef4745a738a1242f92e4c396abeb56e6ff9e785977ce8f646da

memory/4872-2973-0x00000000368C0000-0x00000000368D0000-memory.dmp

C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk

MD5 4d592fd525e977bf3d832cdb1482faa0
SHA1 131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef
SHA256 f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6
SHA512 afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77

memory/4872-3055-0x000000006C810000-0x000000006C88E000-memory.dmp

memory/4872-3056-0x000000006C790000-0x000000006C80A000-memory.dmp

memory/4872-3058-0x000000006C730000-0x000000006C789000-memory.dmp

memory/4872-3057-0x000000006E290000-0x000000006E836000-memory.dmp

memory/4872-3059-0x000000006C890000-0x000000006E28B000-memory.dmp

memory/4872-3070-0x000000006C730000-0x000000006C789000-memory.dmp

memory/4872-3069-0x000000006E290000-0x000000006E836000-memory.dmp

memory/4872-3068-0x000000006C790000-0x000000006C80A000-memory.dmp

memory/4872-3067-0x000000006C810000-0x000000006C88E000-memory.dmp

memory/4872-3071-0x000000006C890000-0x000000006E28B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0637f70e8da59bfe7c1f356b4b6b098d
SHA1 f24e906a653548dc8cad45549dcb7229d4218eac
SHA256 2a1dd85f1ba4b6f8f0b6bb1f125d12bf60627711b307bd45cd25d3f26e8e4f1d
SHA512 5207960821033271387c1cf1a59d4fc411a86ea37469f283981dda2d4058c34e023dd42e3926d93bf4dddb86aad088d615ac514c34ccee183c8222c71582b2a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

MD5 05e9679509b61424a07cc4d4efb7247f
SHA1 db4fcfac1d89c7e4f0bdbea9023034b64a9dbd81
SHA256 31798b2630a882be758010dfa51b12026c8fd81f0e4068b38fd739cac78cba0b
SHA512 1cbe7343e19b41f3f116a93d598d7b67779d29c6bc0a7b086d112dfcc76fee60811290b67b5d2561751700be483f6cd460b9b4c8325397813314ba064e4c2208

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

MD5 9a8ceef2725801e17be5c55b0a7b6887
SHA1 567f8cc2c9704f0f9186e50bb7ed9582bc3ac924
SHA256 c34f0544214631ecebb3d75ea3e9876f8096703b293266fdcb6426952fc98027
SHA512 57c534210f5905ae7d74e3adb6c39ad3d387797786b9a9b8def51508f83b83e97dbca9a48dd0bf38dadb6ea81dc5769d704c8ad58471baf727866eb06c2c4dcd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9b78fd04247d4913cd4b0caf7b48f956
SHA1 4896e8ddb86c2a8fb21ea3780baaf4b6d4a4b867
SHA256 dd082889b18beca3a07378f2b1b099bcf391a225a931f4410a679a9a2fc427ac
SHA512 ef8f8eeddd2125cb4a6cda3eb99bdcb9c7d8ebff4840b0236d81dabb22ed5fc270ebb0cd61f7eea11a05b8e2b2d04eba94d12ff4acbe33551803fcbf16bb2020

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9e895d9374296ad2637416e231164ce0
SHA1 922788f96c6939fd4913a54763b1016e8994583c
SHA256 da6943cd1432174d9a9a9aa8b8a3aba10bc4fa2051aa6ad62efb764aa4d4fd7c
SHA512 f40f0987e1a1f0c1cec91faa727c25d9b4913fed695b6e73e2ec07a05d6ab866ea17bed3c06166269489f149ae5200d41e704a6805b04d26d22bb1cd9bea6fa2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 28af25815191a289ca4b9a912f35e831
SHA1 d71eb6ba7195496f1a20b11c5964cc52de9cdcfd
SHA256 cfab23a8815ebec23e4a30c1d20802df6aea3a84c1ed651b672b00cc8a5250a3
SHA512 17888d6910f85d8de668d2e66f7d657e2cccc3afe18d66231077dac7c378541982dbac684694c9c16369bc682149b5b714c9f39097f50d780c5a152cc3b6a252

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 5a0b77f3f7de9eb238632da8eedcd199
SHA1 68877e21939502f85ae2e5ff1d2cc2a1727b5b2f
SHA256 4aaa2cb2065630d3b2cd85ca307e1380ad59d02e2af085bee1b5e21f2a9f803e
SHA512 fa59747f105cad32ec1863e096f83aaf7704bd1833526f676f9b84de44061d10ea5881bb0a524333c98c4e4405e6d971a21428a89a1ca241d0273161fb4f7aa7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 988ce8a974e8ce9dc7bcbb2b660a7cfd
SHA1 e0ed00a22549472696e5b50ba9c17d69d697ceac
SHA256 d419dcef3ee4994d3b704cf04b04c70e2a1be7582cce155185701a57a2674d51
SHA512 69c7b7871079af31436b8e24801d8eee9ba5eb55917692bf42591a441c201eecd888f12140328d5d171fa592b07023039871b7aa6fc811677745b36c0eac8f39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 932717bfefab688f9004aa43434c6001
SHA1 4c6357d709e4cc7155ec04d0d1e9f02c77abb60c
SHA256 f321a786511652b04c93718b6c1717f4ade610d11a8b5d3d171fbd2c6fb00e42
SHA512 8bc47acca65325c400f7a1c364db8ec02c089a4a5d37201c32e65483434b80ff4901ac8f26f972acbb62555905078877fb63e082cfd17008e6eb1951a6a5c87b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 088577afd8d611ccca4b6fe4184232a8
SHA1 d4acec90541210166eff00e439b7347b15de841d
SHA256 537c8ab5bc7c7c120fe8fcaaa1ede5b5911565c171f3b72e58844be4108e8f8a
SHA512 1cf58c07c781b2bf60b6af01520f6a2b53495cc31d17d176ca4b910a25af39c667da566be449c52b92abb2eda9a58655f16f5f34c9417bd489dad803b3abc07d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0d4a02849f4d5f0822a07124d6e91d19
SHA1 6f25b3dac108b92f569e3ff90f4176c65a563e76
SHA256 5d491b965d5f26d57f18001e93fb80e52ba39e5c6c81ab012a1bdfe174491456
SHA512 05ff3c4f4af720fd8d7b1d8d0331790cc9b529f5a38799bd99844c34667a90d063df06c06e5f4925d31137b288e8f944a5793737a40f4b125a8da1c3aeed884e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a0cfa4a9caa07c4b2c33437600a3a482
SHA1 9f925fd90de60f09809270868d3274858283ac53
SHA256 b2076ba6d03b13c521910678642263857e7a0d65af4fe465d9747aa67d5838fe
SHA512 1e38f4eae12f426f2f7d9f1a27d8ad412b2315183a2b0eaa8745a690d0e6e4b3199c95501f18cb6ea71d4d3018b71e8f6aff0aa5b1fcf7a4f78f127faa0a0af9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 31618bc0a35e5ee6c8acbefa3e50f3da
SHA1 605cc028302ad502886f1c5ed9a47174f168e36e
SHA256 f1cc13dffd575fcc3a4c2ca0737edd228f1cbdf37fcdb798fdffbc01714b063b
SHA512 3468529432ae4ee652bb26539e6807fcdca84ea5b08faed8660de64b586d4beb2e3c6e5645f0b081e62925713d88d093d70c908020da60c2cd7047c3fbe1cedb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ca8ddb1da1dbb55e4db520166f916723
SHA1 dd4ee27153d4de9d12693228f8fb48c3250cbb3b
SHA256 f4f17f5959092f10903d6ccd19276fa51840c934cb80a7473379fe8c10ff4d49
SHA512 c34ef8109f29651ee29df857a68c40406b12a3dc9e288a4d7d33fb5f45fbf133f92003e41861e05ab931b9db9d9d2b5b54d4670af20b6cf3dd244f556812922f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3803a8acff43cfe79f2321bba15ea967
SHA1 537ac17dfaa9e313bb2a79f027056db3dddd0d51
SHA256 5f54eb5c58647b8ea3fe095b2682bb3ee5fc63f1499689658921ccd1b06613f5
SHA512 9a57eae69cb6d7f1b03ae23a75675d1c654d6a9e229e094bf2aa3289ed92bf0fe1eb87e150735c8d318e028338b834affec6fe08ea55a17de5125e7cccf43fed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3282c270da77f8d781fcdeba7aa1748b
SHA1 07ab794a9a372ac13068cb2f471291608ce30de9
SHA256 3c9822be47da4a1d82e514c680baf1a541536ec75b2010a0595ad0746b1ea859
SHA512 9917242e97b9c8d192c5472e4e53d9a214037d6af08e6446eea8ab01dad21a0b12f1d8eca41231175d1e90622454f9b9a10d63533812aa04ce09c4de22e267d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 dcde797d7a91c21f45adf30a6c333430
SHA1 217bbad46ec0cdfe5afc749c887471c917427f4d
SHA256 3034a1a0ff5138b8a5d6d08481a4ec94372fd992486d58d09665ecfaed4c87bc
SHA512 c4bfda265bb6b3c9bee824e8d392364ae3fd7895f7dc8d6ef795fdc057521178d75c7151b138c6167c677ba77271eb61a36938104bfb0cdcd99c60f19f44ef87

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 bc47f90429f6577403eb29865f1329dd
SHA1 6d6e4f3113c0b89d01f473e190d55fbd1c8f9e3c
SHA256 9fe14cef0543be9d1b2f33c7dbca38c7bca2689dec0e24b28fdff359e0ffe2ef
SHA512 71b0bc5ff567bd91e8c2d0eba211ce0137ed60943f18b31d7bbe0f0dd890457ec9d793d2cd80a5febc07fb97e5d99a57bef7aa919e56a1434171ebd7939532cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b941ec5faa8edf7399b66128835d2e59
SHA1 14e6c459036cfda8c54f084fd3b7a3ab0fba8d44
SHA256 08adeaf3452fedf5c7e5bd5a8187c10685be7a94973141cc3f05ce028a7884fc
SHA512 dd41f2b7ad5cc7aa53540f5a2aeeb09dbccb13dccf04d296a0d1e5058f8e336981f242e25b5554a4d11d9e90ce13401724cc997203c1da1020bbe66306d2e785

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 71c5e8397a0f9add33dfadc1b22c53c2
SHA1 fcd920b6d6c8928260135f2c5cc004c877c8421f
SHA256 bedebfa9379fb2fbff48de94522be1621e16deb66b9d9eb0d1a55ad9ade1a766
SHA512 bfd135e12deb302cf0b86f7b6346ff8df6586b85022cf1ba949c07f9487e96d0295a255a6d5e9bb6ca341ae84d385d21f3ceb2744c159ebea546ce6b64fa5a1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a6b295dcbdedb96e95ba215d5782bff3
SHA1 884224cb3fb0f8ecad8147ade2503b9e1cd419c1
SHA256 0b7746e34b5d50976fc0eb335f9edba2d2cd56a56b7b06f74a9b9dd645691b7c
SHA512 e1a3a816fc03450d57203ba94d3c748ba7152417b006790f342bb89e674c4ac63bdcb8615c5c301d83644e02f8f338539fd081715cbf9454a266c49cfc239316

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6e877dc04b7c08219a5e089cad231254
SHA1 501eb1b3fa1c732fdda766e68c947a8e22d6351f
SHA256 b2b0ee91318f3ef7d9ab35ae8e4ab3f22b0cdc9d8ff412b184230ab3553abd04
SHA512 5348931384b580137d41456035f07f9c105b8cef50637b25d8723ba8438a25ca649d96eb5be843622f616fc28271eaad0a79c8d6dbfe56dae7fec2c84402f4b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b277a51ae9a9ebfb_0

MD5 7e63c67d2b100235e0fb90ce1da1fd1d
SHA1 b9a3983b93d58747f748570e50f1ae21b0107bd6
SHA256 804659f2e758f25a490815db1eaca47516d8a4737316122912cb74660ef77080
SHA512 c3d12e38677c7eb9996e0a01189f09857fb15412f84c1999e6d15cad87c7fbdd2704a18eab0e7e50a09890817fae2fdb0a486b29bd38f203c25b36c5b73f4ecd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\49ef3da0ba7b96f8_0

MD5 a88c160163f4689fbd31efb54058dbd6
SHA1 d727cf846cc218727d0dc5c95bba15b431e0547d
SHA256 89d56e87f75181b6549b0aedca7c972cc66d93b7f540c7712499029b12bb2cad
SHA512 61a59468c8e421d7746621e5e0e11fce2344d586bd7716b4edebfaca594e8a4170f96235c8a612517f40294ff74aa9997683a0ec98d324d99b29315f308cc3ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8ff845fa94be4f19b969c52333849118
SHA1 2372f83b3b594759af7fba49799fed0c28d69614
SHA256 7cf1dc74e49e8d5677fece24e5243924fea43a94c4cbf3cb7d80cba5ceaa1aa4
SHA512 16c8fa8586dc13f99647826abb973c20631b64a2e1870abe425d588d64d7404337325d062c4b442221d5672fa6781c62a2b3a795f6ac460b771a3b67fe752037

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 c0fa1dff9501ffaea0632f5418d05414
SHA1 36e6471844f5824f7311f661dcf6a47a0974ff24
SHA256 3b7acaff3738ad00964d19f91c13c9e7614b6f784227dc5dd135533a86357ca4
SHA512 22719590b38969920e0c5577078f0b78521ddd16d2c790039dc34067572d1dc0cf306d1133425dc7b882a5f2fae71779eb79b34364c295ac9c9ceac52f28917e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 40a481102d9288eb638299ce714258ff
SHA1 c290970e73966180b6725c23f8a058ad9100cd19
SHA256 8ea1cc81306689a1d8140b6a726d9e5674d03b5ee02f49b8a071f4440904800c
SHA512 5dba77150b606d25c0594194fe1f5d6c1c8fd1549239f0b5976bb47cef6a46a3866784080177c4bc5d9a71ebc2c2a4471d1d78fe703e6cd051baefc001f90b6c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7024850b029f74c6e7ecd5709f241a40
SHA1 baf99579ee1f3d58dbff4c164ad807be84af197b
SHA256 3849d048ac0c2b679d6526bf76bd42ed214dda18f551fff2da2eb410a3270a9a
SHA512 69bee5e83746f1b0f0641506b791ea1b679a3e6836860ffbc3edf1ce114a0a2ba6e43afc55d6673c2b309f23e409d0b15eba1db189bfe91335e4909f86d162ee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 261453fe7444dc980f65b6f7de0d3de3
SHA1 9f1668474b70d5a2fef4fbb6e18b13c612f7ab54
SHA256 97a9a1d0cb8cf1d7eae1db0b21f5c4dab4383a6306f289c89e0e05474eea26a2
SHA512 88ce919ab3f79c3fb76f5ba2fbc84d49fcef60fb63209203b487cd765f8bfff42a89b59b1f44267ca1f5dc8cfbcd1c97432f23e4ad7b095805b017ef8665a39d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f5812a532c35a6c466a5373a7acfaadf
SHA1 f01d0e212177deb9dd04f7115ef47294ac16e627
SHA256 a7ad42dfe8d752e1ed8a03dcce83a3bdc21569b0b94cca4477fd634659879e36
SHA512 e7c7d58d197815680a07381bbe26d0ec495cba8b9298f97349038d653ba46d55bad9365e0cbf08947250e0987747bd2e7ef5cee4545dfa725832348a0fe4616e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 50de3a7ab51e2515e315fb67a53e094d
SHA1 0491290770df76b3c8c688dcc61936f97b1647b7
SHA256 f4fde64ceb76eb175019875d2c63b8d67ebfc5faf928906a3fae04336b7a88e3
SHA512 dacabaf43039e50914dbf5996f33054fd63d29b7721418d8aa60a25119320842c81ef8edc19d89014c269cd88821113b9bcb36f61e3b050cd32d4084f04d80c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 599961e9fc17c442461e2a8b133dabac
SHA1 4c8502a864e5ddbb79b89516c9700f6854219d13
SHA256 7535b4a765664140df65645f1491c56d8a069d334750272074f6e2f710833353
SHA512 e971c962ef16e8e3b737794dda84782313215f6116fd388d8b549f7f24a21c3c2dae56ee1591c1d786076bc3aa44d3fc1c87a0195738a1ed03585af6db049008

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 681b269a0fed338df0712bb528497a3a
SHA1 59ee2f6e97535d956e902a2646313a3c29e9aaad
SHA256 8bb8c7457cbee04af64edca42f979e945f24adc6de1ed7bc938c0e087f6e9a84
SHA512 51b943812f880404aa51bcde705b502c1cc774d8d6535955bfe4981c533fd1bbadfc7af128e75b426c44e5e9b6b7f36e45126d49fd79be867ba9eb83fc88ab2e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 dd31d9a99dc38f897c512fe9dcdce72a
SHA1 f59ecc2f09ef59942dbc349f11cbbf02b6d52380
SHA256 a95785ab3279481912a3c1619cc5fbfefde90dc9d578b2354d7deb8f9ccca755
SHA512 3e4bef42aba9bf2a11371664da681bb7aca3e72c78b841b23762eb610cf5c573b4396c2d2fb402ac4be80a15bfb6281157ab4766a8ed36be6ba9e629305732d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d2d4c97deebe553d146d861904dd6c06
SHA1 35c6092a5b83bbc54ca53b5326b5b2ce9802acd3
SHA256 1235c39c8f98c1c48e9a8dffa5058cca948a0cb8774b88d81421c239bc0d5d69
SHA512 ef6739428d11fb25de79e923784969b9679f2f3477fac87f53ba8619adb4eef4c50d2fd9abdd256ee30ffff8771baf44e42ee87bf782550044abefd41d5290c5