Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 21:25

General

  • Target

    LDPlayer9_es_1009_ld.exe

  • Size

    3.4MB

  • MD5

    9f9bbd12ae5894046810e6736ec4d892

  • SHA1

    9e81b764a40ec39f6667c54b8d40da0b97cb5a7f

  • SHA256

    8d48d0a05d581922a4d30ba98cbf51ea981a37c95fad689e0b84b979e312f6a4

  • SHA512

    57d5b59de422394856e15b2d65c1f2a9e85a1b012c954ecad98682a84c7f90ff00be91819c8ae9cd123270e2cf446d69bfb248bde471a29846d57bf401417eaa

  • SSDEEP

    49152:p2XX9nMhH9mpVLZ0CSf1pHtOUYqP3CFOrtG/JR9sXafgkDFMVR9C1UhPJXMK701K:p2XX96HMpVLZo1t0xOoGBiCV2Hmd

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
  • Manipulates Digital Signatures 1 TTPs 64 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Possible privilege escalation attempt 6 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 15 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe
    "C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM dnplayer.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1788
    • C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM dnmultiplayer.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3500
    • C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM dnmultiplayerex.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3628
    • C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM bugreport.exe /T
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2144
    • C:\LDPlayer\LDPlayer9\LDPlayer.exe
      "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=1009 -language=es -path="C:\LDPlayer\LDPlayer9\"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\LDPlayer\LDPlayer9\dnrepairer.exe
        "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=852060
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\SysWOW64\net.exe
          "net" start cryptsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start cryptsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:728
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Softpub.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:3904
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Wintrust.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:4656
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Initpki.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4960
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32" Initpki.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1260
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" dssenh.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4040
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" rsaenh.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4084
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" cryptdlg.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:3400
        • C:\Windows\SysWOW64\takeown.exe
          "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:3456
        • C:\Windows\SysWOW64\icacls.exe
          "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:4852
        • C:\Windows\SysWOW64\takeown.exe
          "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2184
        • C:\Windows\SysWOW64\icacls.exe
          "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:3832
        • C:\Windows\SysWOW64\dism.exe
          C:\Windows\system32\dism.exe /Online /English /Get-Features
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3368
          • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\dismhost.exe
            C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\dismhost.exe {6DBF401C-C5F4-418D-9830-CF6FF250A1CD}
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2740
        • C:\Windows\SysWOW64\sc.exe
          sc query HvHost
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1920
        • C:\Windows\SysWOW64\sc.exe
          sc query vmms
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1056
        • C:\Windows\SysWOW64\sc.exe
          sc query vmcompute
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1360
        • C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
          "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4664
        • C:\Windows\SYSTEM32\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
          4⤵
          • Loads dropped DLL
          PID:1128
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5032
        • C:\Windows\SYSTEM32\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4404
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1708
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4488
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc" start Ld9BoxSup
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3224
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2752
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2536
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1888
      • C:\LDPlayer\LDPlayer9\driverconfig.exe
        "C:\LDPlayer\LDPlayer9\driverconfig.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3880
      • C:\Windows\SysWOW64\takeown.exe
        "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:3476
      • C:\Windows\SysWOW64\icacls.exe
        "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:5076
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/ykt8hgSabz
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4944
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fa8446f8,0x7ff8fa844708,0x7ff8fa844718
        3⤵
          PID:4088
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
          3⤵
            PID:516
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4540
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
            3⤵
              PID:4652
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
              3⤵
                PID:4976
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                3⤵
                  PID:4400
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                  3⤵
                    PID:4460
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5264 /prefetch:8
                    3⤵
                      PID:1180
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5276 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3644
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
                      3⤵
                        PID:5660
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2418446156466670257,7812667933456391613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5772
                    • C:\LDPlayer\LDPlayer9\dnplayer.exe
                      "C:\LDPlayer\LDPlayer9\\dnplayer.exe"
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      • Modifies Internet Explorer settings
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:5064
                      • C:\Windows\SysWOW64\sc.exe
                        sc query HvHost
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:3012
                      • C:\Windows\SysWOW64\sc.exe
                        sc query vmms
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4448
                      • C:\Windows\SysWOW64\sc.exe
                        sc query vmcompute
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:2556
                      • C:\Program Files\ldplayer9box\vbox-img.exe
                        "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
                        3⤵
                        • Executes dropped EXE
                        PID:4772
                      • C:\Program Files\ldplayer9box\vbox-img.exe
                        "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
                        3⤵
                        • Executes dropped EXE
                        PID:2328
                      • C:\Program Files\ldplayer9box\vbox-img.exe
                        "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
                        3⤵
                        • Executes dropped EXE
                        PID:4548
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://es.ldplayer.net/blog/94.html
                        3⤵
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:5484
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fa8446f8,0x7ff8fa844708,0x7ff8fa844718
                          4⤵
                            PID:5508
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,2896977339305386840,17401177527601784906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
                            4⤵
                              PID:5740
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,2896977339305386840,17401177527601784906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5660
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,2896977339305386840,17401177527601784906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
                              4⤵
                                PID:5868
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,2896977339305386840,17401177527601784906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
                                4⤵
                                  PID:6024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,2896977339305386840,17401177527601784906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                                  4⤵
                                    PID:6008
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,2896977339305386840,17401177527601784906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
                                    4⤵
                                      PID:3424
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,2896977339305386840,17401177527601784906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                                      4⤵
                                        PID:2384
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x4f4 0x3e4
                                  1⤵
                                    PID:3964
                                  • C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
                                    "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
                                    1⤵
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    PID:3456
                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                      2⤵
                                      • Executes dropped EXE
                                      PID:4788
                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1312
                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                      2⤵
                                      • Executes dropped EXE
                                      PID:3460
                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                      2⤵
                                      • Executes dropped EXE
                                      PID:2752
                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                      2⤵
                                      • Executes dropped EXE
                                      PID:2328
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        3⤵
                                          PID:4788
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4644
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:1880
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:4684
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:4440
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:2900

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\LDPlayer\LDPlayer9\MSVCR120.dll

                                                Filesize

                                                947KB

                                                MD5

                                                50097ec217ce0ebb9b4caa09cd2cd73a

                                                SHA1

                                                8cd3018c4170072464fbcd7cba563df1fc2b884c

                                                SHA256

                                                2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112

                                                SHA512

                                                ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

                                              • C:\LDPlayer\LDPlayer9\crashreport.dll

                                                Filesize

                                                51KB

                                                MD5

                                                6fcb827fe4a5ae344eae27b53d368903

                                                SHA1

                                                719c435846d0860c3c2baf27055a6d114890a8ab

                                                SHA256

                                                bc67354096d13b85a1a13eeb7a2ad899bb35b003519756d28f145e3c040f7804

                                                SHA512

                                                9659a187bccd6fa736fd187abcf57eeeb8b1323d8cc269bb9793978243abbdf830085d6e1df5da7876710ddb5cab20c79d2f53ef4acf6f4826504944fdd5e9cc

                                              • C:\LDPlayer\LDPlayer9\dnmultiplayer.exe

                                                Filesize

                                                1.3MB

                                                MD5

                                                77138e2662cdeffd61cf6210ae3fb8ca

                                                SHA1

                                                a085b99630efc74cedd0be9a0eeb57eff7b3850f

                                                SHA256

                                                68c83685da55573ae966db3113ee513dd76ba489024373968e527bd44d814724

                                                SHA512

                                                a4621910aa3ae4b5dfa558e69d0270717341467cf067d9397e2bbf118f789c87eef8750ecb25ffd9c60f51f35ceb40b211ce9a738116c4dfc06e543ac90d1bcc

                                              • C:\LDPlayer\LDPlayer9\dnplayer.exe

                                                Filesize

                                                3.6MB

                                                MD5

                                                6fe5ee1daf303963482ffc414b1f4aed

                                                SHA1

                                                076ebaeeb02853d96e20085fbedaf7e61f3a60d3

                                                SHA256

                                                2685e5c1aa3cdead02024f21abadb413c6dc130946f7b44ca01b0cea64bdd2ae

                                                SHA512

                                                8bc6758c95a53ebcd6b6fd27bdd3165f91bcd8f370d677afb7d599865b57ecad274eb21502235eeb64ad2624046cafa9f14576221b1503e333815df5a6dfe134

                                              • C:\LDPlayer\LDPlayer9\dnrepairer.exe

                                                Filesize

                                                41.9MB

                                                MD5

                                                8c32366769719275a9e4d9916d0fb3fb

                                                SHA1

                                                56123f2303dbb13f583ef1ff689d5ca26e53ba12

                                                SHA256

                                                2a8774e1bf13aa2116c647953dc5e712deca53caa6d5de04f92548c0acd7bee5

                                                SHA512

                                                4d69b154c572da5ea185ae147855d542744bf2aff0024a88f51f1c73c57724eb9f50277476ccbaaf585e1291b5c019154877e7289880e32fd9d20f1d8c851eab

                                              • C:\LDPlayer\LDPlayer9\dnresource.rcc

                                                Filesize

                                                5.6MB

                                                MD5

                                                65eeb6cb2049e4df3a1db20f15db52ab

                                                SHA1

                                                10182b8c8e95079b105bbe66247fd0e8e97d4eea

                                                SHA256

                                                68fe01a6df81242470ceb107f630a5be3281524ec8ea6aa2182b3847271ab053

                                                SHA512

                                                38ddc0fe70b3f5051a8b2dc02c8dc4be695e9f0ac31654f42c1579b5df93c9708db09e6966fa61e528035c0d47bf09e4e4be38b670670948f8c65f3dc8ab18df

                                              • C:\LDPlayer\LDPlayer9\fonts\Roboto-Regular.otf

                                                Filesize

                                                103KB

                                                MD5

                                                4acd5f0e312730f1d8b8805f3699c184

                                                SHA1

                                                67c957e102bf2b2a86c5708257bc32f91c006739

                                                SHA256

                                                72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5

                                                SHA512

                                                9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe

                                                Filesize

                                                652KB

                                                MD5

                                                ad9d7cbdb4b19fb65960d69126e3ff68

                                                SHA1

                                                dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d

                                                SHA256

                                                a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326

                                                SHA512

                                                f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll

                                                Filesize

                                                1.5MB

                                                MD5

                                                66df6f7b7a98ff750aade522c22d239a

                                                SHA1

                                                f69464fe18ed03de597bb46482ae899f43c94617

                                                SHA256

                                                91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f

                                                SHA512

                                                48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll

                                                Filesize

                                                2.0MB

                                                MD5

                                                01c4246df55a5fff93d086bb56110d2b

                                                SHA1

                                                e2939375c4dd7b478913328b88eaa3c91913cfdc

                                                SHA256

                                                c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889

                                                SHA512

                                                39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll

                                                Filesize

                                                442KB

                                                MD5

                                                2d40f6c6a4f88c8c2685ee25b53ec00d

                                                SHA1

                                                faf96bac1e7665aa07029d8f94e1ac84014a863b

                                                SHA256

                                                1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334

                                                SHA512

                                                4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll

                                                Filesize

                                                1.2MB

                                                MD5

                                                ba46e6e1c5861617b4d97de00149b905

                                                SHA1

                                                4affc8aab49c7dc3ceeca81391c4f737d7672b32

                                                SHA256

                                                2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e

                                                SHA512

                                                bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll

                                                Filesize

                                                192KB

                                                MD5

                                                52c43baddd43be63fbfb398722f3b01d

                                                SHA1

                                                be1b1064fdda4dde4b72ef523b8e02c050ccd820

                                                SHA256

                                                8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f

                                                SHA512

                                                04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll

                                                Filesize

                                                511KB

                                                MD5

                                                e8fd6da54f056363b284608c3f6a832e

                                                SHA1

                                                32e88b82fd398568517ab03b33e9765b59c4946d

                                                SHA256

                                                b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd

                                                SHA512

                                                4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll

                                                Filesize

                                                522KB

                                                MD5

                                                3e29914113ec4b968ba5eb1f6d194a0a

                                                SHA1

                                                557b67e372e85eb39989cb53cffd3ef1adabb9fe

                                                SHA256

                                                c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a

                                                SHA512

                                                75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll

                                                Filesize

                                                854KB

                                                MD5

                                                4ba25d2cbe1587a841dcfb8c8c4a6ea6

                                                SHA1

                                                52693d4b5e0b55a929099b680348c3932f2c3c62

                                                SHA256

                                                b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49

                                                SHA512

                                                82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6

                                              • C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll

                                                Filesize

                                                283KB

                                                MD5

                                                0054560df6c69d2067689433172088ef

                                                SHA1

                                                a30042b77ebd7c704be0e986349030bcdb82857d

                                                SHA256

                                                72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750

                                                SHA512

                                                418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0

                                              • C:\LDPlayer\LDPlayer9\msvcp120.dll

                                                Filesize

                                                444KB

                                                MD5

                                                50260b0f19aaa7e37c4082fecef8ff41

                                                SHA1

                                                ce672489b29baa7119881497ed5044b21ad8fe30

                                                SHA256

                                                891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9

                                                SHA512

                                                6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

                                              • C:\LDPlayer\LDPlayer9\phones.data

                                                Filesize

                                                5KB

                                                MD5

                                                fdee6e3ccf8b61db774884ccb810c66f

                                                SHA1

                                                7a6b13a61cd3ad252387d110d9c25ced9897994d

                                                SHA256

                                                657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4

                                                SHA512

                                                f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512

                                              • C:\LDPlayer\LDPlayer9\vms\config\leidian0.config

                                                Filesize

                                                641B

                                                MD5

                                                0e571cda476abd2d6fad231a950982a7

                                                SHA1

                                                1f39dc9c3d34a0c9e8f71adacaccf8e7c890a546

                                                SHA256

                                                2fdd3dbd3f7379d832109cd48a64ade3ce510ff2a2c6272596735ddbfdc2feac

                                                SHA512

                                                1e6af93c0981f218320e1025b7cc69344c4544fd0034f5f18aa22578375fdd7b5b04e38eb86084dbe9a960fc146ed6976f8e2cafe02629b75664cbbaf39c2404

                                              • C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk

                                                Filesize

                                                35.1MB

                                                MD5

                                                4d592fd525e977bf3d832cdb1482faa0

                                                SHA1

                                                131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef

                                                SHA256

                                                f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6

                                                SHA512

                                                afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                                Filesize

                                                2KB

                                                MD5

                                                ad28038aabd2c8af255768e4c6c948a2

                                                SHA1

                                                d73a91e8385088a09229eea62c0c41ad67564bac

                                                SHA256

                                                6b2f4e3a74b1ba9afb6664a6099daef9a9e05d9a84766d4e3d92372f0553abd3

                                                SHA512

                                                b403f220d0cff7eb460c53684cbd30c81b8256ff47bd76362c6d9751958a01b6c9ceae98dfdb2549efb51a04dbd772ec589ffb125285c23e1fc2736de4b7a2a9

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                                Filesize

                                                1KB

                                                MD5

                                                31f848033973a6fb31a433839afa82ed

                                                SHA1

                                                cf1e33ed4e67a1342de66da78243782c464feb02

                                                SHA256

                                                1008c8e803b4b544f61a91d02b030cd9196531b9857834bd1ac04d5b748f75d3

                                                SHA512

                                                2a8df0e321c790931148b282c79e32ce77ba32446dc2ff92ffe842167be799a2b8baab4691e87ab79f552c65e43778d25ee67f5abe8c55696cffb91d95c948b6

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                                Filesize

                                                458B

                                                MD5

                                                a7eae3bbde273c212488bee450daf96f

                                                SHA1

                                                b65290bf884837a97c3e69e10a68f2c0d68bfe8a

                                                SHA256

                                                d225f273e07133a3c75e3a3b270142e2ecda65e892c42a81d4c768f7285331b3

                                                SHA512

                                                40456aef61399e1c17dcf164761b2606aa52e70eb618e2149c570bf0c62553c14e1d83351a773db709b77991a1358ff0e088390557917de07aeeaad3f2310923

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                                Filesize

                                                432B

                                                MD5

                                                98720fa8101810d63adece8528289178

                                                SHA1

                                                381bdc597aef27cbbe842a633d1750f43a9a2d78

                                                SHA256

                                                2e1f2d135c487379346f7d41e289572df81e95569285144eac6fdd49bd234297

                                                SHA512

                                                fa9ca1ec7b829e7373f1993a54a55de5f7a24491ed9e474d955ac277df134e14c98bd1826f5b1352c8bcf7a04c1abc300599384baa515751193bbe0da402f96a

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                9eb20214ae533fa98dfbfdc8128e6393

                                                SHA1

                                                c6b5b44c9f4fff2662968c050af58957d4649b61

                                                SHA256

                                                b2be14a1372115d7f53c2e179b50655e0d0b06b447a9d084b13629df7eec24ab

                                                SHA512

                                                58648305f6a38f477d98fcc1e525b82fc0d08fb1ab7f871d20bd2977650fa7dafa3a50d9f32e07d61bd462c294e7b651dc82b6a333752ca81682329a389ae8c6

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                d18f79790bd369cd4e40987ee28ebbe8

                                                SHA1

                                                01d68c57e72a6c7e512c56e9d45eb57cf439e6ba

                                                SHA256

                                                c286da52a17e50b6ae4126e15ecb9ff580939c51bf51ae1dda8cec3de503d48b

                                                SHA512

                                                82376b4550c0de80d3bf0bb4fd742a2f7b48eb1eae0796e0e822cb9b1c6044a0062163de56c8afa71364a298a39c2627325c5c69e310ca94e1f1346e429ff6ab

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                7bcae9498ab3165c1a31358bb14ea267

                                                SHA1

                                                4fb295bf109b1f72a2f9df8aa83e274f9ff82518

                                                SHA256

                                                05b49bda72a05e487d2cb96053d3ae6265a435284fb68638cd7ac45b0407e20a

                                                SHA512

                                                4e5f07700e67ddd4a77d961b18c3da2480064b54573067acf4d7f1b1073e42d034b650029617ad3926865ef9a18aeeed6418a202ef166bd8268b091e91e514ff

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

                                                Filesize

                                                20KB

                                                MD5

                                                bd2f1dddea0a2c04a57665a26fdb5587

                                                SHA1

                                                d6c431e721109868c4625a7ecaece71962763497

                                                SHA256

                                                663712963491595198838125c0e1fe753e9b726f93afe26d2c9308a0201fd504

                                                SHA512

                                                23b9e3ec6bbd02b9f33f02a39378cd795bdb417c2db677dedd2eb774e4b9830ea2d3f3b13d4e107881d8cbdf35fc97b227e9cf99de5188f1a4d1872f7b12745c

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                2KB

                                                MD5

                                                bc76625680b24af8edaffa3b7cffd1c9

                                                SHA1

                                                e889429d67d5c469655ce1c9886fddc81f973bc7

                                                SHA256

                                                b3b0898f8d1d714692797a2827a2e10cf863fd04a9940cc3196bdcff80bc7f23

                                                SHA512

                                                4d31f84071eb12d8ddfb0240552a824d22e522f46dd2fcb16a8b41817576f3324282caa3369733eb52ad1aefe15654ab7a531a52037d9c6d1e85c2ca078a6e61

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                Filesize

                                                456B

                                                MD5

                                                5fd4e9d0642f7d458ffaa13c98922f55

                                                SHA1

                                                5597e3bbea29a52d9a54ff9dc496bee0214a0c6c

                                                SHA256

                                                f3f48bedb272a65b214bb3aa34425c6e597ffe135b7c9cecb106689efcc85ff0

                                                SHA512

                                                dbe5511cffd889bdfa2d0595a3d4c36ebe8d4611306169f85d59da0d624eae5c4045899806c0480738edcd3c346a32d7d8012cf34596b00072137d815b5b7d30

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

                                                Filesize

                                                264KB

                                                MD5

                                                f50f89a0a91564d0b8a211f8921aa7de

                                                SHA1

                                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                SHA256

                                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                SHA512

                                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                611B

                                                MD5

                                                94692e566749ebfe28f5b89d6c9bfcf9

                                                SHA1

                                                1e9e4f355581a4fc7118015a2bc80d45b0b20b47

                                                SHA256

                                                071fdb50b13ab4daa7d80a54926c5f6cefe30ec9d009620715018112d9878038

                                                SHA512

                                                712db8c936c0cf7cf22406722e6381178f294518ad8b17c40dafdd1296d0ab728132e215bdc46f046cd720a93e39414d5d3aa9bfd46e54b312195ddcf2b57422

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                Filesize

                                                6KB

                                                MD5

                                                9c14b6651ba07c665544b5860a9309f6

                                                SHA1

                                                cfb758e13236d13f11ef6a4413f70049a764ba89

                                                SHA256

                                                772d3910c92e557ba281e919ac0d23ffc273c9f3dd9a3d003bd957bed158acab

                                                SHA512

                                                9b55511956b32002cb86d20779a8c00ab4a77e93d5a23984a05d95a74dd9b1fc25247aecb6c4f642824f2ed63acad73956d025a0fcf5777ed1193933da1abea9

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                5KB

                                                MD5

                                                5a2493b87953d94309e11af50019df60

                                                SHA1

                                                a164d14bd3600980c8fb4891d62d93a9193ce73d

                                                SHA256

                                                67fb745db664c536a1bd76ec25ee702314a5d5130774bd0eda35bc076dd9d029

                                                SHA512

                                                48fcc084d0ff1f464e9d4f11d36eb0b9dedecb20838584a6c41077aa84b14de085b2682941e34050713d41430952c4d466fc64e9d154837562f9469420edcbd8

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                8KB

                                                MD5

                                                92558332c17c771a8850ab771d7027d0

                                                SHA1

                                                f25f199149939eedcd4916276a86d3e331816ce3

                                                SHA256

                                                a13dfda10904c4ab282c22fd4cf8438f0cdfc316a0cfda53ecf21d20c0bbd29d

                                                SHA512

                                                f016cffc7ebfc9359476379025baed97b8c32c4601befc581d42ac6327b662a9e8052daab55919152f1cf7174b61ff61a393533aecb5b5999733b24ee27e3360

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                f74f9fb55fc33aa9ca68d0e1907d9f5b

                                                SHA1

                                                a50c3fe23ffedf3d3eda04db168d46dc34952efe

                                                SHA256

                                                46ea85a71d3d2d86ee27052bd9ed29d6d602c07fd8b9de322097eaed6af09fac

                                                SHA512

                                                9f56196293de31632ffc34b49d763fa2eccc2f9ca800c3cafea38760f24f2e868809df01ae05ea585b5a2d392465615e30a2194f1f956fc8aabe2396df7e565e

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                c4342452bb92a3991af8699eea308581

                                                SHA1

                                                62a01e4df5b09b3f78a15c0a464421d65d49ef92

                                                SHA256

                                                0f8150283a39e6a8b368d3e6c467ba47e599bc2ca30816be0e8a495c1e828d4c

                                                SHA512

                                                113fcf8a21ca0dc863d301560a5f1833aeb72dba7982a492e4f85fbb4222127783aff0f0fbe76c51bbafe374c18c121d385af04c63edcc30acf08a4462909860

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                Filesize

                                                24KB

                                                MD5

                                                6be217d826ff7c4aa81d39663a38dc10

                                                SHA1

                                                b32f46cf12fc4821f702880382f18ef3714eec66

                                                SHA256

                                                754dca9404f119306b757d135efbab8856521366fe9a3961c5373dda2a57becd

                                                SHA512

                                                306a06b11f079ad10db885200c0bbe37b56bd9687024e18fa84cfb95663f8fb00debebb381e030d5e6c4daca8eddcf180a37668745ec4972ef732dcb0bd4296d

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                4ebacf27f97818640940f8b1e2e34ce1

                                                SHA1

                                                d21e68f7ea38482d794eacbf4fc84f7419b4133d

                                                SHA256

                                                d8a823e8913aab5d7006f01009891bdc80d21cf13116306fc9f004dab52ed34c

                                                SHA512

                                                4172f029a30936cfc5a6e06e5876c49930a4e119ad0ebe799aa2af0401d5f7a776149ecd7cbc758bb117f7a66b8d117dfaa004cff51ab670eae6dd2fd5391403

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                Filesize

                                                16B

                                                MD5

                                                6752a1d65b201c13b62ea44016eb221f

                                                SHA1

                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                SHA256

                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                SHA512

                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                10KB

                                                MD5

                                                bc0a30437e3f082becf35b1b203a6760

                                                SHA1

                                                3827f2b2f042bda7ea931446dcf799451665405b

                                                SHA256

                                                39e60cba0abb8f1b757575a2b35414a1c7f702bf660f06a8b935cc5427b806f3

                                                SHA512

                                                62f43b4c0cf107feb78d8714035808e9166467f452e7ed77d7da6b4708966bac6b4cad54fd302567c37c2ac597a26dec326dd0b764fbedac4184fdbb2ac88f8b

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                10KB

                                                MD5

                                                bfc5779058015d66f2c3993af2da047c

                                                SHA1

                                                a07a5ba04203c22cca5d30891bd1f9e981987ef3

                                                SHA256

                                                98dc9400793a2d1127ae96299f9243a65f6bde1f0efb32e49955a16ea1cdf1f8

                                                SHA512

                                                193d7ff49ba204ed41ae796efa62e6208cd8cf03e67e1a0e05017be927af51373131ac74f24e43a4983fe0117f3f62e8d18af156571d92c632db1c92de50f994

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                10KB

                                                MD5

                                                d2020f2814e7b597e032786e3d41b159

                                                SHA1

                                                835febf79f4be1001406ad720e17cf97ae9cf5ce

                                                SHA256

                                                d54e24f2e1543e6a1648492776c5c8fc2b39625ce6b259f1391a80bc10b81f83

                                                SHA512

                                                c3b39fee43d300f03360fdc0538c5aca95ae4e18ac4bdec977cc6b10a02a09bc98f1e2943b55d48450f1e23b041d4771c3670e12bb57591a627e3e78f4482265

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\AppxProvider.dll

                                                Filesize

                                                554KB

                                                MD5

                                                a7927846f2bd5e6ab6159fbe762990b1

                                                SHA1

                                                8e3b40c0783cc88765bbc02ccc781960e4592f3f

                                                SHA256

                                                913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f

                                                SHA512

                                                1eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\AssocProvider.dll

                                                Filesize

                                                112KB

                                                MD5

                                                94dc379aa020d365ea5a32c4fab7f6a3

                                                SHA1

                                                7270573fd7df3f3c996a772f85915e5982ad30a1

                                                SHA256

                                                dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907

                                                SHA512

                                                998fd10a1f43024a2398491e3764748c0b990b37d8b3c820d281296f8da8f1a2f97073f4fd83543994a6e326fa7e299cb5f59e609358cd77af996175782eeaca

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\CbsProvider.dll

                                                Filesize

                                                875KB

                                                MD5

                                                6ad0376a375e747e66f29fb7877da7d0

                                                SHA1

                                                a0de5966453ff2c899f00f165bbff50214b5ea39

                                                SHA256

                                                4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f

                                                SHA512

                                                8a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\DismCore.dll

                                                Filesize

                                                402KB

                                                MD5

                                                b1f793773dc727b4af1648d6d61f5602

                                                SHA1

                                                be7ed4e121c39989f2fb343558171ef8b5f7af68

                                                SHA256

                                                af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e

                                                SHA512

                                                66a92bff5869a56a7931d7ed9881d79c22ba741c55fb42c11364f037e1ec99902db2679b67a7e60cbf760740d5b47dcf1a6dcfae5ad6711a0bd7f086cc054eed

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\DismCorePS.dll

                                                Filesize

                                                183KB

                                                MD5

                                                a033f16836d6f8acbe3b27b614b51453

                                                SHA1

                                                716297072897aea3ec985640793d2cdcbf996cf9

                                                SHA256

                                                e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e

                                                SHA512

                                                ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\DismHost.exe

                                                Filesize

                                                142KB

                                                MD5

                                                e5d5e9c1f65b8ec7aa5b7f1b1acdd731

                                                SHA1

                                                dbb14dcda6502ab1d23a7c77d405dafbcbeb439e

                                                SHA256

                                                e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80

                                                SHA512

                                                7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\DismProv.dll

                                                Filesize

                                                255KB

                                                MD5

                                                490be3119ea17fa29329e77b7e416e80

                                                SHA1

                                                c71191c3415c98b7d9c9bbcf1005ce6a813221da

                                                SHA256

                                                ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a

                                                SHA512

                                                6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\DmiProvider.dll

                                                Filesize

                                                415KB

                                                MD5

                                                ea8488990b95ce4ef6b4e210e0d963b2

                                                SHA1

                                                cd8bf723aa9690b8ca9a0215321e8148626a27d1

                                                SHA256

                                                04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98

                                                SHA512

                                                56562131cbe5f0ea5a2508f5bfed88f21413526f1539fe4864ece5b0e03a18513f3db33c07e7abd7b8aaffc34a7587952b96bb9990d9f4efa886f613d95a5b1b

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\FfuProvider.dll

                                                Filesize

                                                619KB

                                                MD5

                                                df785c5e4aacaee3bd16642d91492815

                                                SHA1

                                                286330d2ab07512e1f636b90613afcd6529ada1e

                                                SHA256

                                                56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271

                                                SHA512

                                                3566de60fe76b63940cff3579da94f404c0bc713f2476ba00b9de12dc47973c7c22d5eed1fd667d20cea29b3c3c4fa648e5f44667e8369c192a4b69046e6f745

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\FolderProvider.dll

                                                Filesize

                                                59KB

                                                MD5

                                                4f3250ecb7a170a5eb18295aa768702d

                                                SHA1

                                                70eb14976ddab023f85bc778621ade1d4b5f4d9d

                                                SHA256

                                                a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461

                                                SHA512

                                                e9ce6cced5029d931d82e78e7e609a892bfe239096b55062b78e8ff38cce34ce6dd4e91efb41c4cd6ecf6017d098e4c9b13d6cb4408d761051468ee7f74bc569

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\GenericProvider.dll

                                                Filesize

                                                149KB

                                                MD5

                                                ef7e2760c0a24453fc78359aea3d7869

                                                SHA1

                                                0ea67f1fd29df2615da43e023e86046e8e46e2e1

                                                SHA256

                                                d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a

                                                SHA512

                                                be785ba6b564cc4e755b4044ae27f916c009b7d942fcd092aed2ae630b1704e8a2f8b4692648eed481a5eb5355fd2e1ef7f94f6fb519b7e1ff6fc3c5f1aaa06f

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\IBSProvider.dll

                                                Filesize

                                                59KB

                                                MD5

                                                120f0a2022f423fc9aadb630250f52c4

                                                SHA1

                                                826df2b752c4f1bba60a77e2b2cf908dd01d3cf7

                                                SHA256

                                                5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0

                                                SHA512

                                                23e50735c06cef93d11873fc8e5e29fc63dcf3f01dc56822a17c11ca57bbfb10d46fac6351f84ba30050a16d6bd0744a08a4042a9743a6df87ac8a12e81e2764

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\ImagingProvider.dll

                                                Filesize

                                                218KB

                                                MD5

                                                35e989a1df828378baa340f4e0b2dfcb

                                                SHA1

                                                59ecc73a0b3f55e43dace3b05ff339f24ec2c406

                                                SHA256

                                                874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d

                                                SHA512

                                                c8d69e37c918881786a8fdab2a2c5d1632411b1f75082aeb3eb24a8ba5f93dcb39b3f4000e651f95452263525d98fd1d3cb834de93bed16fa6f92ef271c3a92a

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\IntlProvider.dll

                                                Filesize

                                                296KB

                                                MD5

                                                510e132215cef8d09be40402f355879b

                                                SHA1

                                                cae8659f2d3fd54eb321a8f690267ba93d56c6f1

                                                SHA256

                                                1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52

                                                SHA512

                                                2f7b2ec0e94738838f755759cd35e20ab2138b8eca023ee6ef630ab83a3de1bc0792f12ea0d722abe9a6953626cbddf8ba55ea32fc794d2df677a0625e498ab0

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\LogProvider.dll

                                                Filesize

                                                77KB

                                                MD5

                                                815a4e7a7342224a239232f2c788d7c0

                                                SHA1

                                                430b7526d864cfbd727b75738197230d148de21a

                                                SHA256

                                                a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2

                                                SHA512

                                                0c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\MsiProvider.dll

                                                Filesize

                                                207KB

                                                MD5

                                                9a760ddc9fdca758501faf7e6d9ec368

                                                SHA1

                                                5d395ad119ceb41b776690f9085f508eaaddb263

                                                SHA256

                                                7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f

                                                SHA512

                                                59d095246b62a7777e7d2d50c2474f4b633a1ae96056e4a4cb5265ccf7432fed0ea5df9b350f44d70b55a726241da10f228d8b5cbee9b0890c0b9dc9e810b139

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\OSProvider.dll

                                                Filesize

                                                149KB

                                                MD5

                                                db4c3a07a1d3a45af53a4cf44ed550ad

                                                SHA1

                                                5dea737faadf0422c94f8f50e9588033d53d13b3

                                                SHA256

                                                2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758

                                                SHA512

                                                5182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\OfflineSetupProvider.dll

                                                Filesize

                                                182KB

                                                MD5

                                                9cd7292cca75d278387d2bdfb940003c

                                                SHA1

                                                bab579889ed3ac9cb0f124842c3e495cb2ec92ac

                                                SHA256

                                                b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f

                                                SHA512

                                                ebf96839e47bef9e240836b1d02065c703547a2424e05074467fe70f83c1ebf3db6cb71bf0d38848ec25e2e81b4cbb506ced7973b85e2ab2d8e4273de720779d

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\ProvProvider.dll

                                                Filesize

                                                753KB

                                                MD5

                                                70c34975e700a9d7e120aaecf9d8f14b

                                                SHA1

                                                e24d47f025c0ec0f60ec187bfc664e9347dc2c9c

                                                SHA256

                                                a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7

                                                SHA512

                                                7f6a24345f5724d710e0b6c23b3b251e96d656fac58ea67b2b84d7d9a38d7723eae2c278e6e218e7f69f79d1cce240d91a8b0fd0d99960cacc65d82eb614a260

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\AppxProvider.dll.mui

                                                Filesize

                                                22KB

                                                MD5

                                                bd0dd9c5a602cb0ad7eabc16b3c1abfc

                                                SHA1

                                                cede6e6a55d972c22da4bc9e0389759690e6b37f

                                                SHA256

                                                8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3

                                                SHA512

                                                86351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\AssocProvider.dll.mui

                                                Filesize

                                                8KB

                                                MD5

                                                8833761572f0964bdc1bea6e1667f458

                                                SHA1

                                                166260a12c3399a9aa298932862569756b4ecc45

                                                SHA256

                                                b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5

                                                SHA512

                                                2a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\CbsProvider.dll.mui

                                                Filesize

                                                53KB

                                                MD5

                                                6c51a3187d2464c48cc8550b141e25c5

                                                SHA1

                                                a42e5ae0a3090b5ab4376058e506b111405d5508

                                                SHA256

                                                d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199

                                                SHA512

                                                87a9e997d55bc6dbd05af1291fb78cd02266641d018ccfeb6826cb0de205aaf8a57b49e587462dbb6df2b86b54f91c0c5d3f87e64d7dbb2aea75ef143c5447ba

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\DismCore.dll.mui

                                                Filesize

                                                7KB

                                                MD5

                                                7a15f6e845f0679de593c5896fe171f9

                                                SHA1

                                                0c923dfaffb56b56cba0c28a4eacb66b1b91a1f4

                                                SHA256

                                                f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419

                                                SHA512

                                                5a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\DmiProvider.dll.mui

                                                Filesize

                                                17KB

                                                MD5

                                                b7252234aa43b7295bb62336adc1b85c

                                                SHA1

                                                b2c42a5af79530e7cf9bcf54fd76ae9d5f234d7f

                                                SHA256

                                                73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c

                                                SHA512

                                                88241009b342eb1205b10f7725a7cb1ec2c7135606459d038c4b8847efd9d5e0ad4749621f8df93746dd3ba8ab92d1b0f513ed10e2ba712a7991716f4c062358

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\FfuProvider.dll.mui

                                                Filesize

                                                9KB

                                                MD5

                                                dc826a9cb121e2142b670d0b10022e22

                                                SHA1

                                                b2fe459ede8ba99602ae6ea5fa24f0133cca2bc9

                                                SHA256

                                                ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a

                                                SHA512

                                                038e9abff445848c882a71836574df0394e73690bc72642c2aa949c1ad820c5cbb4dedc4ee7b5b75fd5ac8a43813d416f23d28973de7a7f0e5c3f7112da6fe1b

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\FolderProvider.dll.mui

                                                Filesize

                                                2KB

                                                MD5

                                                22b4a3a1ec3b6d7aa3bc61d0812dc85f

                                                SHA1

                                                97ae3504a29eb555632d124022d8406fc5b6f662

                                                SHA256

                                                c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105

                                                SHA512

                                                9329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\GenericProvider.dll.mui

                                                Filesize

                                                5KB

                                                MD5

                                                d6b02daf9583f640269b4d8b8496a5dd

                                                SHA1

                                                e3bc2acd8e6a73b6530bc201902ab714e34b3182

                                                SHA256

                                                9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0

                                                SHA512

                                                189e87fcc2902e2a8e59773783d80a7d4dd5d2991bd291b0976cbd304f78bd225b353703735b84de41b5f59c37402db634c4acc805d73176cde75ca662efff50

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\IBSProvider.dll.mui

                                                Filesize

                                                2KB

                                                MD5

                                                d4b67a347900e29392613b5d86fe4ac2

                                                SHA1

                                                fb84756d11bfd638c4b49268b96d0007b26ba2fb

                                                SHA256

                                                4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5

                                                SHA512

                                                af0a2a3f813e1adfff972285c9655f50ce6916caaeff5cb82f6c7d76491ffc9b365a47f19750fc02d7122182bf65aae79ed167886c33f202d5a781ab83d75662

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\ImagingProvider.dll.mui

                                                Filesize

                                                18KB

                                                MD5

                                                f2e2ba029f26341158420f3c4db9a68f

                                                SHA1

                                                1dee9d3dddb41460995ad8913ad701546be1e59d

                                                SHA256

                                                32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3

                                                SHA512

                                                3d45d7bcf21d5df56b516fc18f7dc1bf80e44258b0c810b199a7bc06047a547060956c9d79575b82d9b6992fb5fe64f5b0ef1e408363887ae81a64b6ff9fa03e

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\IntlProvider.dll.mui

                                                Filesize

                                                27KB

                                                MD5

                                                2eb303db5753eb7a6bb3ab773eeabdcb

                                                SHA1

                                                44c6c38e6ae5f9ce9d7ca9d45a3cc3020b1353e4

                                                SHA256

                                                aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f

                                                SHA512

                                                df1c8cefed4b5ef5a47f9bc0c42776611b3af709938a0900db79c6c9f4fae21acbbb6c4b1cad3c5a2051b622fe7e6e01486d34622742a981623fed933f1b1427

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\LogProvider.dll.mui

                                                Filesize

                                                6KB

                                                MD5

                                                8933c8d708e5acf5a458824b19fd97da

                                                SHA1

                                                de55756ddbeebc5ad9d3ce950acba5d2fb312331

                                                SHA256

                                                6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6

                                                SHA512

                                                ead5017d9d024a1d7c53634ae725438ea3a34eed8c9056ebbc4ebe5aab2055c0e67687ce7608724e4f66f55aa486a63024967b76a5638cde3dd88b3d3432ca1f

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\MsiProvider.dll.mui

                                                Filesize

                                                15KB

                                                MD5

                                                c5e60ee2d8534f57fddb81ffce297763

                                                SHA1

                                                78e6b0e03c8bf5802b3ef429b105d7ae3092a8f2

                                                SHA256

                                                1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145

                                                SHA512

                                                ce654295e8b16da7bd004453ae4a422fe8296a8c2343e56d819883b835c391a02537ecf4d155a281a9d38f2291ee0004506b7fd48a99c0f8881ff1e38ae8ebcc

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\OSProvider.dll.mui

                                                Filesize

                                                3KB

                                                MD5

                                                0633e0fccd477d9b22de4dd5a84abe53

                                                SHA1

                                                e04fb5c3acb35d128c1ea6ee6fb0e9b3fe90d5a9

                                                SHA256

                                                b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706

                                                SHA512

                                                e95ed1d8069d6f200f0a2ea8dd7688404af9db9ce5e229afcb625a1f9eb46ac9e7a1c2c4c5ce156b190514415679e82e213732e8e890ed1a89af9026e4e73fe3

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\OfflineSetupProvider.dll.mui

                                                Filesize

                                                2KB

                                                MD5

                                                015271d46ab128a854a4e9d214ab8a43

                                                SHA1

                                                2569deff96fb5ad6db924cee2e08a998ddc80b2a

                                                SHA256

                                                692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec

                                                SHA512

                                                6ba678da0475a6b1872c2e2c151b395a4d97390bed4671d3f918aab5e69cbc9ceafe72c3100ba060ac6586fd37682499fdeef7d7b1ab10f5ec2411c1438ed438

                                              • C:\Users\Admin\AppData\Local\Temp\4636B776-E7BA-4414-BE79-692C20FA7832\en-US\dismprov.dll.mui

                                                Filesize

                                                2KB

                                                MD5

                                                7d06108999cc83eb3a23eadcebb547a5

                                                SHA1

                                                200866d87a490d17f6f8b17b26225afeb6d39446

                                                SHA256

                                                cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311

                                                SHA512

                                                9f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002

                                              • C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll

                                                Filesize

                                                79KB

                                                MD5

                                                d9cb0b4a66458d85470ccf9b3575c0e7

                                                SHA1

                                                1572092be5489725cffbabe2f59eba094ee1d8a1

                                                SHA256

                                                6ab3fdc4038a86124e6d698620acba3abf9e854702490e245c840c096ee41d05

                                                SHA512

                                                94937e77da89181903a260eac5120e8db165f2a3493086523bc5abbe87c4a9da39af3ba1874e3407c52df6ffda29e4947062ba6abe9f05b85c42379c4be2e5e6

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_djjp2hii.uwc.ps1

                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              • C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll

                                                Filesize

                                                73KB

                                                MD5

                                                b2e3ba2084f827f2e46a917983363f0b

                                                SHA1

                                                41fd27f8688b7a755abc0acc72a2a6a0e1045c78

                                                SHA256

                                                7daa3d35584a7e87c3e8e3afeb436d088209966471d6c766328087823f1f3e73

                                                SHA512

                                                4aea989bda6efc91836264f04f23fb3760764e3ef7809f618ad949c2e64b5a167fe5d054607535ec22fea4942d9ddc5ea7f70a1f529ee23633c1cd275d90e508

                                              • C:\Windows\Logs\DISM\dism.log

                                                Filesize

                                                223KB

                                                MD5

                                                826769b59735787f68582b4ae756439f

                                                SHA1

                                                8675bca009fe337bb7c20204ea3144020a5955ad

                                                SHA256

                                                86bf8d3123b04368fa501f297d9643634b73ad7db55310abfade180eae20bad8

                                                SHA512

                                                92436c2ac550adb23fe0cf623a6f9c00ef09dda1acc7d3b3b054071093170833e8616087a9c5f408283f77fbf805bdc9405e29a9ceef69ab330e22daa7c99e8b

                                              • C:\Windows\Logs\DISM\dism.log

                                                Filesize

                                                276KB

                                                MD5

                                                4021a04ece52a6aad4341df801388632

                                                SHA1

                                                32cbdca7ccbb55256944725d88fabcafe2fd8f59

                                                SHA256

                                                50d7ca739391a8aefa8c12c0c16eac8dd2629c84ec210fe1aed07d46b53cf92f

                                                SHA512

                                                33ef84b15d396992b30f411b55758b919333555c3087b8a2fea0e4516810d349ef9cc855e800bae6a57e42958eab9dfd401621e0c9e154b972a5f1299bc9695b

                                              • memory/1200-18-0x0000000073680000-0x0000000073696000-memory.dmp

                                                Filesize

                                                88KB

                                              • memory/1200-36-0x000000000B8F0000-0x000000000B910000-memory.dmp

                                                Filesize

                                                128KB

                                              • memory/1200-53-0x0000000072D7E000-0x0000000072D7F000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/1200-54-0x0000000072D70000-0x0000000073520000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/1200-55-0x0000000072D70000-0x0000000073520000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/1200-42-0x0000000072D70000-0x0000000073520000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/1200-41-0x0000000072D70000-0x0000000073520000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/1200-40-0x000000000B9E0000-0x000000000B9FA000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/1200-39-0x000000000B990000-0x000000000B9AE000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/1200-38-0x000000000BA00000-0x000000000BA66000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/1200-37-0x000000000B950000-0x000000000B982000-memory.dmp

                                                Filesize

                                                200KB

                                              • memory/1200-35-0x000000000AD30000-0x000000000AD42000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/1200-34-0x000000000ACA0000-0x000000000ACBA000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/1200-33-0x000000000B810000-0x000000000B8C2000-memory.dmp

                                                Filesize

                                                712KB

                                              • memory/1200-32-0x000000000A4F0000-0x000000000A540000-memory.dmp

                                                Filesize

                                                320KB

                                              • memory/1200-31-0x0000000009550000-0x000000000955A000-memory.dmp

                                                Filesize

                                                40KB

                                              • memory/1200-30-0x000000000A750000-0x000000000AC7C000-memory.dmp

                                                Filesize

                                                5.2MB

                                              • memory/1200-29-0x0000000003230000-0x0000000003296000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/1200-28-0x0000000004CC0000-0x0000000004D5C000-memory.dmp

                                                Filesize

                                                624KB

                                              • memory/1200-27-0x0000000003160000-0x00000000031A4000-memory.dmp

                                                Filesize

                                                272KB

                                              • memory/1200-21-0x0000000009270000-0x0000000009302000-memory.dmp

                                                Filesize

                                                584KB

                                              • memory/1200-20-0x0000000009640000-0x0000000009BE4000-memory.dmp

                                                Filesize

                                                5.6MB

                                              • memory/1200-17-0x0000000006740000-0x0000000006756000-memory.dmp

                                                Filesize

                                                88KB

                                              • memory/1200-52-0x00000000066B0000-0x00000000066C0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/1200-13-0x0000000072D7E000-0x0000000072D7F000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/1200-1108-0x0000000072D70000-0x0000000073520000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/1200-12-0x00000000066B0000-0x00000000066C0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/1888-966-0x000000006E750000-0x000000006E79C000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/1888-956-0x0000000005BB0000-0x0000000005F04000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/2536-935-0x0000000005FF0000-0x0000000006344000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/2536-945-0x000000006E750000-0x000000006E79C000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/2752-911-0x00000000058A0000-0x0000000005BF4000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/2752-900-0x0000000005120000-0x0000000005748000-memory.dmp

                                                Filesize

                                                6.2MB

                                              • memory/2752-927-0x0000000007800000-0x0000000007E7A000-memory.dmp

                                                Filesize

                                                6.5MB

                                              • memory/2752-901-0x0000000004ED0000-0x0000000004EF2000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/2752-928-0x0000000007230000-0x000000000723A000-memory.dmp

                                                Filesize

                                                40KB

                                              • memory/2752-929-0x0000000007440000-0x00000000074D6000-memory.dmp

                                                Filesize

                                                600KB

                                              • memory/2752-912-0x0000000005E70000-0x0000000005E8E000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/2752-931-0x0000000007410000-0x000000000741E000-memory.dmp

                                                Filesize

                                                56KB

                                              • memory/2752-899-0x0000000002590000-0x00000000025C6000-memory.dmp

                                                Filesize

                                                216KB

                                              • memory/2752-915-0x000000006E750000-0x000000006E79C000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/2752-914-0x0000000007020000-0x0000000007052000-memory.dmp

                                                Filesize

                                                200KB

                                              • memory/2752-930-0x00000000073C0000-0x00000000073D1000-memory.dmp

                                                Filesize

                                                68KB

                                              • memory/2752-932-0x00000000074E0000-0x00000000074FA000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/2752-913-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/2752-926-0x0000000007090000-0x0000000007133000-memory.dmp

                                                Filesize

                                                652KB

                                              • memory/2752-925-0x0000000007060000-0x000000000707E000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/5064-1282-0x000000006C440000-0x000000006C4BA000-memory.dmp

                                                Filesize

                                                488KB

                                              • memory/5064-1286-0x000000006CAF0000-0x000000006E4EB000-memory.dmp

                                                Filesize

                                                26.0MB

                                              • memory/5064-1267-0x000000006C540000-0x000000006CAE6000-memory.dmp

                                                Filesize

                                                5.6MB

                                              • memory/5064-1283-0x000000006C3E0000-0x000000006C439000-memory.dmp

                                                Filesize

                                                356KB

                                              • memory/5064-1280-0x000000006C4C0000-0x000000006C53E000-memory.dmp

                                                Filesize

                                                504KB

                                              • memory/5064-1075-0x0000000035880000-0x0000000035890000-memory.dmp

                                                Filesize

                                                64KB