Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    182s
  • max time network
    181s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/09/2024, 11:10

General

  • Target

    LDPlayer9_fr_1102_ld.exe

  • Size

    2.5MB

  • MD5

    a64bd549d95bfc8be592833460f79fcc

  • SHA1

    0aeeb9507ed39f14d82149c56011ec3aaed1bec9

  • SHA256

    d285b5242f4583d49c63a7c7f83a72f082ab395f9eaff674ff56c8d2d0fa063d

  • SHA512

    767bffb8861e81ce61cfec5b0462f6a62cf86d9fca8411126b6ee3f43bc7fccbbffae8fafe293e9c227f297d82562d70940b441f9d541e35b66b972f2b79fdae

  • SSDEEP

    49152:INfatughHaKLIKN1cueXlaYbsISTb/am5B8y6sEUhSSwoUK:Ila4ghHaKMu2IYbsIW/amj8yF8S

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
  • Manipulates Digital Signatures 1 TTPs 64 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Possible privilege escalation attempt 6 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 15 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LDPlayer9_fr_1102_ld.exe
    "C:\Users\Admin\AppData\Local\Temp\LDPlayer9_fr_1102_ld.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3904
    • C:\LDPlayer\LDPlayer9\LDPlayer.exe
      "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=1102 -language=fr -path="C:\LDPlayer\LDPlayer9\"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4576
      • C:\LDPlayer\LDPlayer9\dnrepairer.exe
        "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=590460
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:5116
        • C:\Windows\SysWOW64\net.exe
          "net" start cryptsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:348
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start cryptsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4924
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Softpub.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:4560
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Wintrust.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:2144
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Initpki.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2656
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32" Initpki.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:428
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" dssenh.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3900
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" rsaenh.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4716
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" cryptdlg.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:2524
        • C:\Windows\SysWOW64\takeown.exe
          "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:1388
        • C:\Windows\SysWOW64\icacls.exe
          "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2268
        • C:\Windows\SysWOW64\takeown.exe
          "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:928
        • C:\Windows\SysWOW64\icacls.exe
          "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2212
        • C:\Windows\SysWOW64\dism.exe
          C:\Windows\system32\dism.exe /Online /English /Get-Features
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1044
          • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\dismhost.exe
            C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\dismhost.exe {619D0DC9-157A-4C50-959B-26A374040F39}
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            PID:400
        • C:\Windows\SysWOW64\sc.exe
          sc query HvHost
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1604
        • C:\Windows\SysWOW64\sc.exe
          sc query vmms
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5076
        • C:\Windows\SysWOW64\sc.exe
          sc query vmcompute
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3292
        • C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
          "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4900
        • C:\Windows\SYSTEM32\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
          4⤵
          • Loads dropped DLL
          PID:2460
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1380
        • C:\Windows\SYSTEM32\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1924
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2884
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4584
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc" start Ld9BoxSup
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:880
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2452
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2208
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1520
      • C:\LDPlayer\LDPlayer9\driverconfig.exe
        "C:\LDPlayer\LDPlayer9\driverconfig.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2132
      • C:\Windows\SysWOW64\takeown.exe
        "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:5020
      • C:\Windows\SysWOW64\icacls.exe
        "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:4924
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4bUcwDd53d
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3112
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffe09003cb8,0x7ffe09003cc8,0x7ffe09003cd8
        3⤵
          PID:2120
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
          3⤵
            PID:1548
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2532
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
            3⤵
              PID:1036
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              3⤵
                PID:2844
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                3⤵
                  PID:3028
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
                  3⤵
                    PID:4600
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3936 /prefetch:8
                    3⤵
                      PID:2356
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3612 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1932
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3052
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                      3⤵
                        PID:2308
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                        3⤵
                          PID:3900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3664 /prefetch:8
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3020
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                          3⤵
                            PID:4924
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17984719233837405446,17301682346071600485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
                            3⤵
                              PID:2436
                          • C:\LDPlayer\LDPlayer9\dnplayer.exe
                            "C:\LDPlayer\LDPlayer9\\dnplayer.exe"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Checks processor information in registry
                            • Modifies Internet Explorer settings
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:2588
                            • C:\Windows\SysWOW64\sc.exe
                              sc query HvHost
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:1336
                            • C:\Windows\SysWOW64\sc.exe
                              sc query vmms
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:2652
                            • C:\Windows\SysWOW64\sc.exe
                              sc query vmcompute
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:5028
                            • C:\Program Files\ldplayer9box\vbox-img.exe
                              "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
                              3⤵
                              • Executes dropped EXE
                              PID:1824
                            • C:\Program Files\ldplayer9box\vbox-img.exe
                              "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
                              3⤵
                              • Executes dropped EXE
                              PID:3912
                            • C:\Program Files\ldplayer9box\vbox-img.exe
                              "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
                              3⤵
                              • Executes dropped EXE
                              PID:2592
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          1⤵
                          • Drops file in Windows directory
                          • Enumerates system info in registry
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:3388
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe08bacc40,0x7ffe08bacc4c,0x7ffe08bacc58
                            2⤵
                              PID:1268
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1832 /prefetch:2
                              2⤵
                                PID:1864
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2124 /prefetch:3
                                2⤵
                                  PID:1524
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2328 /prefetch:8
                                  2⤵
                                    PID:3924
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3140 /prefetch:1
                                    2⤵
                                      PID:1572
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3300 /prefetch:1
                                      2⤵
                                        PID:1484
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3132,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4496 /prefetch:1
                                        2⤵
                                          PID:2460
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4796 /prefetch:8
                                          2⤵
                                            PID:5020
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4840,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4820 /prefetch:8
                                            2⤵
                                              PID:2016
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
                                              2⤵
                                              • Drops file in Windows directory
                                              PID:2752
                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7d2334698,0x7ff7d23346a4,0x7ff7d23346b0
                                                3⤵
                                                • Drops file in Windows directory
                                                PID:1792
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4812,i,16900291798619873666,3342797999709479363,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4972 /prefetch:1
                                              2⤵
                                                PID:4052
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                              1⤵
                                                PID:2320
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                1⤵
                                                  PID:340
                                                • C:\Windows\system32\AUDIODG.EXE
                                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C0
                                                  1⤵
                                                    PID:2692
                                                  • C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
                                                    "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    PID:4156
                                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1980
                                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:2064
                                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:4408
                                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1324
                                                    • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                                      "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:2260
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:3392
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:4936

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\LDPlayer\LDPlayer9\MSVCP120.dll

                                                        Filesize

                                                        444KB

                                                        MD5

                                                        50260b0f19aaa7e37c4082fecef8ff41

                                                        SHA1

                                                        ce672489b29baa7119881497ed5044b21ad8fe30

                                                        SHA256

                                                        891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9

                                                        SHA512

                                                        6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

                                                      • C:\LDPlayer\LDPlayer9\MSVCR120.dll

                                                        Filesize

                                                        947KB

                                                        MD5

                                                        50097ec217ce0ebb9b4caa09cd2cd73a

                                                        SHA1

                                                        8cd3018c4170072464fbcd7cba563df1fc2b884c

                                                        SHA256

                                                        2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112

                                                        SHA512

                                                        ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

                                                      • C:\LDPlayer\LDPlayer9\crashreport.dll

                                                        Filesize

                                                        51KB

                                                        MD5

                                                        84139b3614981ff952a983cbc7733317

                                                        SHA1

                                                        89da2882575e15d48b6bd3e9a590786beefcb368

                                                        SHA256

                                                        45e1e4a43b88c59c4613e126d14e1a0c5a4f2be0381baba5dbac30372f616f26

                                                        SHA512

                                                        4e0118a9895f515b4f5ff354d282687d8ca78975a155e5222168d80b3ab9a5e3b127a0cb74ca054d2e06d1148396c4b24ecad10979f5a0609055735476a8aa16

                                                      • C:\LDPlayer\LDPlayer9\dnmultiplayer.exe

                                                        Filesize

                                                        1.2MB

                                                        MD5

                                                        6b1daa15640060da31c850c2f57f345d

                                                        SHA1

                                                        fb00fad10d6e534ec00a10d9e5cb49e4e0614157

                                                        SHA256

                                                        ff24da764a299f547c839295927bf7faf27e05d90bba016ca09baecf4a1d9f38

                                                        SHA512

                                                        6263cef9fab28acf359da1324c49edf9bd2b28492b9413be22430a763b800870c35f634b4cf2f20eefb7448cdddf0ef1640a05bba7eb5b0b882e6a1f831b30dc

                                                      • C:\LDPlayer\LDPlayer9\dnplayer.exe

                                                        Filesize

                                                        3.6MB

                                                        MD5

                                                        a2cadbc31e5bdd8698bdf91d429dd7c1

                                                        SHA1

                                                        7ec781715153d5efd3b7b37dca672f56470e8f44

                                                        SHA256

                                                        c4fb76f811900125c488934e9d8497ca603fb6334348cc1f1206d2deaaf442d1

                                                        SHA512

                                                        2a5df99d6c99dab599264a95cb0dc3cf4bb94c3dc1533bf0c33edf41973b163af3456bc57c574220b79b756b27e98134e421235cb807b4fd50a716db437dbf3c

                                                      • C:\LDPlayer\LDPlayer9\dnrepairer.exe

                                                        Filesize

                                                        41.9MB

                                                        MD5

                                                        f38edaf30f4296e5a28d981f6f24f972

                                                        SHA1

                                                        e3305becdaaba4b53387a5cdd243e012aa004cef

                                                        SHA256

                                                        4684b3185eb3b0f8471b3d0c7f866b26720ee40dee500569533f12f98e221273

                                                        SHA512

                                                        1ca4977c2897f9b1ed731ed0bd2b3970d94af4e8e7a568bdb55658bee8ff4df5364b8939494d582186f2637bc5144bfb3260618669c54edfc1369e7e77563d6a

                                                      • C:\LDPlayer\LDPlayer9\dnresource.rcc

                                                        Filesize

                                                        5.6MB

                                                        MD5

                                                        098c2d6254f6ecb2c0dfd727b6ab9e68

                                                        SHA1

                                                        a58491ba7a4f6aea18b64c1686ff23fb84d89739

                                                        SHA256

                                                        8ac43f0b09c8e29a2d5baf51f5536a27d9fca5012379b21e63078eb755145e77

                                                        SHA512

                                                        40419a800c2feaf10594dca2be8418b0c6e395168eb96220634eb47316e105f6749bc478d58b4b26a292b933ebe25cf3071f9025d5195c233a707e913a3b803d

                                                      • C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf

                                                        Filesize

                                                        314KB

                                                        MD5

                                                        e2e37d20b47d7ee294b91572f69e323a

                                                        SHA1

                                                        afb760386f293285f679f9f93086037fc5e09dcc

                                                        SHA256

                                                        153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2

                                                        SHA512

                                                        001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe

                                                        Filesize

                                                        652KB

                                                        MD5

                                                        ad9d7cbdb4b19fb65960d69126e3ff68

                                                        SHA1

                                                        dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d

                                                        SHA256

                                                        a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326

                                                        SHA512

                                                        f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll

                                                        Filesize

                                                        1.5MB

                                                        MD5

                                                        66df6f7b7a98ff750aade522c22d239a

                                                        SHA1

                                                        f69464fe18ed03de597bb46482ae899f43c94617

                                                        SHA256

                                                        91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f

                                                        SHA512

                                                        48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll

                                                        Filesize

                                                        2.0MB

                                                        MD5

                                                        01c4246df55a5fff93d086bb56110d2b

                                                        SHA1

                                                        e2939375c4dd7b478913328b88eaa3c91913cfdc

                                                        SHA256

                                                        c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889

                                                        SHA512

                                                        39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll

                                                        Filesize

                                                        442KB

                                                        MD5

                                                        2d40f6c6a4f88c8c2685ee25b53ec00d

                                                        SHA1

                                                        faf96bac1e7665aa07029d8f94e1ac84014a863b

                                                        SHA256

                                                        1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334

                                                        SHA512

                                                        4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll

                                                        Filesize

                                                        1.2MB

                                                        MD5

                                                        ba46e6e1c5861617b4d97de00149b905

                                                        SHA1

                                                        4affc8aab49c7dc3ceeca81391c4f737d7672b32

                                                        SHA256

                                                        2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e

                                                        SHA512

                                                        bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll

                                                        Filesize

                                                        192KB

                                                        MD5

                                                        52c43baddd43be63fbfb398722f3b01d

                                                        SHA1

                                                        be1b1064fdda4dde4b72ef523b8e02c050ccd820

                                                        SHA256

                                                        8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f

                                                        SHA512

                                                        04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll

                                                        Filesize

                                                        511KB

                                                        MD5

                                                        e8fd6da54f056363b284608c3f6a832e

                                                        SHA1

                                                        32e88b82fd398568517ab03b33e9765b59c4946d

                                                        SHA256

                                                        b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd

                                                        SHA512

                                                        4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll

                                                        Filesize

                                                        522KB

                                                        MD5

                                                        3e29914113ec4b968ba5eb1f6d194a0a

                                                        SHA1

                                                        557b67e372e85eb39989cb53cffd3ef1adabb9fe

                                                        SHA256

                                                        c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a

                                                        SHA512

                                                        75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll

                                                        Filesize

                                                        854KB

                                                        MD5

                                                        4ba25d2cbe1587a841dcfb8c8c4a6ea6

                                                        SHA1

                                                        52693d4b5e0b55a929099b680348c3932f2c3c62

                                                        SHA256

                                                        b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49

                                                        SHA512

                                                        82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6

                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll

                                                        Filesize

                                                        283KB

                                                        MD5

                                                        0054560df6c69d2067689433172088ef

                                                        SHA1

                                                        a30042b77ebd7c704be0e986349030bcdb82857d

                                                        SHA256

                                                        72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750

                                                        SHA512

                                                        418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0

                                                      • C:\LDPlayer\LDPlayer9\phones.data

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        fdee6e3ccf8b61db774884ccb810c66f

                                                        SHA1

                                                        7a6b13a61cd3ad252387d110d9c25ced9897994d

                                                        SHA256

                                                        657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4

                                                        SHA512

                                                        f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512

                                                      • C:\LDPlayer\LDPlayer9\vms\config\leidian0.config

                                                        Filesize

                                                        636B

                                                        MD5

                                                        d19327a3c2c1add4d3307022b03155c5

                                                        SHA1

                                                        4a920c9e23a797b0d441177d0cb0c5e49838b965

                                                        SHA256

                                                        d991d92b4e7808ed953cf9c529b5166a08613e6ebc370c13608916f7671b7318

                                                        SHA512

                                                        fc5a59edb2dd2e701a1a53d0a2c1ac6802f487dc52d0b632846134411dcb449f2a6110c4c8dcf5f0400738825e331920aa5210679effaa9437170bffc529c917

                                                      • C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk

                                                        Filesize

                                                        35.1MB

                                                        MD5

                                                        4d592fd525e977bf3d832cdb1482faa0

                                                        SHA1

                                                        131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef

                                                        SHA256

                                                        f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6

                                                        SHA512

                                                        afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77

                                                      • C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf

                                                        Filesize

                                                        103KB

                                                        MD5

                                                        4acd5f0e312730f1d8b8805f3699c184

                                                        SHA1

                                                        67c957e102bf2b2a86c5708257bc32f91c006739

                                                        SHA256

                                                        72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5

                                                        SHA512

                                                        9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        6200ada27046bc14916c253c549c0093

                                                        SHA1

                                                        c592ce6fe18e829c776fa4aff81c21a953ab2f59

                                                        SHA256

                                                        66a26cc174bb7db6210a2f00b94e6dffe2771df06f2e2e817b7e4b0f305cafae

                                                        SHA512

                                                        b106a52643f8342116d94c5444b530546626939dfa4bb42a220ab7cfaac29c90d4c10a4154b370ed628428e92b8db3ad50361033e9372bbe3864773689bdba4a

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        35c43a635f254a4c9018b5ba6568de71

                                                        SHA1

                                                        e61d40c9a909c728d3132f00a425766cc21c5ca1

                                                        SHA256

                                                        a9d912f2600eecd3576c5b70edcca96bd7dad6bdc6c4715963da17f57fd64454

                                                        SHA512

                                                        551714d297d43c326d3f785bc095ab0266e12e9bae8d34aca90ec7c698775ddd2834dc67101af8d9cd1b7aae8cb59169087d716a943df4d6271aa2d1b46ecc68

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        28b937bc46b19fd21cc7a1f3c8197f97

                                                        SHA1

                                                        5d6c255d8d9c5f1c42d70eb2d764fe01778e8c9c

                                                        SHA256

                                                        da40b45289f8a9aa778aa0a5ccf795bc653bd5441057285e0d4bc5497de5fd5d

                                                        SHA512

                                                        db1800b34735132dbd1ea1340754676cc4f979ebaf71aa678367459209f37e6cd159d8e61af07c9428d6fe7d509a58bc7ecc681be62f02e271d6556c6e120589

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

                                                        Filesize

                                                        434B

                                                        MD5

                                                        7a901915858bfc5dbb8f5e746aff341a

                                                        SHA1

                                                        6e9949b11587ec6e079c55f18cac792c852e2a62

                                                        SHA256

                                                        4f5778f94485fa8afc70cf808e13aced837a9019ba29535fb7bd658d889458a9

                                                        SHA512

                                                        248faaf4bc9e735ba19c2b47b5cd9e8656a04ad955237a9b4e5cd9bf1d51bd1d20fed67229694e2ac1f73d2ae207af12f5d25cdabf11e6c545892d5b1ad0bb0a

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                                        Filesize

                                                        458B

                                                        MD5

                                                        d8a8637edb246b14a0e53cf6238a5add

                                                        SHA1

                                                        d9e668dc576a081295cae35b5776bd26c374f19d

                                                        SHA256

                                                        92f17e5d953c92e896fc8daa7108469670465f826c7cd4f64119723c6cd0c69f

                                                        SHA512

                                                        053338cb37f409fd29027f5a33dd2ae761e013d9896d947b0036d5366c48b17bb98209f03f6e9d969fe2422fca54ae5e76861dd8a9f380efb7bc4a3993fadd42

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                                        Filesize

                                                        432B

                                                        MD5

                                                        e0f761416e433bc54864c52120e16395

                                                        SHA1

                                                        ebf2acbb7035a3d2e1e833594ffff9b306c4a1bf

                                                        SHA256

                                                        4886862378deee6acd2a22360bb28ec89ded5c12c4e16d802ea4f2d628593869

                                                        SHA512

                                                        99bee16dc8733188346d7b88418897ec9d77474971340042bc85c7349e365e3d5621607a1f7ba7edb4231203d5c64b91292a427c625a29e23ac38ffff8e0316a

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                        Filesize

                                                        649B

                                                        MD5

                                                        bba0b0b62353e69ed949426382e8fe74

                                                        SHA1

                                                        56da16c3e6524a226a82e919bf3aa1e810854f30

                                                        SHA256

                                                        3e7847f1f97f42c113270265380249a12e759f34032d4610eddf253ba61a3883

                                                        SHA512

                                                        336b2d957ce4c26d9128bcced61fee65fb6bfb84178fdf8ad1585081fdeee241a8182b4bb1ac8ef3e4368d73033a7ccb007dd034fde7a8c8bea125a473b36635

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                                        Filesize

                                                        211KB

                                                        MD5

                                                        e7226392c938e4e604d2175eb9f43ca1

                                                        SHA1

                                                        2098293f39aa0bcdd62e718f9212d9062fa283ab

                                                        SHA256

                                                        d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

                                                        SHA512

                                                        63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                                                        Filesize

                                                        216B

                                                        MD5

                                                        d4a7edeb2347b16c3a2fb31f039bad34

                                                        SHA1

                                                        90bee89b7b6fb576088aef739e83200b767700cb

                                                        SHA256

                                                        6ec3faa377e4570bc31aa7dc43e670eadd11b10802b68d966ed7258927a2d7e4

                                                        SHA512

                                                        950655d794568e07c816abb0361a4def5d3b7b1febb78ddde4649b4e6ba406be6d86b66cb4e423642e7f2a40ee5f2ebd72207cd19a4baad79fb5894dbd0cf747

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        216B

                                                        MD5

                                                        0f818d0340b37ecd22b781409cd09f84

                                                        SHA1

                                                        8a4b462274804d297ffa0366686ba9e4793e081a

                                                        SHA256

                                                        464d18aeee09ca45ecc3c582165d7ff4262aa7798b73c69ba1e3cdf34b521f37

                                                        SHA512

                                                        e9327a633c74f59955fee2ff2223ef24486222755f33d113634a9b27aea6df9ce49f6d91a8e7a675b5328e89d94f74dc3194ba98645f4428963d0f550a522674

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        d6ff35f276a48fa134f03d47d85590ca

                                                        SHA1

                                                        ca9beeeb5ea86304d25871ee9ffebc9b24ecb9cf

                                                        SHA256

                                                        6c6a77d78ac037a7c948ce0130fdd71b0f7b352bb8d7f81622bca94c1b29e011

                                                        SHA512

                                                        3774f3d7bf6048526945f06c669edbcc7bba7f751ce39277e43690965a395d682a690acd8442dd60bba027eed9c3726a86f8dd5b63c64f81f7cb07e4fa32bca8

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                        Filesize

                                                        2B

                                                        MD5

                                                        d751713988987e9331980363e24189ce

                                                        SHA1

                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                        SHA256

                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                        SHA512

                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                        Filesize

                                                        356B

                                                        MD5

                                                        6c2f441d685130b4d77bc4b49ec5fcbf

                                                        SHA1

                                                        da66ca18c1b18706e540f65348072533108a462d

                                                        SHA256

                                                        798a6c70458531bfdb66f574a77c89a4732f41016a55379f89315bb314829aad

                                                        SHA512

                                                        5f5fa1d753a722cf06a4aefaf915a586b44b736ccebcd55fcccdbf0365f97f30678f0a38e2d7332c7c8e210ffd01fb43ff05cfd5ba370c45d440702f18c11c8e

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        d19b9762fee145122a895be7c82dd030

                                                        SHA1

                                                        473546a398542e8d8cf75c1f3d14d7d918a2990f

                                                        SHA256

                                                        3631d4cde014edfaa5fad1d4081e7b773748d8c8dc430732790add82250f9a18

                                                        SHA512

                                                        cf9be95b3798d41c0323c99d46efe9e6992cabf5d61ca6c20bd4e268c47b26d3bcf076cccad93d9606136f20f32db1bfcc2442dc418f62ecb869fafd98187102

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        da1ef567aa76e74d951fc27cf0d630e5

                                                        SHA1

                                                        0e03ddb86c14c9a70f4b7454fe047d7b98ed648a

                                                        SHA256

                                                        cf659cf07393778b1dae1e386714d3d68705775baae14a2b2d4d9dda68e83c95

                                                        SHA512

                                                        237a98a3f9fb55743937b0a3ff34d808b7d6d0493696104fc05a6c9d7378cfe7e0625be325f7449b3f9764866eaadd7c899622f47f11d9dec9a709d77b575afb

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        69d1462e558f25715428ca00c335e03e

                                                        SHA1

                                                        e52d30b86fc735263c1a229cdf2a5d0f6ecf7ceb

                                                        SHA256

                                                        0a7ca24dd0fe3e7a6e81f1d0259cf955ecc472538473d4f3a79876918137f78d

                                                        SHA512

                                                        8ed3289aaec5ca0bb2bd0b4773edaa53d6c735646055a4a3f6fcd1a87f2733155b70a925b2f4ffdced6b50954c75481aaaf287eca273ad50ede0ca0b4ad98148

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                        Filesize

                                                        9KB

                                                        MD5

                                                        4f4b1b5179eccdf425e1fc193d72d462

                                                        SHA1

                                                        70da0b2ac5e2d0e3f257a851d8c7cafe060d9f4a

                                                        SHA256

                                                        2ca42b8712f6c09210c69435167821c883c49fb06f0fce3fec96f507544bcd61

                                                        SHA512

                                                        94078dd872b919d23fb805f7e5d975efab018644d5e7d6aa6400d35f8e52b018f0918dba91d7ba372b07cec8a4056fa21a28c74453ceaeef3f02b34930f2021c

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                        Filesize

                                                        15KB

                                                        MD5

                                                        291732c97da2df001c27baba61010bd1

                                                        SHA1

                                                        3d5f16676862dd2737ae1c7203271ba65c8fd370

                                                        SHA256

                                                        6b6dacfc03243e24f053990d5a386e26fecc957c6c4c50f68bb0604620678589

                                                        SHA512

                                                        797c9820d201866eae086b1cbfba712e911e701fc7ca2607268a670fed32de5fa3c2b235f6b1037f5ffe5d03b29f1ae59a4910da91eaff29a3c140c966379483

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        205KB

                                                        MD5

                                                        c76482549a07d17683f651d3fd68db62

                                                        SHA1

                                                        397951da5cf94174e1b7d484424ed4371447eca8

                                                        SHA256

                                                        f5f5a1b0264fa0be7146b3c03e64a18b7402c10212502b3f9f0de951a161bab4

                                                        SHA512

                                                        31bb8d8befa6ccffa9b648ce0ad05fb1cf37a7ef25fc02a452ebf5f5fa23a74717749d8f6c73a8d7d0ca74556b0de266241c8701e547e91da382d327cfca1128

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        205KB

                                                        MD5

                                                        6a2254f82fbd464d4123a59647627463

                                                        SHA1

                                                        93d77f73064c338b1c70263dad8174ae62848763

                                                        SHA256

                                                        f35de78fd287880f9d7d1dd41f3edd285a8e0b4ce14c9d046313ce9c76924a5e

                                                        SHA512

                                                        4b8b942aae1cf9d75be02a84d0b8874739f235edd74b17e144a6ce568902fa8f0d8f6b072b085b61d3d3ab2740331f0163e8776de3bac729ea6ef013f1c0c6fa

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                        Filesize

                                                        205KB

                                                        MD5

                                                        c3109c35a6e44c62ff7f77f70e1e9dcb

                                                        SHA1

                                                        9cc68f01d94d5504de7ddbc2466d13253c88faa0

                                                        SHA256

                                                        935587b8e61924565ce25c093a726bab88b5fa7c4c5958070d7de30512599439

                                                        SHA512

                                                        ca8ca47e72a7c0a9d0ed391b70ab78a4fc501013a90540eaec04d95705f80f5e729de40052720b9152d647cef4082425b6ebf7da13a9fa925022e0c2fae7fb35

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                        Filesize

                                                        264KB

                                                        MD5

                                                        d527284e1cdf41dbc2b99eba7cb7ab2e

                                                        SHA1

                                                        5cca356a42adc1dafbf582708651aae6b50c494a

                                                        SHA256

                                                        7b2c94e2157dff1df83f97fb49fc2a10ed25d50c83f4a6f805aca46abe4106f6

                                                        SHA512

                                                        a631ff5692cdfe566594314409090fe845afd8ec76b52a4f49d36d99b2b656c90ec32eace72bf4b9a00a7969a62aa87caa889f0e28b0b0fbeea344500e980e21

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        ea667b2dedf919487c556b97119cf88a

                                                        SHA1

                                                        0ee7b1da90be47cc31406f4dba755fd083a29762

                                                        SHA256

                                                        9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

                                                        SHA512

                                                        832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        2ee16858e751901224340cabb25e5704

                                                        SHA1

                                                        24e0d2d301f282fb8e492e9df0b36603b28477b2

                                                        SHA256

                                                        e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

                                                        SHA512

                                                        bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        1673c1889f963dced0f101e6cb841d9b

                                                        SHA1

                                                        4aafd00eb9ba58ef0b664c6e122da4da93b907f4

                                                        SHA256

                                                        c49edc7284751afb7bcad481aa98a3fd21e58133659e51268782d993ef40fd6e

                                                        SHA512

                                                        5f538370afce67157016cb099a678c75dab6ac8f16173c9a2c3604683493b203f710dfba6c7e00b6a78a0bae38252117a8535606506152cd73f419b86ae92a34

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        da325c45736d287020ccedbef02dbeed

                                                        SHA1

                                                        43d35359432f61770e6f24e7458245f40e3f7a98

                                                        SHA256

                                                        4082577f01710845a31998f8f1f5ed2402a08f764b50eb9dc87fe3f490f0cc8c

                                                        SHA512

                                                        2636e8602a8f54ce60c6ab468a49c83750ca490daade54bbd31307189a0a6fac8848e1803753fcbc049097b1543bee130a1fb3c246bd7de4d8b110c02d43bffe

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        4bf90a1e83ae0625f37d46580c93600d

                                                        SHA1

                                                        b9198f2a84e2915ff65c99bab702964bde48d7dd

                                                        SHA256

                                                        f3e4ee6f48fa198dbf945afbe377d45b98a042f668e2da6dc999fd5345523470

                                                        SHA512

                                                        e2dab3d877095fcf86fcabee8e393b58cfb96ab8ca83881488ac93328e28f5277c6ca3d8d00258919c0e54246c739a954a345b24a6daa12802d0c427b0c76343

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\AssocProvider.dll

                                                        Filesize

                                                        136KB

                                                        MD5

                                                        702f9c8fb68fd19514c106e749ec357d

                                                        SHA1

                                                        7c141106e4ae8f3a0e5f75d8277ec830fc79eccc

                                                        SHA256

                                                        21ad24a767aeb22d27d356bc8381f103ab620de1a47e374b9f961e44b543a358

                                                        SHA512

                                                        2e7d403c89dacdda623ed1a107bac53aafde089fdd66088d578d6b55bcfe0a4fc7b54733642162bd62d0ca3f1696667a6f0cb4b572d81a6eefd6792d6003c0d9

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\DismCorePS.dll

                                                        Filesize

                                                        200KB

                                                        MD5

                                                        7f751738de9ac0f2544b2722f3a19eb0

                                                        SHA1

                                                        7187c57cd1bd378ef73ba9ad686a758b892c89dc

                                                        SHA256

                                                        db995f4f55d8654fc1245da0df9d1d9d52b02d75131bc3bce501b141888232fc

                                                        SHA512

                                                        0891c2dedb420e10d8528996bc9202c9f5f96a855997f71b73023448867d7d03abee4a9a7e2e19ebe2811e7d09497bce1ea4e9097fcb810481af10860ff43dfb

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\DismHost.exe

                                                        Filesize

                                                        168KB

                                                        MD5

                                                        17275206102d1cf6f17346fd73300030

                                                        SHA1

                                                        bbec93f6fb2ae56c705efd6e58d6b3cc68bf1166

                                                        SHA256

                                                        dead0ebd5b5bf5d4b0e68ba975e9a70f98820e85d056b0a6b3775fc4df4da0f6

                                                        SHA512

                                                        ce14a4f95328bb9ce437c5d79084e9d647cb89b66cde86a540b200b1667edc76aa27a36061b6e2ceccecb70b9a011b4bd54040e2a480b8546888ba5cc84a01b3

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\EdgeProvider.dll

                                                        Filesize

                                                        200KB

                                                        MD5

                                                        c22cc16103ee51ba59b765c6b449bddb

                                                        SHA1

                                                        b0683f837e1e44c46c9a050e0a3753893ece24ad

                                                        SHA256

                                                        eb68c7d48f78b46933acba617cf3b5fcb5b8695c8a29295a9fa075f36910825b

                                                        SHA512

                                                        2c382aaddeca4efda63162584c4a2338ffcc1f4828362ce7e927e0b39c470f1f66a7933ae2210d63afb5a2ae25412266fde2ee6bdb896c3c030bdc08b67ec54e

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\Ffuprovider.dll

                                                        Filesize

                                                        680KB

                                                        MD5

                                                        a41b0e08419de4d9874893b813dccb5c

                                                        SHA1

                                                        2390e00f2c2bc9779e99a669193666688064ea77

                                                        SHA256

                                                        57ce7761531058f3c4289b1240bea6dc06355c9c4b4e88b9c9c0df8012edc5b3

                                                        SHA512

                                                        bd370e49da266148d50144c621f6415bdd5358e6274b1d471b8d4ee1888d93774331c3f75e6cb99782f1c8e772981cbc5a4baf5592c6400f340407dc670e547a

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\ImagingProvider.dll

                                                        Filesize

                                                        248KB

                                                        MD5

                                                        4c6d681704e3070df2a9d3f42d3a58a2

                                                        SHA1

                                                        a9f6286ac25f17b6b2acd1fce6459b0bc94c6c81

                                                        SHA256

                                                        f1bbab35b2602d04d096c8de060b2a5cf802499a937fd1ffe749ff7f54852137

                                                        SHA512

                                                        daa0c723312680256c24457162e0ef026b753ba267f3e2755f838e2864a163802c078d8668dd2c2064cb8887f4e382a73d6402a5533b6ac5c3cbf662ad83db86

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\IntlProvider.dll

                                                        Filesize

                                                        312KB

                                                        MD5

                                                        34035aed2021763bec1a7112d53732f1

                                                        SHA1

                                                        7132595f73755c3ae20a01b6863ac9518f7b75a4

                                                        SHA256

                                                        aac13ddb9ab5a165a38611f1b61229268a40d416f07740d4eefba1a8fcf7c731

                                                        SHA512

                                                        ea045aa46713133a5d0ad20514cc2a8c8fffb99b4e19c4d5262f86167cfce08a31d336222fd3c91e6efbfd90312bb2325337aa02a8489e047b616085fdf46c1d

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\LogProvider.dll

                                                        Filesize

                                                        108KB

                                                        MD5

                                                        c63f6b6d4498f2ec95de15645c48e086

                                                        SHA1

                                                        29f71180feed44f023da9b119ba112f2e23e6a10

                                                        SHA256

                                                        56aca41c62c8d0d1b26db3a01ef6c2da4a6a51fc963eb28411f8f7f029f1bfde

                                                        SHA512

                                                        3a634340d8c66cbc1bef19f701d8bdb034449c28afecce4e8744d18181a20f85a17af3b66c8853cecb8be53f69ae73f85b70e45deac29debab084a25eb3c69dc

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\OSProvider.dll

                                                        Filesize

                                                        180KB

                                                        MD5

                                                        e9833a54c1a1bfdab3e5189f3f740ff9

                                                        SHA1

                                                        ffb999c781161d9a694a841728995fda5b6da6d3

                                                        SHA256

                                                        ec137f9caebcea735a9386112cf68f78b92b6a5a38008ce6415485f565e5cf85

                                                        SHA512

                                                        0b18932b24c0257c80225c99be70c5125d2207f9b92681fd623870e7a62599a18fa46bcb5f2b4b01889be73aeb084e1b7e00a4968c699c7fdb3c083ef17a49f9

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\OfflineSetupProvider.dll

                                                        Filesize

                                                        213KB

                                                        MD5

                                                        3437087e6819614a8d54c9bc59a23139

                                                        SHA1

                                                        ae84efe44b02bacdb9da876e18715100a18362be

                                                        SHA256

                                                        8b247665218f5151f0d19f59ea902a7c28f745d67a5d51b63b77242ffb4bdd74

                                                        SHA512

                                                        018e88f6c121dd4ecaceb44794e2fa7a44b52ddb22e7a5a30a332905e02065cbc1d1dcddc197676277b22f741195c1b7c4c185d328b096b6560b84e9749d6dde

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\ProvProvider.dll

                                                        Filesize

                                                        800KB

                                                        MD5

                                                        2ef388f7769205ca319630dd328dcef1

                                                        SHA1

                                                        6dc9ed84e72af4d3e7793c07cfb244626470f3b6

                                                        SHA256

                                                        4915b0c9cd8dc8a29dd649739974d244f9105dc58725f1da0d592af3b546e2bf

                                                        SHA512

                                                        b465917424dd98125d080c135c7e222a9485ed7ec89004f9a70e335b800e5b9419fbc932c8069bae9ff126494174cf48e2790030dd22aa2d75b7b9d8ccff752b

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\ServicingCommon.dll

                                                        Filesize

                                                        944KB

                                                        MD5

                                                        07231bdae9d15bfca7d97f571de3a521

                                                        SHA1

                                                        04aec0f1afcf7732bc4cd1f7aab36e460c325ba6

                                                        SHA256

                                                        be75afbbc30cad7235adf03dcc07fcee3c0c330c89b00e326ebbef2e57df5935

                                                        SHA512

                                                        2a46e0657e84481faf5c9d3de410884cb5c6e7b35039f5be04183cdac6c088cc42b12d0097e27836af14699e7815d794ca1cec80960833ab093b8dc6d44e2129

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\SysprepProvider.dll

                                                        Filesize

                                                        820KB

                                                        MD5

                                                        4dfa1eeec0822bfcfb95e4fa8ec6c143

                                                        SHA1

                                                        54251e697e289020a72e1fd412e34713f2e292cf

                                                        SHA256

                                                        901cea68c7a158a1d9c030d3939f8f72057d1cf2f902aec1bc1b22a0000c0494

                                                        SHA512

                                                        5f3f710bef75da8cddb6e40686d6a19f59fbc7d8a6842eaceb9a002ab284a91ecf48c352171e13f6a75366610988e67710439f1dde579311ebbb3cd9e4751aa4

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\TransmogProvider.dll

                                                        Filesize

                                                        1.3MB

                                                        MD5

                                                        c1c56a9c6ea636dbca49cfcc45a188c3

                                                        SHA1

                                                        d852e49978a08e662804bf3d7ec93d8f6401a174

                                                        SHA256

                                                        b20b3eb2df22998fd7f9ff6898ba707d6b8833a8274719a5e09d5148d868faaf

                                                        SHA512

                                                        f6db05e4644d734f81c2461e4ad49c4e81880c9e4beee13dbbda923360ef6cf4821fccd9040671b86ab2cd8c85fc313c951c1a69e4df14d94268753ce7ae5b2e

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\UnattendProvider.dll

                                                        Filesize

                                                        256KB

                                                        MD5

                                                        7c61284580a6bc4a4c9c92a39bd9ea08

                                                        SHA1

                                                        4579294e3f3b6c03b03b15c249b9cac66e730d2a

                                                        SHA256

                                                        3665872e68264bbf3827c2bf0cfa60124ea1d87912728f2fc3685dce32855cb8

                                                        SHA512

                                                        b30b89d0d5e065042811d6ff397d226877ff698aeb1153681692aedabe3730e2f3746ad9d70e3120e336552bab880644f9ead0c91a451197a8f0977a2126a0fe

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\Vhdprovider.dll

                                                        Filesize

                                                        596KB

                                                        MD5

                                                        8a655555544b2915b5d8676cbf3d77ab

                                                        SHA1

                                                        5a7529f8a6d50d3f4e13b2e3a0585f08eb0511a2

                                                        SHA256

                                                        d3a2dd7d47bfbb3897b927d1b7230b5b12e5fd7315d687458de15fbb08fb7e27

                                                        SHA512

                                                        c6da649ae3c3688065b37bccfb5525ade25ba7bc3b163ad7d61f3b3d1c4957c8fd6c9f2bf23b0dbc4fffe32e980acb5a5d3895b8a012c5ed086e3e38caee2e93

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\WimProvider.dll

                                                        Filesize

                                                        672KB

                                                        MD5

                                                        bcf8735528bb89555fc687b1ed358844

                                                        SHA1

                                                        5ef5b24631d2f447c58b0973f61cb02118ae4adc

                                                        SHA256

                                                        78b742deddee8305ea06d77f296ad9fe0f4b4a27d71b34dcdff8ae199364790c

                                                        SHA512

                                                        8b2be4e9a4334a5fc7f7c58579c20974c9194b771f7a872fd8e411d79f45fc5b7657df4c57ad11acb915d5ea5d1f0583c8a981b2c05104e3303b3ee1469b93f5

                                                      • C:\Users\Admin\AppData\Local\Temp\1D5D5C5F-50C6-48A5-AAA3-F4EEE84B9773\dismprov.dll

                                                        Filesize

                                                        292KB

                                                        MD5

                                                        2ac64cc617d144ae4f37677b5cdbb9b6

                                                        SHA1

                                                        13fe83d7489d302de9ccefbf02c7737e7f9442f9

                                                        SHA256

                                                        006464f42a487ab765e1e97cf2d15bfa7db76752946de52ff7e518bc5bbb9a44

                                                        SHA512

                                                        acdb2c9727f53889aa4f1ca519e1991a5d9f08ef161fb6680265804c99487386ca6207d0a22f6c3e02f34eaeb5ded076655ee3f6b4b4e1f5fab5555d73addfd7

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3vi1voyh.jsz.ps1

                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                      • C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll

                                                        Filesize

                                                        73KB

                                                        MD5

                                                        580d3b35dc77336eecc5e1bdea4cb8eb

                                                        SHA1

                                                        d46bb780cfeb5a3939047692a0d41c84636d03e8

                                                        SHA256

                                                        4fb71a099276c5dc82ef8f9e00817a2199857cc21e2e9ce94dd62f8ff11af6d2

                                                        SHA512

                                                        6229a7f2086668150dac81d99ea5b2b84fae08dc4fd65aae48ef1e7bdaea6d5130b0e2b24ffb9ff8281349d493db9d2aec9f396cccebb41bde21e0d71ea9418c

                                                      • C:\Windows\Logs\DISM\dism.log

                                                        Filesize

                                                        17KB

                                                        MD5

                                                        b89fc92cdf8a956790a50966cd7c6565

                                                        SHA1

                                                        39ee0bcfe2792f2de32607084fe008e39af96598

                                                        SHA256

                                                        202652e9611655fc07c74c13a081ae3614da3eaec2f98e989b9427330974565f

                                                        SHA512

                                                        1b389737ac39870f7f78c85a9fca53570f255876d6fb3419c2b9a050c2a8d6df992373e40b3009b035cf492314854fc4d400b0c13bea2922ee35cf314b15124a

                                                      • C:\Windows\Logs\DISM\dism.log

                                                        Filesize

                                                        23KB

                                                        MD5

                                                        78b734258836c8af7e964f42cd6a73c1

                                                        SHA1

                                                        042f6c19f1d63176a0e532823f36a926a7d02676

                                                        SHA256

                                                        aeaefc96467687c74646e73d1ab8a830ad6def075332c00b985037ffd2cb6055

                                                        SHA512

                                                        4ed286e20c116e53de8d87c18974c910f36832d59d441b6bda21ad533aab94a5a965f21e44dcc8dc2bbeba5f65fe3302a11454a8390478d8255b967053d4a693

                                                      • memory/1520-940-0x000000006F780000-0x000000006F7CC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2208-918-0x00000000055A0000-0x00000000058F7000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/2208-922-0x000000006F780000-0x000000006F7CC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2452-877-0x0000000004F60000-0x000000000558A000-memory.dmp

                                                        Filesize

                                                        6.2MB

                                                      • memory/2452-910-0x00000000073C0000-0x00000000073DA000-memory.dmp

                                                        Filesize

                                                        104KB

                                                      • memory/2452-891-0x0000000005D70000-0x0000000005DBC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2452-890-0x0000000005D30000-0x0000000005D4E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/2452-889-0x00000000058D0000-0x0000000005C27000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/2452-904-0x00000000076D0000-0x0000000007D4A000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2452-880-0x0000000005860000-0x00000000058C6000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/2452-879-0x0000000005780000-0x00000000057E6000-memory.dmp

                                                        Filesize

                                                        408KB

                                                      • memory/2452-878-0x0000000004EB0000-0x0000000004ED2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                      • memory/2452-903-0x0000000006D30000-0x0000000006DD4000-memory.dmp

                                                        Filesize

                                                        656KB

                                                      • memory/2452-876-0x0000000002540000-0x0000000002576000-memory.dmp

                                                        Filesize

                                                        216KB

                                                      • memory/2452-893-0x000000006F780000-0x000000006F7CC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2452-902-0x0000000006D00000-0x0000000006D1E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/2452-892-0x0000000006310000-0x0000000006344000-memory.dmp

                                                        Filesize

                                                        208KB

                                                      • memory/2452-909-0x00000000072E0000-0x00000000072EE000-memory.dmp

                                                        Filesize

                                                        56KB

                                                      • memory/2452-908-0x00000000072A0000-0x00000000072B1000-memory.dmp

                                                        Filesize

                                                        68KB

                                                      • memory/2452-907-0x0000000007320000-0x00000000073B6000-memory.dmp

                                                        Filesize

                                                        600KB

                                                      • memory/2452-906-0x0000000007110000-0x000000000711A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/2452-905-0x0000000007090000-0x00000000070AA000-memory.dmp

                                                        Filesize

                                                        104KB

                                                      • memory/2588-1052-0x0000000036BE0000-0x0000000036BF0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                      • memory/2588-1202-0x0000000070C80000-0x0000000071226000-memory.dmp

                                                        Filesize

                                                        5.6MB

                                                      • memory/2588-1203-0x0000000070C00000-0x0000000070C7E000-memory.dmp

                                                        Filesize

                                                        504KB

                                                      • memory/2588-1206-0x0000000071230000-0x0000000072C2B000-memory.dmp

                                                        Filesize

                                                        26.0MB

                                                      • memory/2588-1204-0x0000000070B80000-0x0000000070BFA000-memory.dmp

                                                        Filesize

                                                        488KB

                                                      • memory/2588-1205-0x0000000070B20000-0x0000000070B79000-memory.dmp

                                                        Filesize

                                                        356KB