d285b5242f4583d49c63a7c7f83a72f082ab395f9eaff674ff56c8d2d0fa063d

Analysis

max time kernel
225s
max time network
230s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_1001_ld.exe
Size 2.5MB
Sample240929-2tvtwathmr
SHA256 d285b5242f4583d49c63a7c7f83a72f082ab395f9eaff674ff56c8d2d0fa063d
MD5 a64bd549d95bfc8be592833460f79fcc
SHA1 0aeeb9507ed39f14d82149c56011ec3aaed1bec9
SHA512 767bffb8861e81ce61cfec5b0462f6a62cf86d9fca8411126b6ee3f43bc7fccbbffae8fafe293e9c227f297d82562d70940b441f9d541e35b66b972f2b79fdae
SSDEEP 49152:INfatughHaKLIKN1cueXlaYbsISTb/am5B8y6sEUhSSwoUK:Ila4ghHaKMu2IYbsIW/amj8yF8S
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011\FuncName = "WVTAsn1SealingSignatureAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.3\DefaultId = "{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002\FuncName = "WVTAsn1SpcFinancialCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007\FuncName = "WVTAsn1SpcSpOpusInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCertPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverInitializePolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverInitializePolicy"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002\FuncName = "WVTAsn1SpcFinancialCriteriaInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004\FuncName = "WVTAsn1SpcPeImageDataDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\FuncName = "DecodeRecipientID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
2916	icacls.exe
3228	icacls.exe
1556	takeown.exe
4100	takeown.exe
3916	icacls.exe
2628	takeown.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2916	icacls.exe
3228	icacls.exe
1556	takeown.exe
4100	takeown.exe
3916	icacls.exe
2628	takeown.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer9_ens_1001_ld.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
148	discord.com
149	discord.com

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\msvcp100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPLoggerCtl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-util-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetLwfUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletion.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-locale-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxDDR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Widgets.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBTest.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxDDR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5OpenGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\comregister.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\dpinst_86.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSupLib.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-interlocked-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-utility-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDD.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-file-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-synch-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-environment-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDTrace.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup-PreW10.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdp6Uninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcr120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-synch-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_V2_utils.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ldutils.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libcurl.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuthSimple.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxGuestPropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxRes.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l2-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\EGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\capi.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxProxyStub.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-processthreads-l1-1-1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-rtlsupport-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-convert-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAutostartSvc.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-time-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\dasync.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-locale-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDragAndDropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSDL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VirtualBoxVM.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-localization-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxCAPI.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\DbgPlugInDiggers.dll	dnrepairer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Executes dropped EXE 15 IoCs

pid	Process
5084	LDPlayer.exe
3688	dnrepairer.exe
2872	dismhost.exe
4764	Ld9BoxSVC.exe
4944	driverconfig.exe
2376	dnplayer.exe
2628	Ld9BoxSVC.exe
4724	vbox-img.exe
3016	vbox-img.exe
1888	vbox-img.exe
948	Ld9BoxHeadless.exe
336	Ld9BoxHeadless.exe
4116	Ld9BoxHeadless.exe
2120	Ld9BoxHeadless.exe
4684	Ld9BoxHeadless.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1784	sc.exe
2148	sc.exe
4196	sc.exe
1580	sc.exe
4168	sc.exe
2020	sc.exe
3116	sc.exe
844	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
3688	dnrepairer.exe
3688	dnrepairer.exe
3688	dnrepairer.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
2872	dismhost.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4764	Ld9BoxSVC.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
2864	regsvr32.exe
3980	regsvr32.exe
3980	regsvr32.exe
3980	regsvr32.exe
3980	regsvr32.exe
3980	regsvr32.exe
3980	regsvr32.exe
3980	regsvr32.exe
3980	regsvr32.exe
2436	regsvr32.exe
2436	regsvr32.exe
2436	regsvr32.exe
2436	regsvr32.exe
2436	regsvr32.exe
2436	regsvr32.exe
2436	regsvr32.exe
2436	regsvr32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_1001_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dism.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8084-11E9-B185-DBE296E54799}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3618-4EBC-B038-833BA829B4B2}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-48DF-438D-85EB-98FFD70D18C9}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1640-41F9-BD74-3EF5FD653250}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3E8A-11E9-825C-AB7B2CABCE23}\ = "IChoiceFormValue"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CC7B-431B-98B2-951FDA8EAB89}\NumMethods\ = "31"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-DAD4-4496-85CF-3F76BCB3B5FA}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-61D9-4940-A084-E6BB29AF3D83}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-FEBE-4049-B476-1292A8E45B09}\NumMethods\ = "29"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-DAD4-4496-85CF-3F76BCB3B5FA}\ = "ISnapshot"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FD1C-411A-95C5-E9BB1414E632}\ = "IPerformanceMetric"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9070-4F9C-B0D5-53054496DBE0}\NumMethods\ = "18"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ldmnq.ldbk\Shell	LDPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4453-4F3E-C9B8-5686939C80B6}\TypeLib	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1EC6-4883-801D-77F56CFD0103}\ = "INetworkAdapterChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6E0B-492A-A8D0-968472A94DC7}\NumMethods\ = "15"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D545-44AA-8013-181B8C288554}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B7DB-4616-AAC6-CFB94D89BA78}\ = "IGuestProcessInputNotifyEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B5BB-4316-A900-5EB28D3413DF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F4C4-4020-A185-0D2881BCFA8B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CF37-453B-9289-3B0F521CAF27}\TypeLib	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-AE84-4B8E-B0F3-5C20C35CAAC9}\ = "IStorageDeviceChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C196-4D26-B8DB-4C8C389F1F82}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0002-4B81-0077-1DCB004571BA}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-604D-11E9-92D3-53CB473DB9FB}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CD54-400C-B858-797BCB82570E}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9536-4EF8-820E-3B0E17E5BBC8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5A1D-43F1-6F27-6A0DB298A9A8}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AC97-4C16-B3E2-81BD8A57CC27}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F4F4-4DD0-9D30-C89B873247EC}\ = "IGuestMultiTouchEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-00C2-4484-0077-C057003D9C90}\ = "IInternalMachineControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-5F86-4D65-AD1B-87CA284FB1C8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ldmnq.apk\Shell\Open	LDPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8384-11E9-921D-8B984E28A686}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-be30-49c0-b315-e9749e1bded1}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1F04-4191-AA2F-1FAC9646AE4C}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E9BB-49B3-BFC7-C5171E93EF38}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{20191216-9CEE-493C-B6FC-64FFE759B3C9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-735F-4FDE-8A54-427D49409B5F}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1C58-440C-BB7B-3A1397284C7B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-929C-40E8-BF16-FEA557CD8E7E}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F4C4-4020-A185-0D2881BCFA8B}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-EE61-462F-AED3-0DFF6CBF9904}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-32E7-4F6C-85EE-422304C71B90}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0002-4B81-0077-1DCB004571BA}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-659C-488B-835C-4ECA7AE71C6C}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-EABD-4FA6-960A-F1756C99EA1C}\NumMethods\ = "14"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4737-457B-99FC-BC52C851A44F}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-486E-472F-481B-969746AF2480}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80F6-4266-8E20-16371F68FA25}\TypeLib	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6E0B-492A-A8D0-968472A94DC7}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-394D-44D3-9EDB-AF2C4472C40A}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1C58-440C-BB7B-3A1397284C7B}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-47C7-4A3F-AAE1-1B516817DB41}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6679-422A-B629-51B06B0C6D93}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7619-41AA-AECE-B21AC5C1A7E6}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D4FC-485F-8613-5AF88BFCFCDC}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D612-47D3-89D4-DB3992533948}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-477A-2497-6759-88B8292A5AF0}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E4B1-486A-8F2E-747AE346C3E9}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-394d-44d3-9edb-af2c4472c40a}	Ld9BoxSVC.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2284	LDPlayer9_ens_1001_ld.exe
2284	LDPlayer9_ens_1001_ld.exe
2284	LDPlayer9_ens_1001_ld.exe
2284	LDPlayer9_ens_1001_ld.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
3688	dnrepairer.exe
3688	dnrepairer.exe
220	powershell.exe
220	powershell.exe
1756	powershell.exe
1756	powershell.exe
4136	powershell.exe
4136	powershell.exe
5084	LDPlayer.exe
5084	LDPlayer.exe
2284	LDPlayer9_ens_1001_ld.exe
2284	LDPlayer9_ens_1001_ld.exe
2148	msedge.exe
2148	msedge.exe
636	msedge.exe
636	msedge.exe
2228	msedge.exe
2228	msedge.exe
1688	identity_helper.exe
1688	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2376	dnplayer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeDebugPrivilege	5084	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	5084	LDPlayer.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2376	dnplayer.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
2376	dnplayer.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 5084	2284	LDPlayer9_ens_1001_ld.exe	103
PID 2284 wrote to memory of 5084	2284	LDPlayer9_ens_1001_ld.exe	103
PID 2284 wrote to memory of 5084	2284	LDPlayer9_ens_1001_ld.exe	103
PID 5084 wrote to memory of 3688	5084	LDPlayer.exe	108
PID 5084 wrote to memory of 3688	5084	LDPlayer.exe	108
PID 5084 wrote to memory of 3688	5084	LDPlayer.exe	108
PID 3688 wrote to memory of 3068	3688	dnrepairer.exe	109
PID 3688 wrote to memory of 3068	3688	dnrepairer.exe	109
PID 3688 wrote to memory of 3068	3688	dnrepairer.exe	109
PID 3068 wrote to memory of 3592	3068	net.exe	111
PID 3068 wrote to memory of 3592	3068	net.exe	111
PID 3068 wrote to memory of 3592	3068	net.exe	111
PID 3688 wrote to memory of 2416	3688	dnrepairer.exe	112
PID 3688 wrote to memory of 2416	3688	dnrepairer.exe	112
PID 3688 wrote to memory of 2416	3688	dnrepairer.exe	112
PID 3688 wrote to memory of 1884	3688	dnrepairer.exe	113
PID 3688 wrote to memory of 1884	3688	dnrepairer.exe	113
PID 3688 wrote to memory of 1884	3688	dnrepairer.exe	113
PID 3688 wrote to memory of 4196	3688	dnrepairer.exe	114
PID 3688 wrote to memory of 4196	3688	dnrepairer.exe	114
PID 3688 wrote to memory of 4196	3688	dnrepairer.exe	114
PID 3688 wrote to memory of 4652	3688	dnrepairer.exe	115
PID 3688 wrote to memory of 4652	3688	dnrepairer.exe	115
PID 3688 wrote to memory of 4652	3688	dnrepairer.exe	115
PID 3688 wrote to memory of 2880	3688	dnrepairer.exe	116
PID 3688 wrote to memory of 2880	3688	dnrepairer.exe	116
PID 3688 wrote to memory of 2880	3688	dnrepairer.exe	116
PID 3688 wrote to memory of 1072	3688	dnrepairer.exe	117
PID 3688 wrote to memory of 1072	3688	dnrepairer.exe	117
PID 3688 wrote to memory of 1072	3688	dnrepairer.exe	117
PID 3688 wrote to memory of 868	3688	dnrepairer.exe	118
PID 3688 wrote to memory of 868	3688	dnrepairer.exe	118
PID 3688 wrote to memory of 868	3688	dnrepairer.exe	118
PID 3688 wrote to memory of 4100	3688	dnrepairer.exe	119
PID 3688 wrote to memory of 4100	3688	dnrepairer.exe	119
PID 3688 wrote to memory of 4100	3688	dnrepairer.exe	119
PID 3688 wrote to memory of 3916	3688	dnrepairer.exe	121
PID 3688 wrote to memory of 3916	3688	dnrepairer.exe	121
PID 3688 wrote to memory of 3916	3688	dnrepairer.exe	121
PID 3688 wrote to memory of 2628	3688	dnrepairer.exe	123
PID 3688 wrote to memory of 2628	3688	dnrepairer.exe	123
PID 3688 wrote to memory of 2628	3688	dnrepairer.exe	123
PID 3688 wrote to memory of 2916	3688	dnrepairer.exe	125
PID 3688 wrote to memory of 2916	3688	dnrepairer.exe	125
PID 3688 wrote to memory of 2916	3688	dnrepairer.exe	125
PID 3688 wrote to memory of 1920	3688	dnrepairer.exe	127
PID 3688 wrote to memory of 1920	3688	dnrepairer.exe	127
PID 3688 wrote to memory of 1920	3688	dnrepairer.exe	127
PID 1920 wrote to memory of 2872	1920	dism.exe	129
PID 1920 wrote to memory of 2872	1920	dism.exe	129
PID 3688 wrote to memory of 2020	3688	dnrepairer.exe	130
PID 3688 wrote to memory of 2020	3688	dnrepairer.exe	130
PID 3688 wrote to memory of 2020	3688	dnrepairer.exe	130
PID 3688 wrote to memory of 3116	3688	dnrepairer.exe	132
PID 3688 wrote to memory of 3116	3688	dnrepairer.exe	132
PID 3688 wrote to memory of 3116	3688	dnrepairer.exe	132
PID 3688 wrote to memory of 844	3688	dnrepairer.exe	134
PID 3688 wrote to memory of 844	3688	dnrepairer.exe	134
PID 3688 wrote to memory of 844	3688	dnrepairer.exe	134
PID 3688 wrote to memory of 4764	3688	dnrepairer.exe	136
PID 3688 wrote to memory of 4764	3688	dnrepairer.exe	136
PID 3688 wrote to memory of 4780	3688	dnrepairer.exe	137
PID 3688 wrote to memory of 4780	3688	dnrepairer.exe	137
PID 3688 wrote to memory of 2864	3688	dnrepairer.exe	138

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1001_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1001_ld.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284
- C:\LDPlayer\LDPlayer9\LDPlayer.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=1001 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=721614
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:2416
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:1884
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4196
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4652
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1072
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:868
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4100
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3916
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2628
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2916
  - - C:\Windows\SysWOW64\dism.exe
      C:\Windows\system32\dism.exe /Online /English /Get-Features
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\dismhost.exe {409B4B90-65A9-4C56-838C-BE6CE3AF3448}
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2872
  - - C:\Windows\SysWOW64\sc.exe
      sc query HvHost
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmms
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3116
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmcompute
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:844
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4764
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:4780
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2864
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3980
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2436
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1784
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2148
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:220
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4136
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1556
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4bUcwDd53d
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5e1446f8,0x7ffb5e144708,0x7ffb5e144718
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5104 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14758983662855572632,7889700593480086447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
    3⤵
    PID:5792
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\\dnplayer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4196
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1580
- - C:\Windows\SysWOW64\sc.exe
    sc query vmcompute
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4168
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    - Executes dropped EXE
    PID:4724
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:3016
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ldplayer.net/blog/how-to-enable-vt.html
    3⤵
    PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb5e1446f8,0x7ffb5e144708,0x7ffb5e144718
      4⤵
      PID:5652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x2ec
1⤵
PID:3764

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2628
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
1⤵
PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 51KB
SHA256 5ba02418771a276ac3ecd2d0300054c2b210ebc673ef3e37d2a82c2c21c3ea71
MD5 fe8c8dfd0765eff8425e336b69d0a725
SHA1 072d2f4560d97ca292662b55d4fcdf2f72dad4fe
SHA512 d9e1920bfa69bd1d7b9ce38882bf23b495cd52c498f381de522fcf883d544229b8c6db972b651fd1aabfd43cfaca26f4cfa388afe50af175322c8868ad26fcb2
SSDEEP 1536:dPGyMprkvxXb0HOaf2FQM4P7HxfjK7ZCx0p:IyVpVaYQM4PtKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnmultiplayer.exe

Path C:\LDPlayer\LDPlayer9\dnmultiplayer.exe
Size 1.3MB
SHA256 3cbc7746de86b79b83432199755a9400506c92562944d1a04d3db0878cc76c8a
MD5 d079f4f02596473852b6875e74f4035b
SHA1 17c4df4c9202bf9046c3e1b7d3d06e6ec06873fb
SHA512 764a3f72d3397e916fe54d1bb6a32e81609e104d36cb5a3bbd3037af1435441a1692a468e461ed40944279b7b0a5664e6b70e9e9c8f7f3e5d950fa0df96bde0e
SSDEEP 24576:p46hclcN9ES9PKZEkM2lItSMUnKx50DRkpO51:pnc2vES9MEbSMUP51
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnplayer.exe

Path C:\LDPlayer\LDPlayer9\dnplayer.exe
Size 3.7MB
SHA256 8c159037a007c8430e8f4acc5f3e143191e96adc596549aedf4e61d8973f694c
MD5 ac43f5c04b6f45df325709a1fa8590b9
SHA1 7542a4cf17c4b7a24a539339e414e0d5cbfc0005
SHA512 596a97738ed3b05f683afe7724f02efd0e4767d09d006755b27adce7db48aae8cd83f0db5c472991ff7f8603e8d9e0f99149a17b67570d1e36ee591cc1d399d0
SSDEEP 49152:/BlMavZtpMC9N++10D6tlBLNxH9uOg/Y5kHMZR2Mne6VpatlNu0avWx/osvd:JlMiZc+10DsBLNxdcYGHMNvVpa
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 41.9MB
SHA256 a323ceded9ce3ef78cfa2e0de4ab82b3b0e42d63505b14e19adb773f40e25649
MD5 2bd10b6472284cef4983afc4e4023ddb
SHA1 5e948978b29b9595d4401c4f2a2fc001a1552b47
SHA512 425c1b48119e45e41da19c2a1cf0b1b3f4a95fa420287330ae5f2e988223218ff803a764327e3566d5c315fa6b6e36740fa1f4bc2d6436ccd78f6b8d6126e5dd
SSDEEP 786432:JD2LYCsXMCK3g9cHgEw30nlKsGAIKuUEDqrfsVrZmxSXr2Oka/:UPiMRfg+KsGAIMEWrEHmMXaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.6MB
SHA256 d0282cbdf42ed19237d67fb9a95fccfce37adf021693dac65b22918c3730116e
MD5 61d07dd6b772844afaf6e87dfec601b9
SHA1 5d2cbeb0a9c45fd9dd4ddc198418ea960ff2ec65
SHA512 c9f685f0ad3d14fa51917986dcb0681e37255f8c8a03e8e6398c223130e549a6f64214036bbf802908590d8ea9cc17d7f3af2b825641fac7739f9befe34975c3
SSDEEP 98304:O8ig03oOpq85eEzZ2AZxHqeLOed24qcGSAvyJKEeeg2mWp8l5h8H7WdzlpCbOcXr:1ig03h08D/UwOq19uGKogZn07WdzlkXr
MD5 SHA1 SHA512 SSDEEP

Submit Download

NanumGothicLight.otf

Path C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf
Size 314KB
SHA256 153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2
MD5 e2e37d20b47d7ee294b91572f69e323a
SHA1 afb760386f293285f679f9f93086037fc5e09dcc
SHA512 001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901
SSDEEP 6144:6kyWbmIwXcviKE2SmwxjVGZ/YKNSfuWBl/3DAJHu46ldvtQqu+EGi:6kXbmBZjjaHN2uQlPDAJHu46l16tGi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7za.exe

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe
Size 652KB
SHA256 a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326
MD5 ad9d7cbdb4b19fb65960d69126e3ff68
SHA1 dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d
SHA512 f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7
SSDEEP 12288:aCEg6ksPgamGycPycplunzCke+tMU0gKVDrnI/Anky3ZDHg:aCCks4ECO8zfeJ3rnI/A93FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

cximagecrt.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll
Size 1.5MB
SHA256 91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f
MD5 66df6f7b7a98ff750aade522c22d239a
SHA1 f69464fe18ed03de597bb46482ae899f43c94617
SHA512 48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e
SSDEEP 24576:gzpjfQWnxImuy/53F9F2LZFTSnvZYfHfE0jr8HDYn8HyTdUZ8:g1zQUgVDjwHcn8STW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll
Size 2.0MB
SHA256 c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889
MD5 01c4246df55a5fff93d086bb56110d2b
SHA1 e2939375c4dd7b478913328b88eaa3c91913cfdc
SHA512 39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196
SSDEEP 49152:OvQ/qpyr0kvV+caeJQaNmAtGJv95T8Wrhc1CPwDv3uFfJvBQBGWj:OvQ/qpyr0kvVpbQQGfF851CPwDv3uFfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll
Size 442KB
SHA256 1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334
MD5 2d40f6c6a4f88c8c2685ee25b53ec00d
SHA1 faf96bac1e7665aa07029d8f94e1ac84014a863b
SHA512 4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779
SSDEEP 6144:QQP8Eg6CNxIZHm8Krm0Druftib83NzDR5W1D8/XFIFWTGLvwOir:Q632xIZHmJm3A49mCQr07r
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll
Size 1.2MB
SHA256 2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e
MD5 ba46e6e1c5861617b4d97de00149b905
SHA1 4affc8aab49c7dc3ceeca81391c4f737d7672b32
SHA512 bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6
SSDEEP 24576:TPD+KpPpmuLM3F2f0LXBrkdfbnaJepHm3E7xL/pN1ecj6UtP9RqbNGhqdyY:DguLM3XiGSHt/jBj6UtP9RqkhqdyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssh2.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll
Size 192KB
SHA256 8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f
MD5 52c43baddd43be63fbfb398722f3b01d
SHA1 be1b1064fdda4dde4b72ef523b8e02c050ccd820
SHA512 04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28
SSDEEP 3072:5dv7LPsQZTaBdJAnX0x8YJqZ/2NTBf4+oGlM0W7Ubof:53VaBdmX0x8YJqZ/2NTBQ+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll
Size 511KB
SHA256 b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd
MD5 e8fd6da54f056363b284608c3f6a832e
SHA1 32e88b82fd398568517ab03b33e9765b59c4946d
SHA512 4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b
SSDEEP 12288:PnsHqH+cOyFNn/JliB0B1pDX7k6CAlW711IWU2lvzh1:/sHzcfZG7QWU2lvzh1
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp110.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll
Size 522KB
SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
MD5 3e29914113ec4b968ba5eb1f6d194a0a
SHA1 557b67e372e85eb39989cb53cffd3ef1adabb9fe
SHA512 75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43
SSDEEP 12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr110.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll
Size 854KB
SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
SSDEEP 12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll
Size 283KB
SHA256 72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750
MD5 0054560df6c69d2067689433172088ef
SHA1 a30042b77ebd7c704be0e986349030bcdb82857d
SHA512 418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0
SSDEEP 6144:wLFThsrlPqhXPXpwiKQQg9L8YMcoIyHJPNlK9//ualAcQYLUIaGdY7Y1XiRdQMJ7:aFThsrlPqhXPXpwiHQg9L8xcoIyHJfKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp120.dll

Path C:\LDPlayer\LDPlayer9\msvcp120.dll
Size 444KB
SHA256 891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9
MD5 50260b0f19aaa7e37c4082fecef8ff41
SHA1 ce672489b29baa7119881497ed5044b21ad8fe30
SHA512 6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d
SSDEEP 12288:aZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77m:a/8wVwHZFTwFOOos3Ooc8DHkC2e77m
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\LDPlayer\LDPlayer9\msvcr120.dll
Size 947KB
SHA256 2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112
MD5 50097ec217ce0ebb9b4caa09cd2cd73a
SHA1 8cd3018c4170072464fbcd7cba563df1fc2b884c
SHA512 ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058
SSDEEP 12288:6BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJSH:SmFyjLF847eiWWcoGZVOIxh/WxIAIbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

phones.data

Path C:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 639B
SHA256 e56312beee46b8fdc5bd14472591eb6f84c011b94ff7986f886dd4cecd8c4b2f
MD5 2fbc89d40acc6ce80555ceaffe93c610
SHA1 5d6e814868948d8c1ea4c01efd0d5c872a4036e9
SHA512 f083d671a99280a6bb41f61b01361a9726b7fa83c9983cc208abe6ac4fcb4bd8aafabfb419feaf26454f3e661c68cea2de81801f76c9e11bcf7f814942d0b241
MD5 SHA1 SHA512

Submit Download

sdcard.vmdk

Path C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk
Size 35.1MB
SHA256 f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6
MD5 4d592fd525e977bf3d832cdb1482faa0
SHA1 131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef
SHA512 afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77
SSDEEP 768:oUakI3gnG30jnzln5pxn7en1njvfVnNnXnLA0Y3bb/qWE6I0eYyU:RIgGCzlt7e1T9NXLQX/qWE6I0eYyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Roboto-Regular.otf

Path C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
Size 1KB
SHA256 07e274ddb50a89722620ecfa2e8879f88c8ccb1421dbaa173481a075983917a1
MD5 a466d0867a89908c842922610af5d0ce
SHA1 ae531cf23e856cc212d13c28f15796203daa5aa0
SHA512 c9b15bbe7da9ec9d48ec547d9a868329bc551a2d4f81e0d96df025e657e01c35d4ccfa259471eb3c962b8e5a153b094d822b577b26783795ad1bec69611d7020
MD5 SHA1 SHA512

Submit Download

B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Size 2KB
SHA256 86617d1de96e108905388b85b22c098b2bffc5d8c3cd13a1f659cfbca817143b
MD5 9f462843b35cf465cd8d1c8df3896797
SHA1 a9fd1e6fb7364253017f63e7d6e0277b2c424d36
SHA512 14c72db9fe5b7782848c1f39d9b8c3ba1b583e974ec49c25314bc2bc9022a236323575f384698f9aa1d67d0a674c5e8dff4bec665f5b760b939d743b86d3347c
MD5 SHA1 SHA512

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 7d7e57105a56cb6f21822265dddf5a7958641b9ea513046698261d426b702505
MD5 fab2b7c6edefbe310b4ab974ae858540
SHA1 c71c69fc5027460e42a8a2afa82223302fff4add
SHA512 97daed72cdaca3d0f05c5d0f75069f6b1b29c20ec9f2915f5f05c2aaccfdae7dc962a4b2283a25addf5399f90876d0b8c84a5b455f597c285aec0025ab82d669
MD5 SHA1 SHA512

Submit Download

75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
Size 434B
SHA256 0be4180297315e80d08bce340c82fea62c0ec01984218009510c4a705f3bb9c8
MD5 a12bdf702f81aaf3fbe5e782f30ff1ab
SHA1 afb8d9dae0844a2cb7da2399a7a2cb123d02a3f3
SHA512 bc36029a05fc03cf67c97cf396f849740494999aab7948f596ff33c3584c133e97b2a36a83bb4f31c55f3e87069e38837060b60570f3f0b935b008b3310787e4
MD5 SHA1 SHA512

Submit Download

B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Size 458B
SHA256 e7b9b7d15762857e3d70239d27f919950403f8550808ba5a8661003e0c6a389b
MD5 29e025a58fcfa2cbfaeb65540eeb79c4
SHA1 0f4618189f6e3f43d4d26e592795008ff3d2eec1
SHA512 edc089a9e724ed51e6c4705d5549fce51a5ced4b339bbea4eeaa4b4ea2a8fd480b8baaa45db1ae8dc0a6457a4423eac8681c41580ca93b3ec0ff970c1f8b68ed
MD5 SHA1 SHA512

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 6428933c270ac637f0f14d09b5f66004eb9bcdf5d12c0d70c0d370a4534a7a01
MD5 5e9af8709b9647246e3e37542ff4da11
SHA1 0bdd34205f9780d39b320a71867f020b8ea1b5c4
SHA512 a61ddd7206abfae5b9e6494d4166caefdcef900180117b349e70fe4ffd40ceef50e7aed0ac7ee504f9056e537c7a820908e3295398da36a4a7f42d42d1b7afcf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
MD5 b80cf20d9e8cf6a579981bfaab1bdce2
SHA1 171a886be3a882bd04206295ce7f1db5b8b7035e
SHA512 0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814
MD5 7006aacd11b992cd29fca21e619e86ea
SHA1 f224b726a114d4c73d7379236739d5fbb8e7f7b7
SHA512 6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d
MD5 SHA1 SHA512

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b
Size 28KB
SHA256 7a5badeaf406c2e1cd4e1108f4169f5312d5aa80dd6d9402a19f45bc9a138b4a
MD5 0b560304bf10a6590dc442467a25dfd1
SHA1 8921db42092b647c5c93e65896412e52399d62cf
SHA512 7500208e23712c6b0044b5c53dc51a4a5783be0adabb339b085767e626cdf06d1bae299e6cb5be80f63a18a6c13d1295ec4c3474c56c7d8699b91bf634a3c1c3
SSDEEP 384:x6gKCD7xSUe5/w4D3JYh2850Go7UsuEpVYcXGsr4J0QBd54U0xetY+ewmAxaPjMb:Ag1D7kPW4bqh2850dOcXFrm/LRedIalI
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054
Size 20KB
SHA256 bb862a8d484879925abff843e123e31149cb908092b0989fd9a27096c251514a
MD5 6c5eafccab3cf4e6b92dfbff01d675ab
SHA1 b459c7291910290b6c4a3f474781ea39ec8c3748
SHA512 2f626cca419b583e1dc84d30b9013e395937db596a299385a0f78700eee35ee39743ea8cc9d1d7176f32f0ddcb3c96b585d5fa0909571f9a883353b39ea55563
SSDEEP 384:Wydvlym5H612xPzsWlWfRy1+6f6n6t79nVMUAz7GB+CYcxw5yjDO6:FdvMM6kllf1B6nsMU4iBywL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5ab3a092a8fd397b0f83f9d57991fe782526b931f0fe0b0bb07eb4ff51179658
MD5 549475bef3d3fd7f21f0dc8261f14366
SHA1 a9e1880e3ceddeb85e4e4b880919929dba9bcc82
SHA512 e4ec248e6824d584b8140eaf95cb6162e3fd6abfccdafb700bb552839f727df015f64414627e47ca67cd2068d81e9eb1af13d468f08e2a5ec812c2595a0935bf
SSDEEP 96:nukk7+110gwpvWMoiVmdeHdpomD9tUWQyV+VDCziEwb:nukky1qgGWMX4g9tro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1ce628f24bc6b4112503a8607574344e5036e9c9e6febd4aead14b2854443140
MD5 4d060740aafc2f144e4b2befd7182404
SHA1 2936182bc6d1fdcacdc3d13dd1888943e3914983
SHA512 80c90210829ee1dfafd1baf257d3b89a339bff5410d2f9372c3efcf2a0533db81c56b186ed2cd56fb321d1217a2a334906996b5fcab326fd8d37f39e5c3af115
SSDEEP 192:nukk016oGWMCrud4OauMiTFATBMTgfQNtSrs2S9km/rFBY0zWYo85aMKkT1rDmng:nukF16lWF44OM80Ig+0YbWmTTZRo4/DJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f4e7ebd35979cce9776de072a232cec03666c9c67b1afeadbd77154309549bea
MD5 54122ec6f5ef05458bb2ed7c5872ab3a
SHA1 01e4bb7ba88116d6e00cb8f9fc7ca2a6f3c2a4a2
SHA512 e3dbf17e4ac5cd810be4b5f39fd5c9bcf6c118b8e624bfeeda7a74807a75b15b3e4af2663f56a982440df3bf96eb90892876efeb9c16865bc95f3a6b5053ca74
SSDEEP 96:nukkBC+110gwpvWMoiVmdeyrud41jdpo3wD9tUWQyV+VD7AiEwb:nukkBX1qgGWMCrud4h43q9trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 9d708e2b6687c0056f7979156122762824cfe5d8832f00ad0f3397e4d6af8b05
MD5 8122d0ac14134d09a94dc2df9fd8a525
SHA1 e117370bda4c5f1d22f3932d137a01ca69180cf1
SHA512 34a2be6436cb000d20b75e17a2723c14f9c6071b9a69ec6728de0a616addf0208553768070b049fd0402570fb7d0cd23ddf3f9e6a49d995ce6b7a05ff4213c4a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 3a6ec0913c48a421391822b0bfb8c0427524989859a3c318c25c126b6af93f4c
MD5 34f8899fb70509854e0a952c7c1eb181
SHA1 4b08ac6338c216b986dc370f9d2926388f0ee1cd
SHA512 2383295d8eaafa70e3812850dbdb4f14fbcc5538e46ff70031ab6962b6ae1d7def6abc2031a317f28d24224046d13254207002444774a0229998450f7f8fc96c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5ae178.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ae178.TMP
Size 370B
SHA256 ad6133de9960642177b8e3ba193e38339adf903f526e9614f788ff8ac352d4ee
MD5 68a4ab4b3da09366fe8fc43464619453
SHA1 e36da169938c0c91e3a68101a61942acb5589c23
SHA512 c3e2e4b794622c58264eb097ddbba8ded65d39b4bdc14f740b4b339c0bf0c42ddd86ebfbe957faeb929059e805d6a7610e0e203ae485caa9c9df89cccc6b3b44
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 bc1a34ef5b012dd2bbbbac7633573e12cc8b9a5ee826ae68623d906111483e75
MD5 9cc2a5279386e2c3f67fa8be57097c83
SHA1 25a78177fcc1667f944d57540093cd168885c35e
SHA512 724da6239300635104d8429cd533a3ef4fef345a83c9df5b06a7b3e13a2edb038405f585ea500598a4e8d8fd1e24686c49482bc2af5b57a8f16751b70eb67bff
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiyKlhe2RUUz06vvouidy0z:29iIxuERzA83h09RZxYiyKl1BzPvp0bX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 226bc314ecaf69d55251766c83786dd2aded1fa01c2930830289acf38a7ef191
MD5 c979bfc98a70c240cd4557b170c23606
SHA1 fa08f0380900fe53a9affb90aca65a08d45d69e8
SHA512 5a8228ed201905dfc8af97accd9991c8a595438abe91df906d83249d78981096e3abf77986ce25f57c4d8dc5696e4f4c24ba37ca8039d5b9eb0e8f591fccbe5f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiyKlhe2RUUz06vvpuidy0z:A9iIxuERzA83h09RZxYiyKl1BzPvI0bX
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppxProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\AppxProvider.dll
Size 554KB
SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
MD5 a7927846f2bd5e6ab6159fbe762990b1
SHA1 8e3b40c0783cc88765bbc02ccc781960e4592f3f
SHA512 1eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f
SSDEEP 6144:TiBcTKZ54SpjXqHKVM8GoxYJwUbdjQzFAPdi3tebF5yf+Q6yLn7xTPBc3:uBFXWUcyziktebF5nn
MD5 SHA1 SHA512 SSDEEP

Submit Download

AssocProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\AssocProvider.dll
Size 112KB
SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
MD5 94dc379aa020d365ea5a32c4fab7f6a3
SHA1 7270573fd7df3f3c996a772f85915e5982ad30a1
SHA512 998fd10a1f43024a2398491e3764748c0b990b37d8b3c820d281296f8da8f1a2f97073f4fd83543994a6e326fa7e299cb5f59e609358cd77af996175782eeaca
SSDEEP 1536:yV9TBLzWvVZtglIDIQdgDbEyuh9UHsTj2HUWli7HlzuTPxwQ:yH1uL6IdgDWjUHeEhyuTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

CbsProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\CbsProvider.dll
Size 875KB
SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
MD5 6ad0376a375e747e66f29fb7877da7d0
SHA1 a0de5966453ff2c899f00f165bbff50214b5ea39
SHA512 8a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18
SSDEEP 12288:kqe4tO+jP4PZxP2gv4MefWfN3bGJ0mqs7xBU99l7gghi000U:ko4+UP3P2pMefWfN3bGJpv7QLl7hi0M
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCore.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\DismCore.dll
Size 402KB
SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
MD5 b1f793773dc727b4af1648d6d61f5602
SHA1 be7ed4e121c39989f2fb343558171ef8b5f7af68
SHA512 66a92bff5869a56a7931d7ed9881d79c22ba741c55fb42c11364f037e1ec99902db2679b67a7e60cbf760740d5b47dcf1a6dcfae5ad6711a0bd7f086cc054eed
SSDEEP 6144:2pFC8Q92GEAjR53dcPFj2loO4KwbPnRKQo2:2pxQ92QjR5tEKCkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCorePS.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\DismCorePS.dll
Size 183KB
SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
MD5 a033f16836d6f8acbe3b27b614b51453
SHA1 716297072897aea3ec985640793d2cdcbf996cf9
SHA512 ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871
SSDEEP 1536:UA5jxij1/4CL6FFJbK1hipbLEXt0GAwlPat:UA5jAj1QCL6FFJ+1hipPEXtpXlY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismHost.exe

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\DismHost.exe
Size 142KB
SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
MD5 e5d5e9c1f65b8ec7aa5b7f1b1acdd731
SHA1 dbb14dcda6502ab1d23a7c77d405dafbcbeb439e
SHA512 7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc
SSDEEP 1536:16iNEP0SZpv0aVyo0rbRmiUwhjgPp9X6E79KfmeCUhNs4+Au0ceacoM1f/TnbsnG:1rEME0FgH6ERKf3/lb/Rw2siUuaqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismProv.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\DismProv.dll
Size 255KB
SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
MD5 490be3119ea17fa29329e77b7e416e80
SHA1 c71191c3415c98b7d9c9bbcf1005ce6a813221da
SHA512 6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13
SSDEEP 3072:cKvrcFu+XXythARfaBAUGNDBOZlUsJY/xL6LyzH7vt/MEhpw9nF:kFBXytcaCUGbOZlUsJaxO2z7vtxhK
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\DmiProvider.dll
Size 415KB
SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
MD5 ea8488990b95ce4ef6b4e210e0d963b2
SHA1 cd8bf723aa9690b8ca9a0215321e8148626a27d1
SHA512 56562131cbe5f0ea5a2508f5bfed88f21413526f1539fe4864ece5b0e03a18513f3db33c07e7abd7b8aaffc34a7587952b96bb9990d9f4efa886f613d95a5b1b
SSDEEP 6144:Hx/vIsFo3S/cEeMykrx++h0kra+gIEmHK:Hx/vrs0FeGxf7ZVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfuProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\FfuProvider.dll
Size 619KB
SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
MD5 df785c5e4aacaee3bd16642d91492815
SHA1 286330d2ab07512e1f636b90613afcd6529ada1e
SHA512 3566de60fe76b63940cff3579da94f404c0bc713f2476ba00b9de12dc47973c7c22d5eed1fd667d20cea29b3c3c4fa648e5f44667e8369c192a4b69046e6f745
SSDEEP 6144:Dl7JmNA6s7wJzYlfa4QsFIKDys3NvGvcIKifgRw/zJkwT/F0MOAYIfsA46ItKata:Dld6A67qjFVKVSw/au2A4DclSZkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

FolderProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\FolderProvider.dll
Size 59KB
SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
MD5 4f3250ecb7a170a5eb18295aa768702d
SHA1 70eb14976ddab023f85bc778621ade1d4b5f4d9d
SHA512 e9ce6cced5029d931d82e78e7e609a892bfe239096b55062b78e8ff38cce34ce6dd4e91efb41c4cd6ecf6017d098e4c9b13d6cb4408d761051468ee7f74bc569
SSDEEP 1536:sexLd+GGpAR1uFs4mrYNjTURz6dZiFj1EOt4Pf2:skUG+EIFRb9TURz8iFJEOt4n2
MD5 SHA1 SHA512 SSDEEP

Submit Download

GenericProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\GenericProvider.dll
Size 149KB
SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
MD5 ef7e2760c0a24453fc78359aea3d7869
SHA1 0ea67f1fd29df2615da43e023e86046e8e46e2e1
SHA512 be785ba6b564cc4e755b4044ae27f916c009b7d942fcd092aed2ae630b1704e8a2f8b4692648eed481a5eb5355fd2e1ef7f94f6fb519b7e1ff6fc3c5f1aaa06f
SSDEEP 3072:WvIVEykJhkBPNN9/Y/6xOi/xHVpbe01cPKZoq:WvsEyChkBPNN9NNDbeacPLq
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\IBSProvider.dll
Size 59KB
SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
MD5 120f0a2022f423fc9aadb630250f52c4
SHA1 826df2b752c4f1bba60a77e2b2cf908dd01d3cf7
SHA512 23e50735c06cef93d11873fc8e5e29fc63dcf3f01dc56822a17c11ca57bbfb10d46fac6351f84ba30050a16d6bd0744a08a4042a9743a6df87ac8a12e81e2764
SSDEEP 768:hANsBtL+LsOHEeZMG8c4cWamUMvyARy0VnrI3Lebvdqvp7UYr6wD1PQb8/:UmsLsOkeacfmDjZriSTU22P28/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImagingProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\ImagingProvider.dll
Size 218KB
SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
MD5 35e989a1df828378baa340f4e0b2dfcb
SHA1 59ecc73a0b3f55e43dace3b05ff339f24ec2c406
SHA512 c8d69e37c918881786a8fdab2a2c5d1632411b1f75082aeb3eb24a8ba5f93dcb39b3f4000e651f95452263525d98fd1d3cb834de93bed16fa6f92ef271c3a92a
SSDEEP 6144:SR2jvbWvfuzAWkVUtqlk7AlP1GB2wNBG6:SR2ymvkm2wNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntlProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\IntlProvider.dll
Size 296KB
SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
MD5 510e132215cef8d09be40402f355879b
SHA1 cae8659f2d3fd54eb321a8f690267ba93d56c6f1
SHA512 2f7b2ec0e94738838f755759cd35e20ab2138b8eca023ee6ef630ab83a3de1bc0792f12ea0d722abe9a6953626cbddf8ba55ea32fc794d2df677a0625e498ab0
SSDEEP 6144:D20d1ONlCQZ8RWbKJqHVp13hbTPaTUMPo+WKOLv:K0d1O7CQuRhJGjgUYWHLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\LogProvider.dll
Size 77KB
SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
MD5 815a4e7a7342224a239232f2c788d7c0
SHA1 430b7526d864cfbd727b75738197230d148de21a
SHA512 0c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349
SSDEEP 1536:X9mLBNlc4Rd1wbNA7elgn0+r+GEJ8a0qMX0Igx7DAJoNxPyCp:XMLlBRd1kSels+T8a0qMX0Igx7DAJoN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\MsiProvider.dll
Size 207KB
SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
MD5 9a760ddc9fdca758501faf7e6d9ec368
SHA1 5d395ad119ceb41b776690f9085f508eaaddb263
SHA512 59d095246b62a7777e7d2d50c2474f4b633a1ae96056e4a4cb5265ccf7432fed0ea5df9b350f44d70b55a726241da10f228d8b5cbee9b0890c0b9dc9e810b139
SSDEEP 3072:lAHjL5MM39qnOOL1QZaFsrMQ72dmTcWI+fByuc+RAuI/bB0MoutygIQlUoMIVWE:lAHfyMkraaSrGwnjfBIXbdtyyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\OSProvider.dll
Size 149KB
SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
MD5 db4c3a07a1d3a45af53a4cf44ed550ad
SHA1 5dea737faadf0422c94f8f50e9588033d53d13b3
SHA512 5182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde
SSDEEP 3072:mT/wD4tK821qqa4SzpVYJyAu27gH3MgDXGy:mTasK6LpVObgH9DX
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfflineSetupProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\OfflineSetupProvider.dll
Size 182KB
SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
MD5 9cd7292cca75d278387d2bdfb940003c
SHA1 bab579889ed3ac9cb0f124842c3e495cb2ec92ac
SHA512 ebf96839e47bef9e240836b1d02065c703547a2424e05074467fe70f83c1ebf3db6cb71bf0d38848ec25e2e81b4cbb506ced7973b85e2ab2d8e4273de720779d
SSDEEP 3072:bk8F4zlDtDlWY32LCG3F4l96gsFYrykP57S7moSFiO36CzPvOFX:bk8OzljW3CoSl9eOmU7sbE7PA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProvProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\ProvProvider.dll
Size 753KB
SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
MD5 70c34975e700a9d7e120aaecf9d8f14b
SHA1 e24d47f025c0ec0f60ec187bfc664e9347dc2c9c
SHA512 7f6a24345f5724d710e0b6c23b3b251e96d656fac58ea67b2b84d7d9a38d7723eae2c278e6e218e7f69f79d1cce240d91a8b0fd0d99960cacc65d82eb614a260
SSDEEP 12288:X/ck9AStILSQfhJI1UOAibcu978/ftYEGVRU8rbcgWte6QP:PckaLSQpJI1UeUKEKFfetTQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\AppxProvider.dll.mui
Size 22KB
SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
MD5 bd0dd9c5a602cb0ad7eabc16b3c1abfc
SHA1 cede6e6a55d972c22da4bc9e0389759690e6b37f
SHA512 86351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c
SSDEEP 192:WqLBjDHbtptJt5MNxWJtrtutAtKt0tptj/eCk6tf6voFeSMoLH7/x9Wg+WA:WqLJDrLpMyYWbWoFelCH7Z9Wg+WA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\AssocProvider.dll.mui
Size 8KB
SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
MD5 8833761572f0964bdc1bea6e1667f458
SHA1 166260a12c3399a9aa298932862569756b4ecc45
SHA512 2a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8
SSDEEP 192:x/Akc8dT8EC1y/vYsCAFdUTFLrNmAYKkA48UGtqWKKWr:TtsRbIWKKWr
MD5 SHA1 SHA512 SSDEEP

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\CbsProvider.dll.mui
Size 53KB
SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
MD5 6c51a3187d2464c48cc8550b141e25c5
SHA1 a42e5ae0a3090b5ab4376058e506b111405d5508
SHA512 87a9e997d55bc6dbd05af1291fb78cd02266641d018ccfeb6826cb0de205aaf8a57b49e587462dbb6df2b86b54f91c0c5d3f87e64d7dbb2aea75ef143c5447ba
SSDEEP 768:s34QoxGHbXqhu7dCJ6zoROa9fOLBzZoL/ug:s34QoxGHb6huJCJ6zoROa9fou/ug
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\DismCore.dll.mui
Size 7KB
SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
MD5 7a15f6e845f0679de593c5896fe171f9
SHA1 0c923dfaffb56b56cba0c28a4eacb66b1b91a1f4
SHA512 5a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca
SSDEEP 96:w4aiiiWwdwCg/PCpQcBK8Cq9ovnwEWDOWwo:JpaJWDOWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\DmiProvider.dll.mui
Size 17KB
SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
MD5 b7252234aa43b7295bb62336adc1b85c
SHA1 b2c42a5af79530e7cf9bcf54fd76ae9d5f234d7f
SHA512 88241009b342eb1205b10f7725a7cb1ec2c7135606459d038c4b8847efd9d5e0ad4749621f8df93746dd3ba8ab92d1b0f513ed10e2ba712a7991716f4c062358
SSDEEP 192:C53q+0W6eHJr6dVD4hN2J63092HdHUcbR1b0apWuzWRvWt:g6eHJr6dVwH3J9bbvbHpfzWRvWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\FfuProvider.dll.mui
Size 9KB
SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
MD5 dc826a9cb121e2142b670d0b10022e22
SHA1 b2fe459ede8ba99602ae6ea5fa24f0133cca2bc9
SHA512 038e9abff445848c882a71836574df0394e73690bc72642c2aa949c1ad820c5cbb4dedc4ee7b5b75fd5ac8a43813d416f23d28973de7a7f0e5c3f7112da6fe1b
SSDEEP 192:/9Ulo7nI+5XnEhLADlDS+d4LfS65Xocb1CEdWcCWn:DLI+5XQL+d4LfS65XJBCEdWcCWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\FolderProvider.dll.mui
Size 2KB
SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
MD5 22b4a3a1ec3b6d7aa3bc61d0812dc85f
SHA1 97ae3504a29eb555632d124022d8406fc5b6f662
SHA512 9329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c
MD5 SHA1 SHA512

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\GenericProvider.dll.mui
Size 5KB
SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
MD5 d6b02daf9583f640269b4d8b8496a5dd
SHA1 e3bc2acd8e6a73b6530bc201902ab714e34b3182
SHA512 189e87fcc2902e2a8e59773783d80a7d4dd5d2991bd291b0976cbd304f78bd225b353703735b84de41b5f59c37402db634c4acc805d73176cde75ca662efff50
SSDEEP 48:ycW8d55p3lDPjLULeCH8C/FcWNlGHQlzQttIZWO9u8bK5WwHgw:l3lD3COWAcQLEWAeWwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\IBSProvider.dll.mui
Size 2KB
SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
MD5 d4b67a347900e29392613b5d86fe4ac2
SHA1 fb84756d11bfd638c4b49268b96d0007b26ba2fb
SHA512 af0a2a3f813e1adfff972285c9655f50ce6916caaeff5cb82f6c7d76491ffc9b365a47f19750fc02d7122182bf65aae79ed167886c33f202d5a781ab83d75662
MD5 SHA1 SHA512

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\ImagingProvider.dll.mui
Size 18KB
SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
MD5 f2e2ba029f26341158420f3c4db9a68f
SHA1 1dee9d3dddb41460995ad8913ad701546be1e59d
SHA512 3d45d7bcf21d5df56b516fc18f7dc1bf80e44258b0c810b199a7bc06047a547060956c9d79575b82d9b6992fb5fe64f5b0ef1e408363887ae81a64b6ff9fa03e
SSDEEP 384:WEPs6ATPNW8mc8jRd9kPQ/ih6uXJeEkWblWk:WEPs6MFW8l8jr9L/ihcEZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\IntlProvider.dll.mui
Size 27KB
SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
MD5 2eb303db5753eb7a6bb3ab773eeabdcb
SHA1 44c6c38e6ae5f9ce9d7ca9d45a3cc3020b1353e4
SHA512 df1c8cefed4b5ef5a47f9bc0c42776611b3af709938a0900db79c6c9f4fae21acbbb6c4b1cad3c5a2051b622fe7e6e01486d34622742a981623fed933f1b1427
SSDEEP 192:FmXnvvMzYr9Hw2PWJh0nCI2rFvAp2ZHwdg/nGaZ5XJVFLdcgUrWLD/QWQ0QdQJWC:FOn3MMbnGjGClJVFa0bQWQ0QdQJWZ4Wq
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\LogProvider.dll.mui
Size 6KB
SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
MD5 8933c8d708e5acf5a458824b19fd97da
SHA1 de55756ddbeebc5ad9d3ce950acba5d2fb312331
SHA512 ead5017d9d024a1d7c53634ae725438ea3a34eed8c9056ebbc4ebe5aab2055c0e67687ce7608724e4f66f55aa486a63024967b76a5638cde3dd88b3d3432ca1f
SSDEEP 96:zXM6czix6RXToVSHvoXBD3LXnvoJnoN6yvG8vIUEWNrWwv:LMniIh0IHAXB7DnAJoN6yO8wFWNrWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\MsiProvider.dll.mui
Size 15KB
SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
MD5 c5e60ee2d8534f57fddb81ffce297763
SHA1 78e6b0e03c8bf5802b3ef429b105d7ae3092a8f2
SHA512 ce654295e8b16da7bd004453ae4a422fe8296a8c2343e56d819883b835c391a02537ecf4d155a281a9d38f2291ee0004506b7fd48a99c0f8881ff1e38ae8ebcc
SSDEEP 96:2TRzAa2VDHWUt1qaoe3em2G6BHWPrem2vopuLcvy6em2bxVoa/b1mA5ICHH00H0X:2TRSDzRXQdoa/5ICH/AbQZL8ZK1WcoWc
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\OSProvider.dll.mui
Size 3KB
SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
MD5 0633e0fccd477d9b22de4dd5a84abe53
SHA1 e04fb5c3acb35d128c1ea6ee6fb0e9b3fe90d5a9
SHA512 e95ed1d8069d6f200f0a2ea8dd7688404af9db9ce5e229afcb625a1f9eb46ac9e7a1c2c4c5ce156b190514415679e82e213732e8e890ed1a89af9026e4e73fe3
MD5 SHA1 SHA512

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
MD5 015271d46ab128a854a4e9d214ab8a43
SHA1 2569deff96fb5ad6db924cee2e08a998ddc80b2a
SHA512 6ba678da0475a6b1872c2e2c151b395a4d97390bed4671d3f918aab5e69cbc9ceafe72c3100ba060ac6586fd37682499fdeef7d7b1ab10f5ec2411c1438ed438
MD5 SHA1 SHA512

Submit Download

dismprov.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\24C468CD-B47B-40DB-9695-10E4F00392BA\en-US\dismprov.dll.mui
Size 2KB
SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
MD5 7d06108999cc83eb3a23eadcebb547a5
SHA1 200866d87a490d17f6f8b17b26225afeb6d39446
SHA512 9f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ffe4jkle.uia.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffe4jkle.uia.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ldopengl32x.dll

Path C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll
Size 130KB
SHA256 af678908489c742fd60a95884678cf98b2a0ebefa4c979bff41dbac5cc980fd3
MD5 f7a0a4481be22a5e88414b59b66fb40d
SHA1 607ad029b08cf0856f264d5b4609d61fcfb7c723
SHA512 cdd15be61d646019e4f5db36841fb7e755aec0f78b44d8896e7e2a4ab370d18999702fee6a9308218d1c96327ad8c126e7a0034ef74b29310d0ea2a04113ce0f
SSDEEP 3072:XqfyyOxtmwAhh+wv0DfBSygVxwFMNS/Yu+LIyNH:yy2d3s1gTy//YdLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 2.1MB
SHA256 b06bb0257601ced7d23ec8327d70880ce96e9e492b0c47b109fdca63314c03eb
MD5 0843e431fd71cb394270749f18e5477f
SHA1 8935206baa7981018202b0ac8b23a3f072008906
SHA512 03d27e8cae4c13ddc0bb280bf21b8f1d6307467c7c75cdf08bcda4cc6722c3eada30f561a26a2bed5b5e1a720ea4e121ee29a02bba422d0ad74f9a3127d86f33
SSDEEP 3072:lS3yHZl5HNFZCIz9ZFGkzZZ44/3yyvVwK/mjSfzWVwKV+mhlcmh10eay+BUlP751:JHzvy+BUlP75RmvtG7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 2.2MB
SHA256 bdba7d2fcb24dc3fa8425f1104d6be717c1560de8245f7e15eeb9413cabf8331
MD5 53394e4877b1ada195beb516265dbcca
SHA1 1b0f6b6599118da69b5566d09cf52c0f03dbbac0
SHA512 ddcb0668e86ca574117376bf1eb980360a5a67fccd0aa42c5f7da839e9f6a393f7b9c9511c63b0c8ace4754439f312d98c57d59037e810c2309fe090937a6656
SSDEEP 3072:lS3yHZl5HNFZCIz9ZFGkzZZ44/3yyvVwK/mjSfzWVwKV+mhlcmh10eay+BUlP75K:JHzvy+BUlP75RmvtG7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-892-0x00000000078F0000-0x0000000007986000-memory.dmp

Download

memory/220-873-0x0000000005EB0000-0x0000000006204000-memory.dmp

Download

memory/220-888-0x0000000007540000-0x00000000075E3000-memory.dmp

Download

memory/220-887-0x0000000006920000-0x000000000693E000-memory.dmp

Download

memory/220-876-0x0000000007300000-0x0000000007332000-memory.dmp

Download

memory/220-877-0x000000006F570000-0x000000006F5BC000-memory.dmp

Download

memory/220-875-0x0000000006390000-0x00000000063DC000-memory.dmp

Download

memory/220-890-0x0000000007670000-0x000000000768A000-memory.dmp

Download

memory/220-874-0x0000000006340000-0x000000000635E000-memory.dmp

Download

memory/220-891-0x00000000076E0000-0x00000000076EA000-memory.dmp

Download

memory/220-860-0x0000000005420000-0x0000000005A48000-memory.dmp

Download

memory/220-889-0x0000000007CB0000-0x000000000832A000-memory.dmp

Download

memory/220-893-0x0000000007870000-0x0000000007881000-memory.dmp

Download

memory/220-862-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/220-894-0x00000000078B0000-0x00000000078BE000-memory.dmp

Download

memory/220-895-0x0000000007990000-0x00000000079AA000-memory.dmp

Download

memory/220-861-0x0000000005BC0000-0x0000000005BE2000-memory.dmp

Download

memory/220-863-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Download

memory/220-859-0x0000000004D80000-0x0000000004DB6000-memory.dmp

Download

memory/1756-908-0x000000006F570000-0x000000006F5BC000-memory.dmp

Download

memory/1756-903-0x0000000005A10000-0x0000000005D64000-memory.dmp

Download

memory/2376-1044-0x0000000037130000-0x0000000037140000-memory.dmp

Download

memory/2376-1183-0x0000000071220000-0x0000000072C1B000-memory.dmp

Download

memory/2376-1185-0x0000000070BF0000-0x0000000070C6E000-memory.dmp

Download

memory/2376-1186-0x0000000070B70000-0x0000000070BEA000-memory.dmp

Download

memory/2376-1187-0x0000000070B10000-0x0000000070B69000-memory.dmp

Download

memory/2376-1184-0x0000000070C70000-0x0000000071216000-memory.dmp

Download

memory/2376-1022-0x00000000011B0000-0x00000000011C6000-memory.dmp

Download

memory/4136-928-0x0000000005710000-0x0000000005A64000-memory.dmp

Download

memory/4136-929-0x000000006F570000-0x000000006F5BC000-memory.dmp

Download