Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2024 14:01

General

  • Target

    https://www.ldplayer.net/apps/cheatlab-on-pc.html

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Manipulates Digital Signatures 1 TTPs 64 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Possible privilege escalation attempt 6 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ldplayer.net/apps/cheatlab-on-pc.html
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff79846f8,0x7ffff7984708,0x7ffff7984718
      2⤵
        PID:4836
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        2⤵
          PID:4840
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4832
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
          2⤵
            PID:4076
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
            2⤵
              PID:3448
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
              2⤵
                PID:3588
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
                2⤵
                  PID:1416
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                  2⤵
                    PID:1184
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                    2⤵
                      PID:3188
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
                      2⤵
                        PID:4796
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
                        2⤵
                          PID:1668
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
                          2⤵
                            PID:4400
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
                            2⤵
                              PID:212
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                              2⤵
                                PID:2952
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7192 /prefetch:8
                                2⤵
                                  PID:2472
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
                                  2⤵
                                    PID:4012
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7400 /prefetch:8
                                    2⤵
                                      PID:4532
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
                                      2⤵
                                        PID:2788
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4640
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                                        2⤵
                                          PID:2564
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                          2⤵
                                            PID:3580
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7584 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5180
                                          • C:\Users\Admin\Downloads\LDPlayer9_ens_com.Cheatlab.Cheatlab_3040_ld.exe
                                            "C:\Users\Admin\Downloads\LDPlayer9_ens_com.Cheatlab.Cheatlab_3040_ld.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Enumerates connected drives
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5292
                                            • C:\LDPlayer\LDPlayer9\LDPlayer.exe
                                              "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=3040 -language=en -path="C:\LDPlayer\LDPlayer9\"
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3440
                                              • C:\LDPlayer\LDPlayer9\dnrepairer.exe
                                                "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=459420
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Drops file in Program Files directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5996
                                                • C:\Windows\SysWOW64\net.exe
                                                  "net" start cryptsvc
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3720
                                                  • C:\Windows\SysWOW64\net1.exe
                                                    C:\Windows\system32\net1 start cryptsvc
                                                    6⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5192
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" Softpub.dll /s
                                                  5⤵
                                                  • Manipulates Digital Signatures
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5196
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" Wintrust.dll /s
                                                  5⤵
                                                  • Manipulates Digital Signatures
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1640
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" Initpki.dll /s
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5848
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "C:\Windows\system32\regsvr32" Initpki.dll /s
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5960
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" dssenh.dll /s
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2440
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" rsaenh.dll /s
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2348
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" cryptdlg.dll /s
                                                  5⤵
                                                  • Manipulates Digital Signatures
                                                  • System Location Discovery: System Language Discovery
                                                  PID:452
                                                • C:\Windows\SysWOW64\takeown.exe
                                                  "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
                                                  5⤵
                                                  • Possible privilege escalation attempt
                                                  • Modifies file permissions
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4632
                                                • C:\Windows\SysWOW64\icacls.exe
                                                  "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
                                                  5⤵
                                                  • Possible privilege escalation attempt
                                                  • Modifies file permissions
                                                  • System Location Discovery: System Language Discovery
                                                  PID:884
                                                • C:\Windows\SysWOW64\takeown.exe
                                                  "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
                                                  5⤵
                                                  • Possible privilege escalation attempt
                                                  • Modifies file permissions
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1584
                                                • C:\Windows\SysWOW64\icacls.exe
                                                  "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
                                                  5⤵
                                                  • Possible privilege escalation attempt
                                                  • Modifies file permissions
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4108
                                                • C:\Windows\SysWOW64\dism.exe
                                                  C:\Windows\system32\dism.exe /Online /English /Get-Features
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5288
                                                  • C:\Users\Admin\AppData\Local\Temp\4C2E7161-C844-46E4-91C7-7F41D735E7E4\dismhost.exe
                                                    C:\Users\Admin\AppData\Local\Temp\4C2E7161-C844-46E4-91C7-7F41D735E7E4\dismhost.exe {7FA8D566-43FC-4321-8D3D-3A5687556E37}
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops file in Windows directory
                                                    PID:2280
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc query HvHost
                                                  5⤵
                                                  • Launches sc.exe
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6124
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc query vmms
                                                  5⤵
                                                  • Launches sc.exe
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4376
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc query vmcompute
                                                  5⤵
                                                  • Launches sc.exe
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6064
                                                • C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
                                                  "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2788
                                                • C:\Windows\SYSTEM32\regsvr32.exe
                                                  "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
                                                  5⤵
                                                  • Loads dropped DLL
                                                  PID:4448
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
                                                  5⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2472
                                                • C:\Windows\SYSTEM32\regsvr32.exe
                                                  "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
                                                  5⤵
                                                  • Loads dropped DLL
                                                  • Modifies registry class
                                                  PID:3696
                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                  "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
                                                  5⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:5244
                                                • C:\Windows\SysWOW64\sc.exe
                                                  "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
                                                  5⤵
                                                  • Launches sc.exe
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6080
                                                • C:\Windows\SysWOW64\sc.exe
                                                  "C:\Windows\system32\sc" start Ld9BoxSup
                                                  5⤵
                                                  • Launches sc.exe
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4452
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1280
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5512
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2236
                                              • C:\LDPlayer\LDPlayer9\driverconfig.exe
                                                "C:\LDPlayer\LDPlayer9\driverconfig.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5200
                                              • C:\Windows\SysWOW64\takeown.exe
                                                "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
                                                4⤵
                                                • Possible privilege escalation attempt
                                                • Modifies file permissions
                                                • System Location Discovery: System Language Discovery
                                                PID:5636
                                              • C:\Windows\SysWOW64\icacls.exe
                                                "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
                                                4⤵
                                                • Possible privilege escalation attempt
                                                • Modifies file permissions
                                                • System Location Discovery: System Language Discovery
                                                PID:3724
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/9BanqRjUtc
                                              3⤵
                                                PID:5216
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff79846f8,0x7ffff7984708,0x7ffff7984718
                                                  4⤵
                                                    PID:5928
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
                                                2⤵
                                                  PID:5836
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:1
                                                  2⤵
                                                    PID:5844
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:1
                                                    2⤵
                                                      PID:5996
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
                                                      2⤵
                                                        PID:6004
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7644 /prefetch:1
                                                        2⤵
                                                          PID:5300
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
                                                          2⤵
                                                            PID:2668
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
                                                            2⤵
                                                              PID:2220
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
                                                              2⤵
                                                                PID:4672
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:1
                                                                2⤵
                                                                  PID:5684
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
                                                                  2⤵
                                                                    PID:5688
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
                                                                    2⤵
                                                                      PID:5220
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
                                                                      2⤵
                                                                        PID:636
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
                                                                        2⤵
                                                                          PID:5812
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
                                                                          2⤵
                                                                            PID:4540
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                                                                            2⤵
                                                                              PID:5036
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                                                                              2⤵
                                                                                PID:3964
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:1
                                                                                2⤵
                                                                                  PID:6116
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4668 /prefetch:8
                                                                                  2⤵
                                                                                    PID:5572
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5556 /prefetch:8
                                                                                    2⤵
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4316
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7908 /prefetch:8
                                                                                    2⤵
                                                                                      PID:6000
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17184982464932169651,6712024821904487594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5164 /prefetch:2
                                                                                      2⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:4676
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:2108
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:4984

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\LDPlayer\LDPlayer9\crashreport.dll

                                                                                        Filesize

                                                                                        51KB

                                                                                        MD5

                                                                                        cb1f1554bd438600eba5a55feda2c653

                                                                                        SHA1

                                                                                        893dcdd3d21568c6d0586fa3590be7c9dcbfa42e

                                                                                        SHA256

                                                                                        27bb89fa0800e7fdf643126551dda3eaa834b1171346010b93fb904076e90f4f

                                                                                        SHA512

                                                                                        65b064ce0496680408f76e7fe3a9946155384864099c1913acb1f88db182277d5d09d4e9cfdff8a8ae821f0037af93ce97bbc76e656831a52714abcdc0da6412

                                                                                      • C:\LDPlayer\LDPlayer9\dnrepairer.exe

                                                                                        Filesize

                                                                                        41.9MB

                                                                                        MD5

                                                                                        cee286a3b75e2e3b92359a54a129a8cf

                                                                                        SHA1

                                                                                        d9708dc4a44c32a25d31eb93b7e0627155c5a871

                                                                                        SHA256

                                                                                        d6f0c9d7efe02de528a908285a989cc41903bc34b3448e5638af551ef12f77a5

                                                                                        SHA512

                                                                                        daf84e165437170d2ae029f2092ea9dbde03d6a34d85ac710e679e560333f8c17c6a2fc16ad69adad36ccf29c462f9c92346ca42e163e7a8c4069253456f06c1

                                                                                      • C:\LDPlayer\LDPlayer9\dnresource.rcc

                                                                                        Filesize

                                                                                        5.6MB

                                                                                        MD5

                                                                                        be5eb5347c30bc6feba94d103528050a

                                                                                        SHA1

                                                                                        862ff5fd84b1caa34a6298969799a802f1cb3df6

                                                                                        SHA256

                                                                                        5fda5ba5047c9b6c542eb4643fd42e664838702534a3d1a53ccb0c1af1490965

                                                                                        SHA512

                                                                                        15994a163acacbdd5811e21c01a0993c16dcf078cad37b74c95e488cf6c6944c288550a60d1da8e049c24657896370332bf8c0431a7b037614552b43c47a630d

                                                                                      • C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf

                                                                                        Filesize

                                                                                        314KB

                                                                                        MD5

                                                                                        e2e37d20b47d7ee294b91572f69e323a

                                                                                        SHA1

                                                                                        afb760386f293285f679f9f93086037fc5e09dcc

                                                                                        SHA256

                                                                                        153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2

                                                                                        SHA512

                                                                                        001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe

                                                                                        Filesize

                                                                                        652KB

                                                                                        MD5

                                                                                        ad9d7cbdb4b19fb65960d69126e3ff68

                                                                                        SHA1

                                                                                        dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d

                                                                                        SHA256

                                                                                        a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326

                                                                                        SHA512

                                                                                        f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        MD5

                                                                                        66df6f7b7a98ff750aade522c22d239a

                                                                                        SHA1

                                                                                        f69464fe18ed03de597bb46482ae899f43c94617

                                                                                        SHA256

                                                                                        91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f

                                                                                        SHA512

                                                                                        48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll

                                                                                        Filesize

                                                                                        2.0MB

                                                                                        MD5

                                                                                        01c4246df55a5fff93d086bb56110d2b

                                                                                        SHA1

                                                                                        e2939375c4dd7b478913328b88eaa3c91913cfdc

                                                                                        SHA256

                                                                                        c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889

                                                                                        SHA512

                                                                                        39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll

                                                                                        Filesize

                                                                                        442KB

                                                                                        MD5

                                                                                        2d40f6c6a4f88c8c2685ee25b53ec00d

                                                                                        SHA1

                                                                                        faf96bac1e7665aa07029d8f94e1ac84014a863b

                                                                                        SHA256

                                                                                        1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334

                                                                                        SHA512

                                                                                        4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll

                                                                                        Filesize

                                                                                        1.2MB

                                                                                        MD5

                                                                                        ba46e6e1c5861617b4d97de00149b905

                                                                                        SHA1

                                                                                        4affc8aab49c7dc3ceeca81391c4f737d7672b32

                                                                                        SHA256

                                                                                        2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e

                                                                                        SHA512

                                                                                        bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll

                                                                                        Filesize

                                                                                        192KB

                                                                                        MD5

                                                                                        52c43baddd43be63fbfb398722f3b01d

                                                                                        SHA1

                                                                                        be1b1064fdda4dde4b72ef523b8e02c050ccd820

                                                                                        SHA256

                                                                                        8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f

                                                                                        SHA512

                                                                                        04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll

                                                                                        Filesize

                                                                                        511KB

                                                                                        MD5

                                                                                        e8fd6da54f056363b284608c3f6a832e

                                                                                        SHA1

                                                                                        32e88b82fd398568517ab03b33e9765b59c4946d

                                                                                        SHA256

                                                                                        b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd

                                                                                        SHA512

                                                                                        4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll

                                                                                        Filesize

                                                                                        522KB

                                                                                        MD5

                                                                                        3e29914113ec4b968ba5eb1f6d194a0a

                                                                                        SHA1

                                                                                        557b67e372e85eb39989cb53cffd3ef1adabb9fe

                                                                                        SHA256

                                                                                        c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a

                                                                                        SHA512

                                                                                        75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll

                                                                                        Filesize

                                                                                        854KB

                                                                                        MD5

                                                                                        4ba25d2cbe1587a841dcfb8c8c4a6ea6

                                                                                        SHA1

                                                                                        52693d4b5e0b55a929099b680348c3932f2c3c62

                                                                                        SHA256

                                                                                        b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49

                                                                                        SHA512

                                                                                        82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6

                                                                                      • C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll

                                                                                        Filesize

                                                                                        283KB

                                                                                        MD5

                                                                                        0054560df6c69d2067689433172088ef

                                                                                        SHA1

                                                                                        a30042b77ebd7c704be0e986349030bcdb82857d

                                                                                        SHA256

                                                                                        72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750

                                                                                        SHA512

                                                                                        418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0

                                                                                      • C:\LDPlayer\LDPlayer9\msvcp120.dll

                                                                                        Filesize

                                                                                        444KB

                                                                                        MD5

                                                                                        50260b0f19aaa7e37c4082fecef8ff41

                                                                                        SHA1

                                                                                        ce672489b29baa7119881497ed5044b21ad8fe30

                                                                                        SHA256

                                                                                        891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9

                                                                                        SHA512

                                                                                        6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

                                                                                      • C:\LDPlayer\LDPlayer9\msvcr120.dll

                                                                                        Filesize

                                                                                        947KB

                                                                                        MD5

                                                                                        50097ec217ce0ebb9b4caa09cd2cd73a

                                                                                        SHA1

                                                                                        8cd3018c4170072464fbcd7cba563df1fc2b884c

                                                                                        SHA256

                                                                                        2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112

                                                                                        SHA512

                                                                                        ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

                                                                                      • C:\LDPlayer\LDPlayer9\phones.data

                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        fdee6e3ccf8b61db774884ccb810c66f

                                                                                        SHA1

                                                                                        7a6b13a61cd3ad252387d110d9c25ced9897994d

                                                                                        SHA256

                                                                                        657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4

                                                                                        SHA512

                                                                                        f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512

                                                                                      • C:\LDPlayer\LDPlayer9\vms\config\leidian0.config

                                                                                        Filesize

                                                                                        640B

                                                                                        MD5

                                                                                        de8d68022717438517eb0e32fd23429d

                                                                                        SHA1

                                                                                        ddd373a6e7f51403e78735e830f2f4b626da3d87

                                                                                        SHA256

                                                                                        30a9f1358561f0d69a40e8fe809ca89adc797a3ddf320399152cf702e2e8660b

                                                                                        SHA512

                                                                                        83f43ef56360cb8cb675e3eb2d5daf919f52b71fce47a7ab526d68aed03b454a5e873abe8d5e4acdcab7da3e3a60f8d853335b313a0da91e4f9442954c21c005

                                                                                      • C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf

                                                                                        Filesize

                                                                                        103KB

                                                                                        MD5

                                                                                        4acd5f0e312730f1d8b8805f3699c184

                                                                                        SHA1

                                                                                        67c957e102bf2b2a86c5708257bc32f91c006739

                                                                                        SHA256

                                                                                        72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5

                                                                                        SHA512

                                                                                        9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        7477427626b96f8da643df929cb6be85

                                                                                        SHA1

                                                                                        72f02a07f44c7bfb93228182a314c4fddaed8b22

                                                                                        SHA256

                                                                                        1772bfb59b958d89525173c12653cfe391b2b377297b6efe76d9834d1dc0e6ed

                                                                                        SHA512

                                                                                        b10639677616b014161894f54565e58bc68e5dafd08e04cc873264e543a616bff6300d51938c4a847e752543a2da7f3cca75ec53a5a4b8369c0c68e97731430f

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        918368e8fcb30a4bd51cff376fa633f0

                                                                                        SHA1

                                                                                        5358043adf7b2b0f6e70f64fac28f6c28c932da5

                                                                                        SHA256

                                                                                        0ad90802546d5d67c0b4663b1a493651ced10bd5cb48bcac64b585dc4aeec292

                                                                                        SHA512

                                                                                        a21b9e96a2721338c215ccff839705f3c249b3e69b19a81360d4429572ffde7a0330c59ac2eab1758bd1d00a938308483e00b03289b6a6d16840f95ad0e0ce6f

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        3a7e76d395c28078066c5e110ea19c88

                                                                                        SHA1

                                                                                        2f59c0737b5dae4f2bfbc57776f7eb9a7231274f

                                                                                        SHA256

                                                                                        11562a2b191c080fd68f1dc466fc9e69c6ed5db9b2585c276862c394a0624da7

                                                                                        SHA512

                                                                                        40543f549537c201d9d054b57d2d479b1bad109fecdab6ffa0bdca5751018577f61f205685c9fd54de0738cdface8f932d5692ca8e5d992590626be61130f3db

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

                                                                                        Filesize

                                                                                        434B

                                                                                        MD5

                                                                                        3fe4aee3178997b534e4aecf7906f0b3

                                                                                        SHA1

                                                                                        2676a4bb106c93a690f2f0a4423a8f4808005f68

                                                                                        SHA256

                                                                                        cf51f5909f2f0ca1caa62d50371131b7d3e9f928c834493ce069082cffa04c7c

                                                                                        SHA512

                                                                                        b074c4c43fea6f87ccb76ee519bfa56af26304b3ac84d5e4cf32afc93f7b0bb511bc65d805609bb2b3752b05692181fa6824ebfda710017d18ad1eacb2617c77

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                                                                        Filesize

                                                                                        458B

                                                                                        MD5

                                                                                        0cfd9dbe812ef98ece44fcfe1cf5274e

                                                                                        SHA1

                                                                                        f12d3de30b758d96d33dc8c045d6c5020d8a963b

                                                                                        SHA256

                                                                                        4e20871fb2ed7309b68a485fd2f0dac4f022a0e5ea465e76536ef383ae416bc2

                                                                                        SHA512

                                                                                        2838f60bec46571d723f740d1095668727285a6dc43a909f4365b591888495930ee3a5cc00b6854320ed4124471c872b0a78bac9680a3baaa829bf43bfbda359

                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                                                                        Filesize

                                                                                        432B

                                                                                        MD5

                                                                                        5c7051bb9ef523e805b34e56f038f709

                                                                                        SHA1

                                                                                        d9731d431936ed2718db8654a01366ca7123bd78

                                                                                        SHA256

                                                                                        76bfbaf715b9063dccc5e98ed5849d4773f077c0ec7f55f8a6d286f5ee911619

                                                                                        SHA512

                                                                                        c6354311b4dfe31df70f20e076ce7d7bd5886fb07b1ff3983d810ef267b6a0d8686564620b9a4c25b67c2cfa34d10bcf24717eaa2a608184e18477b1ed92de92

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                        Filesize

                                                                                        152B

                                                                                        MD5

                                                                                        9e3fc58a8fb86c93d19e1500b873ef6f

                                                                                        SHA1

                                                                                        c6aae5f4e26f5570db5e14bba8d5061867a33b56

                                                                                        SHA256

                                                                                        828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                                                                                        SHA512

                                                                                        e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                        Filesize

                                                                                        152B

                                                                                        MD5

                                                                                        27304926d60324abe74d7a4b571c35ea

                                                                                        SHA1

                                                                                        78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                                                                                        SHA256

                                                                                        7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                                                                                        SHA512

                                                                                        f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                                                        Filesize

                                                                                        99KB

                                                                                        MD5

                                                                                        0b32c919991c61adec0d044f8a1953e8

                                                                                        SHA1

                                                                                        4cf39d5fd187d33c5e588d544940f5539abd8986

                                                                                        SHA256

                                                                                        13391f7b28ce142efa4ffba8728bc7175fa85fd43b57d57208cf030edf3f45ec

                                                                                        SHA512

                                                                                        eb085b404518464806fe87b05c92228fac7d392fda76fd9523002fcac36b5bec5748f16d127e05a933a35e37368dde4768f524fd9df3575ee38aa20a8b4e8886

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                                                                        Filesize

                                                                                        79KB

                                                                                        MD5

                                                                                        f4227a5dbb0255506a38751db6c05280

                                                                                        SHA1

                                                                                        c5dd5b1665fc04a3df44786fdb5678ec7b8c20df

                                                                                        SHA256

                                                                                        313bb9bf8bcac50cd8b0e71dcc27f20c895093df5f855afbdd0b1142e03bb5e2

                                                                                        SHA512

                                                                                        c56168028e2da6b7b0d1507a98b70e2f6c276813f4d9cad02b81ca33100363188ed8e3e76670f7fa01b9e8097651dbb86a2abc84ed287cb806434f2e92ded5e8

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

                                                                                        Filesize

                                                                                        67KB

                                                                                        MD5

                                                                                        929b1f88aa0b766609e4ca5b9770dc24

                                                                                        SHA1

                                                                                        c1f16f77e4f4aecc80dadd25ea15ed10936cc901

                                                                                        SHA256

                                                                                        965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

                                                                                        SHA512

                                                                                        fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

                                                                                        Filesize

                                                                                        64KB

                                                                                        MD5

                                                                                        d6b36c7d4b06f140f860ddc91a4c659c

                                                                                        SHA1

                                                                                        ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                                        SHA256

                                                                                        34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                                        SHA512

                                                                                        2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

                                                                                        Filesize

                                                                                        19KB

                                                                                        MD5

                                                                                        2e86a72f4e82614cd4842950d2e0a716

                                                                                        SHA1

                                                                                        d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                        SHA256

                                                                                        c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                        SHA512

                                                                                        7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

                                                                                        Filesize

                                                                                        63KB

                                                                                        MD5

                                                                                        710d7637cc7e21b62fd3efe6aba1fd27

                                                                                        SHA1

                                                                                        8645d6b137064c7b38e10c736724e17787db6cf3

                                                                                        SHA256

                                                                                        c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                                                        SHA512

                                                                                        19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

                                                                                        Filesize

                                                                                        26KB

                                                                                        MD5

                                                                                        05164205de79b19511050d171cd310d9

                                                                                        SHA1

                                                                                        cb68f9326bb7bb9d756ba31719a3b0b9349cd530

                                                                                        SHA256

                                                                                        3f2ff4e7e8b9de036869f70b206635403eb69e55fba6277576d4acabf278c2f2

                                                                                        SHA512

                                                                                        7875c499b74dd09d9e858abf231fa3b39934a11419eca7016fe4cb29a6ae7031f3397344c718c35556bbec32cf79e1aef8abd1bb1cd2be71f98f39cc9e83e447

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        afe0eed9aa411d51820e3d45fedcc4a4

                                                                                        SHA1

                                                                                        c6dd9e74a3bc7d3ca927074db800ff850aaff827

                                                                                        SHA256

                                                                                        e98cdb4dd8973db0b53f1af428337a08fc3c4c32f15a1490e72739238d0e6e1f

                                                                                        SHA512

                                                                                        ffa56eff4eadf1a7ae4e39a9691ed0eacde4c50ff12ea8f3c711d2100175446fd4bd53abfd80ca38ad65913a4f2d8a62c7289be0c3a18b1de90a3f0fac44247f

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        d02c2c28727bdcf13b294c760025b352

                                                                                        SHA1

                                                                                        4404cccfa0417490ac2a3c68497e240c2fc80d9d

                                                                                        SHA256

                                                                                        66e0c143e8a9082ed643a1c2ad5a98ed13431f411a564401f8a2f5e2a1648c58

                                                                                        SHA512

                                                                                        68a5e85d42c79a949873d2384f9090aea8ae0b527aeca9d5e0679b5e61c1bb60630b3d8d7c76132767fb968c9f34b37e66d6f755f756cf150fdc8f2ab880b532

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        bc91808e2d2abe2d6a987eba467bb709

                                                                                        SHA1

                                                                                        902f7294addbe3ad4dd0cce84d3cca0188cf2422

                                                                                        SHA256

                                                                                        8422e388075cdf570f74da2afbdbf61a8f8634cc3c25276a83af839932ee7cac

                                                                                        SHA512

                                                                                        a205bab674c307e1c90618d046e83241996e4daf183b29c44f6202c6e963b8af43addcf60fcc1b3a214f9a363427b97985375e938edccf8fed6f6959588a9136

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                        Filesize

                                                                                        7KB

                                                                                        MD5

                                                                                        ae73c94d8ea6187a6dd3c169f8b3ee7e

                                                                                        SHA1

                                                                                        2e79a85757a6487e3658e52135ae79a736bf533e

                                                                                        SHA256

                                                                                        55cfaf9db1d203c60b5cd2dce0c7dcbb812b2219e30415e939c6f1573267c366

                                                                                        SHA512

                                                                                        e19803c328881b228a01bcca053cd8c586f5e925fe4a1a9a4f00bb6ce00ffc443e092ebc49fa9d61e5f3860b29204b7c09e983432cc7a5a424a9754bf93b392d

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                        Filesize

                                                                                        8KB

                                                                                        MD5

                                                                                        1fcd91104b48e4c7b04593ee347d0a37

                                                                                        SHA1

                                                                                        16546412c179f9710462e5025a9954b56328c77e

                                                                                        SHA256

                                                                                        8a49a81ad186f287f46214279ba18acf4864b0dbad7ca80a1b11723342b9663e

                                                                                        SHA512

                                                                                        a4d59f16e7a5a5c8aad240fbefc747d12c02528b5b87351c5ffe9e05cb71d72d2f2c5a21a6997fd6b2d38cea1b47b83074bde35e6547af057fffd1be8dfba537

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        11KB

                                                                                        MD5

                                                                                        00295e846b47ac1f147ed758640bd582

                                                                                        SHA1

                                                                                        92724c13ac2508754f5c9bee0b9f1ab8efda9b20

                                                                                        SHA256

                                                                                        7391a463329527a7e658002cca8d56e85fb481e1ff41cbc2d59ad2959de4d31d

                                                                                        SHA512

                                                                                        664b1e22397ad53bbe16b5b8b51423324b1ad41dc4c70430526e3a2f04acf738930ba6f89e466027b0b958dc36ff3cfeccd3ce63661db98bff50212108f76594

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        5KB

                                                                                        MD5

                                                                                        cf03a5b084fe0ed433dfb993d8ff5fcf

                                                                                        SHA1

                                                                                        c465a1a58f3dee389bc52c11b490edb5f2872cc4

                                                                                        SHA256

                                                                                        bc7714599cf6d33fa4474fd0710a81c7f538b716fe70341f1c5ab46d14186602

                                                                                        SHA512

                                                                                        1154f068b4820c2a83de8541fdc61b6df87c9b81e00b54503f3af6d42b793c47aa86771b513119a8c2cfed260335104d6755ccc82e8948364feccec6d201b9f3

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        11KB

                                                                                        MD5

                                                                                        664dbc6342b011d3216a497e4ac6af91

                                                                                        SHA1

                                                                                        b90e242beced1191edcd425dc875763c682982aa

                                                                                        SHA256

                                                                                        9b2759a7367892e702abd01935d50015eaa2c60d05b545e78d2f5454950dd18d

                                                                                        SHA512

                                                                                        09f2e3f24cb7f12406489ecf354d891c84a3a5781b29941c117910a291f6c11b45129aca81915b44473042fc5367f5f75125c07e10296653fba5e65bfcdf6356

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        12KB

                                                                                        MD5

                                                                                        61cef3911884e46ed8f4479ffe4911b7

                                                                                        SHA1

                                                                                        3fabed601fb0548f7dea0b9c01cb28129f7b62f0

                                                                                        SHA256

                                                                                        fe1df94d610e302cc41659c511516222b1193e01ab4d42ad75518259e7135084

                                                                                        SHA512

                                                                                        04e2198c6a053fea55c8e20d9d76ad253a4e52af0c9343d7dbd53f6dc8fa3cc533250fba49f67d861be92804c06828f09823a53531af9ceb0004c8c2dacc7ba6

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        b0ec0f17cf67ebcb3060239fbd6efb50

                                                                                        SHA1

                                                                                        d0b4abeea076c452c4340e0ca88734b5a50958f1

                                                                                        SHA256

                                                                                        0999163fee19dfcdd877f6a03cda70924c9cd64d37e3b81b3d1f69e38e17da5a

                                                                                        SHA512

                                                                                        ad40ca2929529acdd72b3eaebfaf3fc9d1e259e554222af0538443c26227a4f2dc595419bbec5edbf86a814e48b2281a88bc583b06bc9fe5463a7bf6a4cfff9d

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                        Filesize

                                                                                        12KB

                                                                                        MD5

                                                                                        a1205e3464a9bce98c6da20f8e79223f

                                                                                        SHA1

                                                                                        e3126cc6c8354c49bba72f5ef930fab0fd03a4d1

                                                                                        SHA256

                                                                                        6f55ece457c7e498d508ccf1d98cf528fbb0fead7cc2c122cb7c7c2a8915f761

                                                                                        SHA512

                                                                                        7f068a37d8a2dc6ad583f1bb402620a82415eba0a5edb641882d7365a40c5033ea94909a75109240a65c0de4a02a5083e9940f80cfef834c5ff5728ae34759eb

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        419c862add2f219bcba7f8feff51f3d4

                                                                                        SHA1

                                                                                        3a85eb03360934e5133d4f0db512f89c62ad178f

                                                                                        SHA256

                                                                                        ccc2550051732b265893b0e3fadb8f5c12fed1962cfbf9c9892be353dbd922da

                                                                                        SHA512

                                                                                        7c58ff53eb6c3bf8d2f2a5250fd3c9f6ccfed8124fbc3c442e26f45a0ef5aecf6711a1b0b7bbb9083f03976855eb468f2add61e3a17f366eda478bdecc17d4de

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        a7f78135b1a80a9f98bce87e7b4313e6

                                                                                        SHA1

                                                                                        982776f6cb1bd24214934247ecc16e56149ec14d

                                                                                        SHA256

                                                                                        475653d406c03662144b86b7f4547ba553d1cae76f5fba7b6b0fbc3f4b62a58c

                                                                                        SHA512

                                                                                        d1608bbd94657c198554847f6d79c43300d9cf2090fe0a0eede83fdd490e496723a43bc3c2d7bd47376d023f1a1713f4212ed22ceb56c8d8448926bfdc1f46e2

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        3KB

                                                                                        MD5

                                                                                        d27733c3e073af76eca0c23afd6faca9

                                                                                        SHA1

                                                                                        158b60701b5ad249a9cb0fe3d25a760115f5f643

                                                                                        SHA256

                                                                                        c912a9ff05b93ee7816b7cfe45c65a2c44c400dc77fcad087b345a34dd1ffa87

                                                                                        SHA512

                                                                                        9a8d53320548d5423d070b4c2260b6d05a15c6c975a984ce018f2f1b1eed78c8f5982d788c0a700cbb6b765240b4220700d183fa0f9be4772e958c8182ab0778

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        0991a305aec4bb54a993d1cd0f2f0bbb

                                                                                        SHA1

                                                                                        93fe13120d26898b3cdd6b06e37a8b4be07d7ac4

                                                                                        SHA256

                                                                                        a06d876a5f27c8b67f4496116fc756b973fcc75b1bee3e044b6bcb6b253f5a28

                                                                                        SHA512

                                                                                        7f861ec402ffce1e261aae8d93bc9848de4aa23ae74e1a0a0792ab80d50dfea56c7314c600e181e5471e11d9194d6318ee0e03af12fc0d0cb126c0ab67ca1fa4

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585c06.TMP

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        36faa7caa92fa277df49f2f8ad82ce23

                                                                                        SHA1

                                                                                        749820f904c28dd162a7625119cdc68177c37989

                                                                                        SHA256

                                                                                        d21bc2b1d3ca2ac05de92464366a0a6b7e73227609dae171671a742a86803174

                                                                                        SHA512

                                                                                        55c9cd4e40b00f5099c8048d2b54041afe5b3e64796b9d3ad335edcd50a0d0e252576c9d0f7eccd5fbc5e45b8693a579b47ef2c0c3ff8536d5898df2c8edad9a

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                        Filesize

                                                                                        16B

                                                                                        MD5

                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                        SHA1

                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                        SHA256

                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                        SHA512

                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        9e3b5d4cab9c7117edf87ffdfa963866

                                                                                        SHA1

                                                                                        9e217b930792803535beb29db9b30d53d8c9da42

                                                                                        SHA256

                                                                                        b002e0c46c56ce1c96e50bb8e2634a73f0973eeadba6244a83d8f1e6418b5aea

                                                                                        SHA512

                                                                                        6dfba42107bd646d1bb1889ebafe0ce73f39979a01cd2a3f9c0393ef3f3d97a03911099e2f7ec6184460ce048ad4ac26861ba826e0ae4744018ea9503e594ec5

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\afb77bfc-9031-4ef7-a355-aa49a1f0ad10.tmp

                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        d1b9179c48998ece343b0e2cdd905885

                                                                                        SHA1

                                                                                        17fafdbdef2a10d38d296a7de850d3d8fcece1d0

                                                                                        SHA256

                                                                                        ca0fe6401433b639a69b8adf83b45f8c4e366a5c107036bf8016ce1a3ae59a5d

                                                                                        SHA512

                                                                                        ee2b75c396e72b6869b4e84c96a1e3548317cc54ceb63fbbd08faf5eb691a145816fd47dd9bdb130ac4500a901f5c65a5443ca6f02b1edd363ea7647a0b0054a

                                                                                      • C:\Users\Admin\AppData\Local\Temp\4C2E7161-C844-46E4-91C7-7F41D735E7E4\DismHost.exe

                                                                                        Filesize

                                                                                        142KB

                                                                                        MD5

                                                                                        e5d5e9c1f65b8ec7aa5b7f1b1acdd731

                                                                                        SHA1

                                                                                        dbb14dcda6502ab1d23a7c77d405dafbcbeb439e

                                                                                        SHA256

                                                                                        e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80

                                                                                        SHA512

                                                                                        7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpf1ts3v.jpg.ps1

                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                      • C:\Users\Admin\Downloads\Unconfirmed 53279.crdownload

                                                                                        Filesize

                                                                                        2.5MB

                                                                                        MD5

                                                                                        a64bd549d95bfc8be592833460f79fcc

                                                                                        SHA1

                                                                                        0aeeb9507ed39f14d82149c56011ec3aaed1bec9

                                                                                        SHA256

                                                                                        d285b5242f4583d49c63a7c7f83a72f082ab395f9eaff674ff56c8d2d0fa063d

                                                                                        SHA512

                                                                                        767bffb8861e81ce61cfec5b0462f6a62cf86d9fca8411126b6ee3f43bc7fccbbffae8fafe293e9c227f297d82562d70940b441f9d541e35b66b972f2b79fdae

                                                                                      • C:\Windows\Logs\DISM\dism.log

                                                                                        Filesize

                                                                                        276KB

                                                                                        MD5

                                                                                        4c08e4958b0b37dc8139eecda63d0096

                                                                                        SHA1

                                                                                        b9a0df4396991165d69a1ee179e03db9b1bf53ea

                                                                                        SHA256

                                                                                        2b38da778e1d235e9fc36130817617d7f53bb19ff39c22f29e450a4b3d3c3738

                                                                                        SHA512

                                                                                        88a45edea2691d3a27361fe5241904cfceaa0eb01e061f1187c5eebf078f1abe71398a1586264cc207f3de09c6176fc0c66b5396ed925fea77019e041a30516e

                                                                                      • \??\pipe\LOCAL\crashpad_4772_XZJHZWNHZZJPLYKO

                                                                                        MD5

                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                        SHA1

                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                        SHA256

                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                        SHA512

                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                      • memory/1280-1895-0x0000000007910000-0x000000000792A000-memory.dmp

                                                                                        Filesize

                                                                                        104KB

                                                                                      • memory/1280-1893-0x00000000077F0000-0x0000000007893000-memory.dmp

                                                                                        Filesize

                                                                                        652KB

                                                                                      • memory/1280-1868-0x0000000005F90000-0x0000000005FF6000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/1280-1908-0x0000000007B60000-0x0000000007B6E000-memory.dmp

                                                                                        Filesize

                                                                                        56KB

                                                                                      • memory/1280-1909-0x0000000007C30000-0x0000000007C4A000-memory.dmp

                                                                                        Filesize

                                                                                        104KB

                                                                                      • memory/1280-1879-0x00000000065F0000-0x000000000660E000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                      • memory/1280-1880-0x0000000006620000-0x000000000666C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/1280-1881-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

                                                                                        Filesize

                                                                                        200KB

                                                                                      • memory/1280-1867-0x0000000005F20000-0x0000000005F86000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/1280-1897-0x0000000007B90000-0x0000000007C26000-memory.dmp

                                                                                        Filesize

                                                                                        600KB

                                                                                      • memory/1280-1866-0x0000000005630000-0x0000000005652000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/1280-1865-0x0000000005700000-0x0000000005D28000-memory.dmp

                                                                                        Filesize

                                                                                        6.2MB

                                                                                      • memory/1280-1864-0x0000000005010000-0x0000000005046000-memory.dmp

                                                                                        Filesize

                                                                                        216KB

                                                                                      • memory/1280-1896-0x0000000007980000-0x000000000798A000-memory.dmp

                                                                                        Filesize

                                                                                        40KB

                                                                                      • memory/1280-1878-0x0000000006000000-0x0000000006354000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/1280-1894-0x0000000007F50000-0x00000000085CA000-memory.dmp

                                                                                        Filesize

                                                                                        6.5MB

                                                                                      • memory/1280-1898-0x0000000007B10000-0x0000000007B21000-memory.dmp

                                                                                        Filesize

                                                                                        68KB

                                                                                      • memory/1280-1892-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                      • memory/1280-1882-0x000000006E2D0000-0x000000006E31C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/2236-1951-0x000000006E2D0000-0x000000006E31C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/2236-1941-0x0000000005CC0000-0x0000000006014000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/5512-1930-0x000000006E2D0000-0x000000006E31C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB