d285b5242f4583d49c63a7c7f83a72f082ab395f9eaff674ff56c8d2d0fa063d

Analysis

max time kernel
133s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/10/2024, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_1001_ld (1).exe
Size 2.5MB
Sample241007-nf7dvsserj
SHA256 d285b5242f4583d49c63a7c7f83a72f082ab395f9eaff674ff56c8d2d0fa063d
MD5 a64bd549d95bfc8be592833460f79fcc
SHA1 0aeeb9507ed39f14d82149c56011ec3aaed1bec9
SHA512 767bffb8861e81ce61cfec5b0462f6a62cf86d9fca8411126b6ee3f43bc7fccbbffae8fafe293e9c227f297d82562d70940b441f9d541e35b66b972f2b79fdae
SSDEEP 49152:INfatughHaKLIKN1cueXlaYbsISTb/am5B8y6sEUhSSwoUK:Ila4ghHaKMu2IYbsIW/amj8yF8S
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverInitializePolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\FuncName = "DecodeRecipientID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "HTTPSCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012\Dll = "WINTRUST.DLL"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverInitializePolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4\FuncName = "WVTAsn1SealingTimestampAttributeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "GenericChainFinalProv"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.3\DefaultId = "{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCertPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2012\FuncName = "WVTAsn1SealingTimestampAttributeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001\FuncName = "WVTAsn1SpcMinimalCriteriaInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221\FuncName = "WVTAsn1CatNameValueEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3\FuncName = "WVTAsn1CatMemberInfo2Encode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4\FuncName = "FormatPKIXEmailProtection"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3548	takeown.exe
4816	icacls.exe
4472	takeown.exe
2968	icacls.exe
1296	takeown.exe
2196	icacls.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2968	icacls.exe
1296	takeown.exe
2196	icacls.exe
3548	takeown.exe
4816	icacls.exe
4472	takeown.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer9_ens_1001_ld (1).exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-runtime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxEFI32.fd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstSSLCertDownloads.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-convert-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ldutils.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9VMMR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\libcurl.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_V2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Core.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\concrt140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDbg.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxExtPackHelperApp.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-libraryloader-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetFltInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletionStress.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuthSimple.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxBalloonCtrl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDTrace.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-math-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-profile-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES12Translator.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\comregister.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-synch-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxRes.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-file-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDragAndDropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-namedpipe-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxSup.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcr120.dll	dnrepairer.exe
File opened for modification	C:\Program Files\ldplayer9box\msvcp140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-process-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetNAT.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcr100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\ucrtbase.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\vcruntime140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxDDR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSampleDriver.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSVGA3D.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxTestOGL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-private-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetDHCP.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-environment-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vcruntime140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDD2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstAnimate.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-2-0.dll	dnrepairer.exe
File opened for modification	C:\Program Files\ldplayer9box\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Executes dropped EXE 4 IoCs

pid	Process
2248	LDPlayer.exe
2512	dnrepairer.exe
2836	dismhost.exe
4848	Ld9BoxSVC.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3180	sc.exe
3028	sc.exe
816	sc.exe
4856	sc.exe
2304	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
2512	dnrepairer.exe
2512	dnrepairer.exe
2512	dnrepairer.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
2836	dismhost.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
4848	Ld9BoxSVC.exe
3352	regsvr32.exe
3352	regsvr32.exe
3352	regsvr32.exe
3352	regsvr32.exe
3352	regsvr32.exe
3352	regsvr32.exe
3352	regsvr32.exe
3352	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
836	regsvr32.exe
836	regsvr32.exe
836	regsvr32.exe
836	regsvr32.exe
836	regsvr32.exe
836	regsvr32.exe
836	regsvr32.exe
836	regsvr32.exe
2800	regsvr32.exe
2800	regsvr32.exe
2800	regsvr32.exe
2800	regsvr32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dism.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_1001_ld (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-5FDC-4ABA-AFF5-6A39BBD7C38B}\ = "IHost"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-929C-40E8-BF16-FEA557CD8E7E}\ = "ISystemProperties"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-47C7-4A3F-AAE1-1B516817DB41}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8079-447A-A33E-47A69C7980DB}\ = "ISnapshotChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7BA7-45A8-B26D-C91AE3754E37}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4C1B-EDF7-FDF3-C1BE6827DC28}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B7DB-4616-AAC6-CFB94D89BA78}\ = "IGuestProcessInputNotifyEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.Session.1\ = "Session Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486F-40DB-9150-DEEE3FD24189}\ = "IGuestFileReadEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9536-4EF8-820E-3B0E17E5BBC8}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E64A-4908-804E-371CAD23A756}\NumMethods\ = "16"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-647D-45AC-8FE9-F49B3183BA37}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B45C-48AE-8B36-D35E83D207AA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3188-4C8C-8756-1395E8CB691C}\ = "IVRDEServerChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3EE4-11E9-B872-CB9447AAD965}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\ = "Session Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6E15-4F71-A6A5-94E707FAFBCC}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7619-41AA-AECE-B21AC5C1A7E6}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\ProgId	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-73A5-46CC-8227-93FE57D006A6}\ = "IDHCPIndividualConfig"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C196-4D26-B8DB-4C8C389F1F82}\ = "IVirtualSystemDescription"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C196-4D26-B8DB-4C8C389F1F82}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C196-4D26-B8DB-4C8C389F1F82}\ = "IVirtualSystemDescription"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5A1D-43F1-6F27-6A0DB298A9A8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6B76-4805-8FAB-00A9DCF4732B}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-787B-44AB-B343-A082A3F2DFB1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-44A0-A470-BA20-27890B96DBA9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6679-422A-B629-51B06B0C6D93}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-5F86-4D65-AD1B-87CA284FB1C8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9070-4F9C-B0D5-53054496DBE0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-BCB2-4905-A7AB-CC85448A742B}\ = "IGuestProcessOutputEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3188-4C8C-8756-1395E8CB691C}\ = "IVRDEServerChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5637-472A-9736-72019EABD7DE}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.Session.1\ = "Session Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D612-47D3-89D4-DB3992533948}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-787B-44AB-B343-A082A3F2DFB1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-A161-41F1-B583-4892F4A9D5D5}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-A227-4F23-8278-2F675EEA1BB2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4022-DC80-5535-6FB116815604}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1EC6-4883-801D-77F56CFD0103}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-FD1C-411A-95C5-E9BB1414E632}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9070-4F9C-B0D5-53054496DBE0}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B4A4-44CE-85A8-127AC5EB59DC}\ = "ICPUExecutionCapChangedEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4521-44CC-DF95-186E4D057C83}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5FDC-4ABA-AFF5-6A39BBD7C38B}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CC19-43FA-8EBF-BAECB6B9EC87}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0C65-11EA-AD23-0FF257C71A7F}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3E8A-11E9-8082-DB8AE479EF87}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E4B1-486A-8F2E-747AE346C3E9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20191216-1750-46F0-936E-BD127D5BC264}\1.3\HELPDIR\ = "C:\\Program Files\\ldplayer9box"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\ = "IMouse"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80E1-4A8A-93A1-67C5F92A838A}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-BE30-49C0-B315-E9749E1BDED1}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4737-457B-99FC-BC52C851A44F}\ = "IKeyboardLedsChangedEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-A1A9-4AC2-8E80-C049AF69DAC8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-647D-45AC-8FE9-F49B3183BA37}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6E0B-492A-A8D0-968472A94DC7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F7B7-4B05-900E-2A9253C00F51}\NumMethods\ = "28"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1EC0-4C0F-857F-FBE2A737A256}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8084-11E9-B185-DBE296E54799}\ = "IDisplaySourceBitmap"	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1796	LDPlayer9_ens_1001_ld (1).exe
1796	LDPlayer9_ens_1001_ld (1).exe
1796	LDPlayer9_ens_1001_ld (1).exe
1796	LDPlayer9_ens_1001_ld (1).exe
2248	LDPlayer.exe
2248	LDPlayer.exe
2248	LDPlayer.exe
2248	LDPlayer.exe
2248	LDPlayer.exe
2248	LDPlayer.exe
4648	msedge.exe
4648	msedge.exe
4228	msedge.exe
4228	msedge.exe
2248	LDPlayer.exe
2248	LDPlayer.exe
2512	dnrepairer.exe
2512	dnrepairer.exe
4208	powershell.exe
4208	powershell.exe
4632	powershell.exe
4632	powershell.exe
840	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe
Token: SeDebugPrivilege	2248	LDPlayer.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2724	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2248	1796	LDPlayer9_ens_1001_ld (1).exe	90
PID 1796 wrote to memory of 2248	1796	LDPlayer9_ens_1001_ld (1).exe	90
PID 1796 wrote to memory of 2248	1796	LDPlayer9_ens_1001_ld (1).exe	90
PID 1796 wrote to memory of 4228	1796	LDPlayer9_ens_1001_ld (1).exe	91
PID 1796 wrote to memory of 4228	1796	LDPlayer9_ens_1001_ld (1).exe	91
PID 4228 wrote to memory of 1980	4228	msedge.exe	92
PID 4228 wrote to memory of 1980	4228	msedge.exe	92
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 2380	4228	msedge.exe	93
PID 4228 wrote to memory of 4648	4228	msedge.exe	94
PID 4228 wrote to memory of 4648	4228	msedge.exe	94
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95
PID 4228 wrote to memory of 1900	4228	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1001_ld (1).exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1001_ld (1).exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796
- C:\LDPlayer\LDPlayer9\LDPlayer.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=1001 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=721492
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2512
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:1284
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:1376
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1640
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2604
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:200
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:124
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:2200
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4472
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2968
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1296
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2196
  - - C:\Windows\SysWOW64\dism.exe
      C:\Windows\system32\dism.exe /Online /English /Get-Features
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\dismhost.exe {CE8489D1-25B0-4D47-838C-62EE6A183AF9}
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2836
  - - C:\Windows\SysWOW64\sc.exe
      sc query HvHost
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3028
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmms
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:816
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmcompute
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4856
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4848
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:3352
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4592
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:836
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2800
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3180
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2304
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4208
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4632
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:840
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3548
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ldplayer.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb150d3cb8,0x7ffb150d3cc8,0x7ffb150d3cd8
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6864795032251644799,3021970312140687116,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6864795032251644799,3021970312140687116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6864795032251644799,3021970312140687116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6864795032251644799,3021970312140687116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6864795032251644799,3021970312140687116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6864795032251644799,3021970312140687116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,6864795032251644799,3021970312140687116,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:2216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1940

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:124

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2148

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" RenamePC
1⤵
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x0000000000000490
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP120.dll

Path C:\LDPlayer\LDPlayer9\MSVCP120.dll
Size 444KB
SHA256 891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9
MD5 50260b0f19aaa7e37c4082fecef8ff41
SHA1 ce672489b29baa7119881497ed5044b21ad8fe30
SHA512 6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d
SSDEEP 12288:aZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77m:a/8wVwHZFTwFOOos3Ooc8DHkC2e77m
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 51KB
SHA256 27bb89fa0800e7fdf643126551dda3eaa834b1171346010b93fb904076e90f4f
MD5 cb1f1554bd438600eba5a55feda2c653
SHA1 893dcdd3d21568c6d0586fa3590be7c9dcbfa42e
SHA512 65b064ce0496680408f76e7fe3a9946155384864099c1913acb1f88db182277d5d09d4e9cfdff8a8ae821f0037af93ce97bbc76e656831a52714abcdc0da6412
SSDEEP 1536:jPGyMprkvxXb0HOafTRQM4j7Hxfk7Z9x:yyVpVa9QM4je
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 41.9MB
SHA256 d6f0c9d7efe02de528a908285a989cc41903bc34b3448e5638af551ef12f77a5
MD5 cee286a3b75e2e3b92359a54a129a8cf
SHA1 d9708dc4a44c32a25d31eb93b7e0627155c5a871
SHA512 daf84e165437170d2ae029f2092ea9dbde03d6a34d85ac710e679e560333f8c17c6a2fc16ad69adad36ccf29c462f9c92346ca42e163e7a8c4069253456f06c1
SSDEEP 786432:cDC5YCsXMCK3g9cHgEw30nlKsGAIKuUEDqrfsVrZmxSXr2Okab:tPiMRfg+KsGAIMEWrEHmMXaI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.6MB
SHA256 5fda5ba5047c9b6c542eb4643fd42e664838702534a3d1a53ccb0c1af1490965
MD5 be5eb5347c30bc6feba94d103528050a
SHA1 862ff5fd84b1caa34a6298969799a802f1cb3df6
SHA512 15994a163acacbdd5811e21c01a0993c16dcf078cad37b74c95e488cf6c6944c288550a60d1da8e049c24657896370332bf8c0431a7b037614552b43c47a630d
SSDEEP 98304:M8ig03oOpq85eEzZ2AZxHqeLOed24qcGSAvyJKEee0jbcl5h8H7WdzlpCbOcX1H:Hig03h08D/UwOq19uGKob07WdzlkXt
MD5 SHA1 SHA512 SSDEEP

Submit Download

NanumGothicLight.otf

Path C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf
Size 314KB
SHA256 153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2
MD5 e2e37d20b47d7ee294b91572f69e323a
SHA1 afb760386f293285f679f9f93086037fc5e09dcc
SHA512 001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901
SSDEEP 6144:6kyWbmIwXcviKE2SmwxjVGZ/YKNSfuWBl/3DAJHu46ldvtQqu+EGi:6kXbmBZjjaHN2uQlPDAJHu46l16tGi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7za.exe

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe
Size 652KB
SHA256 a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326
MD5 ad9d7cbdb4b19fb65960d69126e3ff68
SHA1 dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d
SHA512 f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7
SSDEEP 12288:aCEg6ksPgamGycPycplunzCke+tMU0gKVDrnI/Anky3ZDHg:aCCks4ECO8zfeJ3rnI/A93FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

cximagecrt.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll
Size 1.5MB
SHA256 91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f
MD5 66df6f7b7a98ff750aade522c22d239a
SHA1 f69464fe18ed03de597bb46482ae899f43c94617
SHA512 48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e
SSDEEP 24576:gzpjfQWnxImuy/53F9F2LZFTSnvZYfHfE0jr8HDYn8HyTdUZ8:g1zQUgVDjwHcn8STW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll
Size 2.0MB
SHA256 c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889
MD5 01c4246df55a5fff93d086bb56110d2b
SHA1 e2939375c4dd7b478913328b88eaa3c91913cfdc
SHA512 39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196
SSDEEP 49152:OvQ/qpyr0kvV+caeJQaNmAtGJv95T8Wrhc1CPwDv3uFfJvBQBGWj:OvQ/qpyr0kvVpbQQGfF851CPwDv3uFfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll
Size 442KB
SHA256 1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334
MD5 2d40f6c6a4f88c8c2685ee25b53ec00d
SHA1 faf96bac1e7665aa07029d8f94e1ac84014a863b
SHA512 4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779
SSDEEP 6144:QQP8Eg6CNxIZHm8Krm0Druftib83NzDR5W1D8/XFIFWTGLvwOir:Q632xIZHmJm3A49mCQr07r
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll
Size 1.2MB
SHA256 2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e
MD5 ba46e6e1c5861617b4d97de00149b905
SHA1 4affc8aab49c7dc3ceeca81391c4f737d7672b32
SHA512 bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6
SSDEEP 24576:TPD+KpPpmuLM3F2f0LXBrkdfbnaJepHm3E7xL/pN1ecj6UtP9RqbNGhqdyY:DguLM3XiGSHt/jBj6UtP9RqkhqdyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssh2.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll
Size 192KB
SHA256 8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f
MD5 52c43baddd43be63fbfb398722f3b01d
SHA1 be1b1064fdda4dde4b72ef523b8e02c050ccd820
SHA512 04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28
SSDEEP 3072:5dv7LPsQZTaBdJAnX0x8YJqZ/2NTBf4+oGlM0W7Ubof:53VaBdmX0x8YJqZ/2NTBQ+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll
Size 511KB
SHA256 b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd
MD5 e8fd6da54f056363b284608c3f6a832e
SHA1 32e88b82fd398568517ab03b33e9765b59c4946d
SHA512 4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b
SSDEEP 12288:PnsHqH+cOyFNn/JliB0B1pDX7k6CAlW711IWU2lvzh1:/sHzcfZG7QWU2lvzh1
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp110.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll
Size 522KB
SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
MD5 3e29914113ec4b968ba5eb1f6d194a0a
SHA1 557b67e372e85eb39989cb53cffd3ef1adabb9fe
SHA512 75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43
SSDEEP 12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr110.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll
Size 854KB
SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
SSDEEP 12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll
Size 283KB
SHA256 72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750
MD5 0054560df6c69d2067689433172088ef
SHA1 a30042b77ebd7c704be0e986349030bcdb82857d
SHA512 418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0
SSDEEP 6144:wLFThsrlPqhXPXpwiKQQg9L8YMcoIyHJPNlK9//ualAcQYLUIaGdY7Y1XiRdQMJ7:aFThsrlPqhXPXpwiHQg9L8xcoIyHJfKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\LDPlayer\LDPlayer9\msvcr120.dll
Size 947KB
SHA256 2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112
MD5 50097ec217ce0ebb9b4caa09cd2cd73a
SHA1 8cd3018c4170072464fbcd7cba563df1fc2b884c
SHA512 ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058
SSDEEP 12288:6BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJSH:SmFyjLF847eiWWcoGZVOIxh/WxIAIbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

phones.data

Path C:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 641B
SHA256 066eebc2468dace9751cf832e64bfe1237489f013bb87122739d49abbe5bb6ef
MD5 e4e7a6ee51e40b998dd70146c087d15c
SHA1 d8ac896871a94b41c592d797ac8da52e8b761cc6
SHA512 9ab6379891e7a53fe95bff880f68821937bece8e51800dd3a68eb5079112443502e675a659e48ec1f4367dd466d822e760cd3dad51865170100f63d54c028385
MD5 SHA1 SHA512

Submit Download

Roboto-Regular.otf

Path C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
Size 1KB
SHA256 2c8581eed907aa1025c61091d8bb14d3a976c2f4409d125e6044bdceda36468c
MD5 a74b4c3d1ea26c6fea7d508cb7731757
SHA1 a5e1add7ded6474f50934c48eebd65af1eefd812
SHA512 002353716cc5edd8c2df8be490c603c7753a9537b754dc81ec4340d8944e1ea30dbd3b21b46a9ffbaaa7be36e91d9bc3f9a792fb59161a3753a9c29a09b0ebb7
MD5 SHA1 SHA512

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_32532FE6EE279C8A04951B3E75CC9341

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_32532FE6EE279C8A04951B3E75CC9341
Size 1KB
SHA256 b707021a7d6a4e1814aac46631831adbcbe1d1b31db6b413b53f08a03ccd23f0
MD5 df2499bda340f0f902eb58c9c31b9d67
SHA1 07db091710ab2db8797628c90822c693ed763555
SHA512 88b33b7e9216e38112f8a4dae5550ac9384fb226cbb746613377d9270e16c1f22969521f7b0b84c668aec2e294267ea3e003fff8af34dc31311199f4fb83cea7
MD5 SHA1 SHA512

Submit Download

B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Size 2KB
SHA256 b6a1d3708326354f491a6db01836fae0a1eb5883e567b4ac937a6963a08ec26e
MD5 a3e07b6bb2ab79b3af4f0460d31b5fa0
SHA1 75716a670d59b771d7bc8c237747d29aa471782d
SHA512 0a2953e305e242eebb884f02db8c5977b27a0d7edcf2966e85d2418b4149d25cda8f90b72abddf25db5f99141c6005406b284521c1a94dbe30a2ca45a55c24ba
MD5 SHA1 SHA512

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 c97374dcce4cc448c34e98b2ce84a71ccfb135831f727cca15d8180ed038033a
MD5 66a6fb411e4cd87fe426f4e08b9eca7c
SHA1 d739a6950147922f04573a522d98f2c7f4a40cfe
SHA512 ae8fd63a042051d3fbe5a715c42050a97127b2a380ebee304382637dc5277adecb5fbd132f17868524b3d4ea307f4a6630f2151b47c20e909f09c7a9aefd93b6
MD5 SHA1 SHA512

Submit Download

75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
Size 434B
SHA256 d6e4843cdf05dd5adde9e30754a6684e6a45c01014d737e19bd623ddf6a3f621
MD5 36d6fe1bc93e6a07fd11df381dbea034
SHA1 3f86074c499c4790f9246024296c52400ad5080b
SHA512 6f117dae96d50d362e494cf4faa25f6afbd9a51038e53de31a2a56e6dafe64e584c1acb4c919fca12346a50edd96a4fff4c9c90d88c0b521b557319a2fba16cc
MD5 SHA1 SHA512

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_32532FE6EE279C8A04951B3E75CC9341

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_32532FE6EE279C8A04951B3E75CC9341
Size 510B
SHA256 888f0e0327015ad9d671d945b7b64181dfade51174087ced89118321a09d57a7
MD5 d38a125f23350524b1f8ab5982ab5b16
SHA1 5d8b57427e2e148abd16bdf88d6775eeafea233f
SHA512 70852a4e2e97f053919f946e3344741b617f20411d6fda55b956e342f4a8a8d8fd3ec164d9c9f16e989216fa37f52568ae88307149c6700c9f8ceabdc78f716b
MD5 SHA1 SHA512

Submit Download

B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Size 458B
SHA256 9e53709ad49d82a720e7d6781017b3a3a6cddf638ff0c1fc11a916e1f8d54d7a
MD5 9ebe185c7bc40730a6c633b59567e359
SHA1 08aa86671ac5b5964b70dd5bab1dc054c3ba4fe9
SHA512 6254f4ae6d36a7bbd4e6199635cb35b98629ca9f7213b04088bd3a61a373e83cc84ac54dc0ebb3b238ab10037a0a84d265c3fee19cf2e80d97b10bbf81f1e572
MD5 SHA1 SHA512

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 da150ebf4bf25aee46c7c0f3aa48dbb9a2e08ba8d402f0e1e8e059819045bc25
MD5 b67a004bdebaa8702065dcae5252cae5
SHA1 d684c2e3a7b04a065cea30776d4f246efce23ce6
SHA512 dbb04350402f01355041c7e388a7e6d182af2e27c385516facdf24a48597ade4cea4aa71348ca81a1f6ed72244ceeb45c4d3146991ba66c68fbba03e17a0c1d5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d
MD5 b0177afa818e013394b36a04cb111278
SHA1 dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5
SHA512 d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f
MD5 9af507866fb23dace6259791c377531f
SHA1 5a5914fc48341ac112bfcd71b946fc0b2619f933
SHA512 c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7
MD5 SHA1 SHA512

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c
Size 1024KB
SHA256 64f6d8d15569c832dd126f8696b8a15829725c935edab77a3564290e73482664
MD5 7d8aefeab0bcd1be8acd0ed001304445
SHA1 9056cd863c8363f2fd6da9089f46080625b8688d
SHA512 5198f74293ec4f0cb01bb1c57a6dc056a248195ddb462a9e419c99a40e936f8a49b080050a42bf59fc571e7ef68b9e8cc82f6b851ba773d92d37c02dbfabade8
SSDEEP 24576:Ps2tZ0qQv6rlBux4qFq3vTjNs8PwTEOXBJZq7mD4vEznLQKqJ:Ps2tBQvKlBuFF0l9I3XBJKmMiqJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 52c865e56d2af02fc8f3103206fcf2c9e412419c75b0137a70ede5dee42cb285
MD5 006934e7c60c338a1993b0dbe094e3a3
SHA1 12490eed5377639a21817fcaad38d6b83864a729
SHA512 5952f7dfb9b6e486b1c25ef13ebbda101217db36892ed75c5b5830d2b8b451c09397d98ee6e8764c6b71e168a14253c2fb2a90595daa8b30f1f16bda7b23ddce
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e163ad457e02ca079e32ce2bf86bf6b92e78897830befab7589c9e24d0f1ec96
MD5 dfe68153fc821888758e14266a62dec0
SHA1 f9333b83876705014e957ef37ef04b12973c0e59
SHA512 d8ade8fad0809b1f2979a1a5356328f9d37c52997ac987cc5bead26e3269dd814ef58d5ec2312f55cf37b0073021a12884dc0a10a9eea7d1f044312de095237b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3713cdbe4b6fbcbeda5fda75b2d4fc9ddbd54a83b6d13269b46e18141498f3d2
MD5 43c18f30d3ade2e81f2f5203877dd935
SHA1 0589c0ec0a1bfe22b3d0ba5f0871fc7949a58444
SHA512 5ac08c832678ab02d50db0e563204fd4d2aaf2290dcc29bda8ecf79ffe1a617de71f4752c9d7e3c8a5284e03dbdd4507f25e31dd767f4a578016664b261d7029
SSDEEP 96:nDk3EzICp0kvSVwSv0MoiHCR5mdPdu2150Gea2I6Jyg0WQyV+VpAiX3wI3:nDk3Up0k2v0MiOu2T0Gea2IQ1Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 11146e212d4d70f923fab8d4a095aafc58bf59eff57ea7ff909a949a193de5de
MD5 34e9119cb2268cf48e5b4adeb71fafce
SHA1 ac7b6d0d2355edbfb8a5047d6f1c5ce3d47e8bc9
SHA512 b27ee178f75d0a74722b4f29206144a514e79e29eca1a85eb3a4a14914b7bc8e54dc10be478fd46bfb8c6362f2f07b383a8e3e319d55652b3b7c8fadf250d9ce
SSDEEP 96:nDk3t0Cp0kawSv0MoiVmdHIAJNS0WQyV+VpziX3wI3:nDk3ttp0kav0MAI2kLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 14cfbdae4cb363f83e44821627307c3dea5021b2d70be02a3a0bc6ff4685c1c0
MD5 1ff6cce1fe4f492e80818c6a3d9f05c4
SHA1 0a7a5dd5c13cfc9346828d7c5e9f59107d8e50d8
SHA512 868df7eaf000da0e498c5d2d374f5b67c3f89a073b2dfb747686a25c7c21bc59c17c23be505d548973df0811e60884959a4d5e74e0a5ae8dba9d1e590b38ca6a
SSDEEP 192:r1oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGfo6e2RURTRB6uoQ8wx0Yv/u:d9iIxuERzA83h09RZxASGpu2uoQQY8RZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AssocProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\AssocProvider.dll
Size 136KB
SHA256 21ad24a767aeb22d27d356bc8381f103ab620de1a47e374b9f961e44b543a358
MD5 702f9c8fb68fd19514c106e749ec357d
SHA1 7c141106e4ae8f3a0e5f75d8277ec830fc79eccc
SHA512 2e7d403c89dacdda623ed1a107bac53aafde089fdd66088d578d6b55bcfe0a4fc7b54733642162bd62d0ca3f1696667a6f0cb4b572d81a6eefd6792d6003c0d9
SSDEEP 3072:kaiR7O/lP9mL/w/Js/I0gldE+QU+JMh3wTHCno:kasi/l19/JmgldNPhmx
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismCorePS.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\DismCorePS.dll
Size 200KB
SHA256 db995f4f55d8654fc1245da0df9d1d9d52b02d75131bc3bce501b141888232fc
MD5 7f751738de9ac0f2544b2722f3a19eb0
SHA1 7187c57cd1bd378ef73ba9ad686a758b892c89dc
SHA512 0891c2dedb420e10d8528996bc9202c9f5f96a855997f71b73023448867d7d03abee4a9a7e2e19ebe2811e7d09497bce1ea4e9097fcb810481af10860ff43dfb
SSDEEP 1536:nDiqbsdYfXhuE8RouT/FdJMs9xlYkP1yhi1n17+EqtoqCIE06cNHP0G:tUEIouT/FdJP1Mi1vqto7v0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismHost.exe

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\DismHost.exe
Size 168KB
SHA256 dead0ebd5b5bf5d4b0e68ba975e9a70f98820e85d056b0a6b3775fc4df4da0f6
MD5 17275206102d1cf6f17346fd73300030
SHA1 bbec93f6fb2ae56c705efd6e58d6b3cc68bf1166
SHA512 ce14a4f95328bb9ce437c5d79084e9d647cb89b66cde86a540b200b1667edc76aa27a36061b6e2ceccecb70b9a011b4bd54040e2a480b8546888ba5cc84a01b3
SSDEEP 3072:u6bLa/eoNP/VYbxYxVipvxx9hXD0L6/Dk6F62G0rrqw:u6q/eMYbxYxAVxr1DY6v62G0l
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismProv.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\DismProv.dll
Size 292KB
SHA256 006464f42a487ab765e1e97cf2d15bfa7db76752946de52ff7e518bc5bbb9a44
MD5 2ac64cc617d144ae4f37677b5cdbb9b6
SHA1 13fe83d7489d302de9ccefbf02c7737e7f9442f9
SHA512 acdb2c9727f53889aa4f1ca519e1991a5d9f08ef161fb6680265804c99487386ca6207d0a22f6c3e02f34eaeb5ded076655ee3f6b4b4e1f5fab5555d73addfd7
SSDEEP 6144:G5cwM105c71F1yLcmi13uBo8Sxdxym3gqOU2Wu:G5cz105cBF0LcmiPf3Xij
MD5 SHA1 SHA512 SSDEEP

Submit Download

EdgeProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\EdgeProvider.dll
Size 200KB
SHA256 eb68c7d48f78b46933acba617cf3b5fcb5b8695c8a29295a9fa075f36910825b
MD5 c22cc16103ee51ba59b765c6b449bddb
SHA1 b0683f837e1e44c46c9a050e0a3753893ece24ad
SHA512 2c382aaddeca4efda63162584c4a2338ffcc1f4828362ce7e927e0b39c470f1f66a7933ae2210d63afb5a2ae25412266fde2ee6bdb896c3c030bdc08b67ec54e
SSDEEP 3072:LLmV5hyl8O5hBi38PFbh/NWHhNqF6yYLeBd9d9d92i+F3vljfWJjJ8fd:LLmbIl/5hk38PFvWBNqFXYLeUiddJi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ffuprovider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\Ffuprovider.dll
Size 680KB
SHA256 57ce7761531058f3c4289b1240bea6dc06355c9c4b4e88b9c9c0df8012edc5b3
MD5 a41b0e08419de4d9874893b813dccb5c
SHA1 2390e00f2c2bc9779e99a669193666688064ea77
SHA512 bd370e49da266148d50144c621f6415bdd5358e6274b1d471b8d4ee1888d93774331c3f75e6cb99782f1c8e772981cbc5a4baf5592c6400f340407dc670e547a
SSDEEP 12288:2Bc7EGpjRrvwg1oYZao+A5MYU1uaZZPunSvGpVQzsVo:2OQGpjRrvb1oYvnUc0HuV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImagingProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\ImagingProvider.dll
Size 248KB
SHA256 f1bbab35b2602d04d096c8de060b2a5cf802499a937fd1ffe749ff7f54852137
MD5 4c6d681704e3070df2a9d3f42d3a58a2
SHA1 a9f6286ac25f17b6b2acd1fce6459b0bc94c6c81
SHA512 daa0c723312680256c24457162e0ef026b753ba267f3e2755f838e2864a163802c078d8668dd2c2064cb8887f4e382a73d6402a5533b6ac5c3cbf662ad83db86
SSDEEP 6144:I/8j1wVGBFsGk1S/FjRSPIg4wFlbCW+GZANJ:I/8ZhsD1S/Fjsb+4C
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntlProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\IntlProvider.dll
Size 312KB
SHA256 aac13ddb9ab5a165a38611f1b61229268a40d416f07740d4eefba1a8fcf7c731
MD5 34035aed2021763bec1a7112d53732f1
SHA1 7132595f73755c3ae20a01b6863ac9518f7b75a4
SHA512 ea045aa46713133a5d0ad20514cc2a8c8fffb99b4e19c4d5262f86167cfce08a31d336222fd3c91e6efbfd90312bb2325337aa02a8489e047b616085fdf46c1d
SSDEEP 6144:pF4xGRPfWkASBdeutMLQ2u3WTxTBgzEZiIExLYvSmEjZ9SOL/:pQGRPf7ASBQ7humDcEZ3mYqftL/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\LogProvider.dll
Size 108KB
SHA256 56aca41c62c8d0d1b26db3a01ef6c2da4a6a51fc963eb28411f8f7f029f1bfde
MD5 c63f6b6d4498f2ec95de15645c48e086
SHA1 29f71180feed44f023da9b119ba112f2e23e6a10
SHA512 3a634340d8c66cbc1bef19f701d8bdb034449c28afecce4e8744d18181a20f85a17af3b66c8853cecb8be53f69ae73f85b70e45deac29debab084a25eb3c69dc
SSDEEP 3072:OcWhdZh3LH2F6dxcd5+suyufoMX0Igx7DAJoNQrw:OcWfHbWF6dxM5nuwMX0Igx7DAJoNP
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\OSProvider.dll
Size 180KB
SHA256 ec137f9caebcea735a9386112cf68f78b92b6a5a38008ce6415485f565e5cf85
MD5 e9833a54c1a1bfdab3e5189f3f740ff9
SHA1 ffb999c781161d9a694a841728995fda5b6da6d3
SHA512 0b18932b24c0257c80225c99be70c5125d2207f9b92681fd623870e7a62599a18fa46bcb5f2b4b01889be73aeb084e1b7e00a4968c699c7fdb3c083ef17a49f9
SSDEEP 3072:BB8yo2sMg0UGPZiWmiIjt/c+84+AJV7woP97Pn8HdMWij:BB8R2sMptajhcH4LtJPn8HE
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfflineSetupProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\OfflineSetupProvider.dll
Size 213KB
SHA256 8b247665218f5151f0d19f59ea902a7c28f745d67a5d51b63b77242ffb4bdd74
MD5 3437087e6819614a8d54c9bc59a23139
SHA1 ae84efe44b02bacdb9da876e18715100a18362be
SHA512 018e88f6c121dd4ecaceb44794e2fa7a44b52ddb22e7a5a30a332905e02065cbc1d1dcddc197676277b22f741195c1b7c4c185d328b096b6560b84e9749d6dde
SSDEEP 6144:uknE5hYZ4yjhHDWLcKKCCc3Kh5b5L3ru1VGDtBx:uknE5hYZdHdKs3KSZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProvProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\ProvProvider.dll
Size 800KB
SHA256 4915b0c9cd8dc8a29dd649739974d244f9105dc58725f1da0d592af3b546e2bf
MD5 2ef388f7769205ca319630dd328dcef1
SHA1 6dc9ed84e72af4d3e7793c07cfb244626470f3b6
SHA512 b465917424dd98125d080c135c7e222a9485ed7ec89004f9a70e335b800e5b9419fbc932c8069bae9ff126494174cf48e2790030dd22aa2d75b7b9d8ccff752b
SSDEEP 24576:3cnsk1TMoJLkGQhmEoQL8gpBAyPW5EJEuv+9Uipg8URQ:3cnsk1TMoJLkGQht3L8gp1W5Eium9Ui1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ServicingCommon.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\ServicingCommon.dll
Size 944KB
SHA256 be75afbbc30cad7235adf03dcc07fcee3c0c330c89b00e326ebbef2e57df5935
MD5 07231bdae9d15bfca7d97f571de3a521
SHA1 04aec0f1afcf7732bc4cd1f7aab36e460c325ba6
SHA512 2a46e0657e84481faf5c9d3de410884cb5c6e7b35039f5be04183cdac6c088cc42b12d0097e27836af14699e7815d794ca1cec80960833ab093b8dc6d44e2129
SSDEEP 24576:bCW97/8sbipN+B/bN6lmX1xSUMOIrWaaY90I8dDHPR7UvPT:bCW97/8sbi2B/pRHIrWaaY6I8lJ7UvPT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysprepProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\SysprepProvider.dll
Size 820KB
SHA256 901cea68c7a158a1d9c030d3939f8f72057d1cf2f902aec1bc1b22a0000c0494
MD5 4dfa1eeec0822bfcfb95e4fa8ec6c143
SHA1 54251e697e289020a72e1fd412e34713f2e292cf
SHA512 5f3f710bef75da8cddb6e40686d6a19f59fbc7d8a6842eaceb9a002ab284a91ecf48c352171e13f6a75366610988e67710439f1dde579311ebbb3cd9e4751aa4
SSDEEP 12288:z7iAEht8j7iaTzcPi1Bf5WAqr151lrrhTyqTyvj6jljcjFdC6:zOAEht8jOaPc4fi13lXw/j6jljcjFf
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransmogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\TransmogProvider.dll
Size 1.3MB
SHA256 b20b3eb2df22998fd7f9ff6898ba707d6b8833a8274719a5e09d5148d868faaf
MD5 c1c56a9c6ea636dbca49cfcc45a188c3
SHA1 d852e49978a08e662804bf3d7ec93d8f6401a174
SHA512 f6db05e4644d734f81c2461e4ad49c4e81880c9e4beee13dbbda923360ef6cf4821fccd9040671b86ab2cd8c85fc313c951c1a69e4df14d94268753ce7ae5b2e
SSDEEP 12288:pEFAXpw+9lMTYwnY/ksZhniBDJUzlkbIa0DCYclUC:bXpw+9lhwnAi1JQkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnattendProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\UnattendProvider.dll
Size 256KB
SHA256 3665872e68264bbf3827c2bf0cfa60124ea1d87912728f2fc3685dce32855cb8
MD5 7c61284580a6bc4a4c9c92a39bd9ea08
SHA1 4579294e3f3b6c03b03b15c249b9cac66e730d2a
SHA512 b30b89d0d5e065042811d6ff397d226877ff698aeb1153681692aedabe3730e2f3746ad9d70e3120e336552bab880644f9ead0c91a451197a8f0977a2126a0fe
SSDEEP 6144:I7s9GR9JzcVCGNJSHSSu3zne0/hbT1vxtATg:I7s9GR9J70JSyb7b1vxog
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vhdprovider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\Vhdprovider.dll
Size 596KB
SHA256 d3a2dd7d47bfbb3897b927d1b7230b5b12e5fd7315d687458de15fbb08fb7e27
MD5 8a655555544b2915b5d8676cbf3d77ab
SHA1 5a7529f8a6d50d3f4e13b2e3a0585f08eb0511a2
SHA512 c6da649ae3c3688065b37bccfb5525ade25ba7bc3b163ad7d61f3b3d1c4957c8fd6c9f2bf23b0dbc4fffe32e980acb5a5d3895b8a012c5ed086e3e38caee2e93
SSDEEP 12288:NpYtyy4AHBveMJR+ko2fixilfF/FTup0C3EPuvsbobBxvoOG6mqTmHIp0dhLIJF9:/gyy4AHBveMboZxKfF/Jup0QEPgsbonZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WimProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\9989ADAA-3D00-4795-A7C3-CBA7F42E2D65\WimProvider.dll
Size 672KB
SHA256 78b742deddee8305ea06d77f296ad9fe0f4b4a27d71b34dcdff8ae199364790c
MD5 bcf8735528bb89555fc687b1ed358844
SHA1 5ef5b24631d2f447c58b0973f61cb02118ae4adc
SHA512 8b2be4e9a4334a5fc7f7c58579c20974c9194b771f7a872fd8e411d79f45fc5b7657df4c57ad11acb915d5ea5d1f0583c8a981b2c05104e3303b3ee1469b93f5
SSDEEP 12288:eiudpGAJaCfLUeZigXV+P4rY68YLhNH9wnHjdjfM4P7a:eiubGAJaCoeZigFXrWYr9wHjdQOa
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ozi0lvfw.cf0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozi0lvfw.cf0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 19KB
SHA256 4e52e0f9d2d16917f30a45ec64085fcd8befec2625c07cdceb8000941eb835df
MD5 c8efce384cb4110b965fe943238d9593
SHA1 4b1c4751b6d590c84a3102bf02939fa70d37c072
SHA512 79214932e93bd30b5d02e58154c3471f11c9bc08ed3506ff87e0096bb77d32d44bd0f8c8d4b7054a4c8eb73ff01a3686060f8349d3e85556eeade7ed526af769
SSDEEP 384:5m+bzyn691q7DoZ/UOyFnQ59FYEWPa8OTQ:5m/j5
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 23KB
SHA256 4a890e152098a5dcde2ee462f1ac275b134eb591809001f68368488fd15e6b74
MD5 15cd329933a9728096ae818ca96b37a1
SHA1 7d1edc3bb78c692f029e896bc82407debb02cb54
SHA512 0f7055a7f178ea45ff7ff15882119128bddaaf41b4e70779285cd9db61f13b3a803ddf3c7be027e01a5deb0e236679792d29cd883616e0b736e75a611284215e
SSDEEP 384:5m+bzyn691q7DoZ/UOyFnQ59FYEWPa8OTDKhAnulhKnP9Ci:5m/jC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/840-1025-0x000000006E6A0000-0x000000006E6EC000-memory.dmp

Download

memory/4208-965-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Download

memory/4208-989-0x00000000073C0000-0x0000000007464000-memory.dmp

Download

memory/4208-993-0x0000000007770000-0x0000000007806000-memory.dmp

Download

memory/4208-994-0x00000000076F0000-0x0000000007701000-memory.dmp

Download

memory/4208-996-0x0000000007810000-0x000000000782A000-memory.dmp

Download

memory/4208-995-0x0000000007730000-0x000000000773E000-memory.dmp

Download

memory/4208-962-0x00000000029D0000-0x0000000002A06000-memory.dmp

Download

memory/4208-990-0x0000000007B30000-0x00000000081AA000-memory.dmp

Download

memory/4208-991-0x00000000074E0000-0x00000000074FA000-memory.dmp

Download

memory/4208-992-0x0000000007560000-0x000000000756A000-memory.dmp

Download

memory/4208-978-0x0000000006770000-0x00000000067A4000-memory.dmp

Download

memory/4208-979-0x000000006E6A0000-0x000000006E6EC000-memory.dmp

Download

memory/4208-988-0x00000000073A0000-0x00000000073BE000-memory.dmp

Download

memory/4208-977-0x00000000061C0000-0x000000000620C000-memory.dmp

Download

memory/4208-976-0x0000000006190000-0x00000000061AE000-memory.dmp

Download

memory/4208-966-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/4208-975-0x0000000005CD0000-0x0000000006027000-memory.dmp

Download

memory/4208-964-0x0000000005310000-0x0000000005332000-memory.dmp

Download

memory/4208-963-0x0000000005410000-0x0000000005A3A000-memory.dmp

Download

memory/4632-1007-0x000000006E6A0000-0x000000006E6EC000-memory.dmp

Download