Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 12:55

General

  • Target

    LDPlayer9_fr_com.alightcreative.motion_8110_ld.exe

  • Size

    2.5MB

  • MD5

    6908b774daad336d0ab1c55f55c344c4

  • SHA1

    04ea8a943ca41fe152a4c2ec99ede83967d546f3

  • SHA256

    10c59dd6cef6195616ec76184885c1ed1134f9c2ca801652c81a018d040ebbe4

  • SHA512

    aa283489d2474f7b8a5f2bb6f524aa5c3f99932b61e52737db36b8cc7b168e6040217ec69860592e473fab6df5597cc30ce79c23b17805f6cf3c854f41d41de8

  • SSDEEP

    49152:GNfatughHaKLIKN1cueXlaYbsISTb/am5B8y6sEUhSSwoUK0:Gla4ghHaKMu2IYbsIW/amj8yF8SE

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
  • Manipulates Digital Signatures 1 TTPs 64 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Possible privilege escalation attempt 6 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 15 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LDPlayer9_fr_com.alightcreative.motion_8110_ld.exe
    "C:\Users\Admin\AppData\Local\Temp\LDPlayer9_fr_com.alightcreative.motion_8110_ld.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\LDPlayer\LDPlayer9\LDPlayer.exe
      "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=8110 -language=fr -path="C:\LDPlayer\LDPlayer9\"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3076
      • C:\LDPlayer\LDPlayer9\dnrepairer.exe
        "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=524570
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Windows\SysWOW64\net.exe
          "net" start cryptsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start cryptsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2232
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Softpub.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:3824
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Wintrust.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:1876
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" Initpki.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4404
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32" Initpki.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3336
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" dssenh.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4288
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" rsaenh.dll /s
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1240
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" cryptdlg.dll /s
          4⤵
          • Manipulates Digital Signatures
          • System Location Discovery: System Language Discovery
          PID:2848
        • C:\Windows\SysWOW64\takeown.exe
          "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:5004
        • C:\Windows\SysWOW64\icacls.exe
          "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:4012
        • C:\Windows\SysWOW64\takeown.exe
          "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2760
        • C:\Windows\SysWOW64\icacls.exe
          "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:884
        • C:\Windows\SysWOW64\dism.exe
          C:\Windows\system32\dism.exe /Online /English /Get-Features
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3196
          • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\dismhost.exe
            C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\dismhost.exe {4EAB3656-78C1-4A96-8305-362605D5DA93}
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2116
        • C:\Windows\SysWOW64\sc.exe
          sc query HvHost
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3364
        • C:\Windows\SysWOW64\sc.exe
          sc query vmms
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5080
        • C:\Windows\SysWOW64\sc.exe
          sc query vmcompute
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2380
        • C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
          "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3996
        • C:\Windows\SYSTEM32\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
          4⤵
          • Loads dropped DLL
          PID:3968
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3044
        • C:\Windows\SYSTEM32\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1072
        • C:\Windows\SysWOW64\regsvr32.exe
          "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2760
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3796
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc" start Ld9BoxSup
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1684
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2800
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3924
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:672
      • C:\LDPlayer\LDPlayer9\driverconfig.exe
        "C:\LDPlayer\LDPlayer9\driverconfig.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4636
      • C:\Windows\SysWOW64\takeown.exe
        "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:4980
      • C:\Windows\SysWOW64\icacls.exe
        "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:5004
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4bUcwDd53d
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee8d946f8,0x7ffee8d94708,0x7ffee8d94718
        3⤵
          PID:2528
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
          3⤵
            PID:2252
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4784
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
            3⤵
              PID:4084
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
              3⤵
                PID:5084
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
                3⤵
                  PID:5080
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
                  3⤵
                    PID:2316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4032 /prefetch:8
                    3⤵
                      PID:1156
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,16830960998153549741,4088402521641175380,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4384 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4948
                  • C:\LDPlayer\LDPlayer9\dnplayer.exe
                    "C:\LDPlayer\LDPlayer9\\dnplayer.exe" downloadpackage=com.alightcreative.motion|package=com.alightcreative.motion
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Modifies Internet Explorer settings
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2896
                    • C:\Windows\SysWOW64\sc.exe
                      sc query HvHost
                      3⤵
                      • Launches sc.exe
                      • System Location Discovery: System Language Discovery
                      PID:2700
                    • C:\Windows\SysWOW64\sc.exe
                      sc query vmms
                      3⤵
                      • Launches sc.exe
                      • System Location Discovery: System Language Discovery
                      PID:4148
                    • C:\Windows\SysWOW64\sc.exe
                      sc query vmcompute
                      3⤵
                      • Launches sc.exe
                      • System Location Discovery: System Language Discovery
                      PID:4792
                    • C:\Program Files\ldplayer9box\vbox-img.exe
                      "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
                      3⤵
                      • Executes dropped EXE
                      PID:1208
                    • C:\Program Files\ldplayer9box\vbox-img.exe
                      "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
                      3⤵
                      • Executes dropped EXE
                      PID:672
                    • C:\Program Files\ldplayer9box\vbox-img.exe
                      "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
                      3⤵
                      • Executes dropped EXE
                      PID:5080
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://fr.ldplayer.net/blog/comment-activer-la-vt.html
                      3⤵
                      • Enumerates system info in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:6140
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffee8d946f8,0x7ffee8d94708,0x7ffee8d94718
                        4⤵
                          PID:5184
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14042241760004759010,1344943804411309159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
                          4⤵
                            PID:5432
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14042241760004759010,1344943804411309159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5440
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14042241760004759010,1344943804411309159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
                            4⤵
                              PID:3836
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14042241760004759010,1344943804411309159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
                              4⤵
                                PID:4928
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14042241760004759010,1344943804411309159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
                                4⤵
                                  PID:432
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14042241760004759010,1344943804411309159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
                                  4⤵
                                    PID:5036
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x4ec 0x464
                              1⤵
                                PID:1840
                              • C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
                                "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
                                1⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                PID:3580
                                • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3168
                                • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2356
                                • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2512
                                • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4412
                                • C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
                                  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2380
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2980
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:2792
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3984
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4412
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:5912

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\LDPlayer\LDPlayer9\MSVCP120.dll

                                          Filesize

                                          444KB

                                          MD5

                                          50260b0f19aaa7e37c4082fecef8ff41

                                          SHA1

                                          ce672489b29baa7119881497ed5044b21ad8fe30

                                          SHA256

                                          891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9

                                          SHA512

                                          6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

                                        • C:\LDPlayer\LDPlayer9\crashreport.dll

                                          Filesize

                                          51KB

                                          MD5

                                          1eb5ffaa41c73d028b4108eef962fb7f

                                          SHA1

                                          bba9bcb8a064fdf68a79bae656f11ba039c9cc77

                                          SHA256

                                          421b885202b3bfe4c7e5f9281c17f836df1de98db6d14c6590eabf4d8153a6af

                                          SHA512

                                          148863b577f7d9fc25225e8dfd3f01d4865afb1596dd320bbd0451fae9d173fc1e15105f0e98352bffb6c36a2462e3d8292ce6db8877b0b921b304be1ba2b879

                                        • C:\LDPlayer\LDPlayer9\dnmultiplayer.exe

                                          Filesize

                                          1.3MB

                                          MD5

                                          03746b5d567927bdb69499ec30039d8c

                                          SHA1

                                          93b08624bd80ed01c370e0ba9a2ee3824edd8733

                                          SHA256

                                          1e3b7a0ac94de0e7209b19b709a0ddd2effbc1b98437a81b3d3dac853ef54b77

                                          SHA512

                                          abf608e020e732407524b780bed7b894768f9828dbbecb1a66c9b6d8cb079380646bc228dce5f1bdbef4b089b241574a22c79eee3271a623cd05e7754ad83e19

                                        • C:\LDPlayer\LDPlayer9\dnplayer.exe

                                          Filesize

                                          3.6MB

                                          MD5

                                          2c8986ce6c1c5fcba4146f642e95d862

                                          SHA1

                                          a913254e6a9bd1db7825f9880a992f21a6827bd7

                                          SHA256

                                          07285fcc8e65f164c8897ebdb63dc44801dae28782a6b2ee5f3469c64952efd6

                                          SHA512

                                          a5b074ad394b75f2597007ca732f5e1b877fae483122332dbcaecfea0c6c52a658df8b5844e60280766fcd38333dfac3a259c159c405a83ea6b78691405203d5

                                        • C:\LDPlayer\LDPlayer9\dnrepairer.exe

                                          Filesize

                                          41.9MB

                                          MD5

                                          5115ad2e73db8f2c00f9328c97469e0a

                                          SHA1

                                          552a24ab6bf961d84b1211f0b9d083c24c36781e

                                          SHA256

                                          19b8c6fa38f2fcc728acb3a110ab4bcdb49648440957a75ecc107c84f3eb7be3

                                          SHA512

                                          7ea61e22a4d036a690ed6fdb6fe05464c0430cc4811930815d6d7281f99c2895e7956b90ec255f59020da82c6f7ae32a9ac780e9d4464a05d4f680119a4ec739

                                        • C:\LDPlayer\LDPlayer9\dnresource.rcc

                                          Filesize

                                          5.6MB

                                          MD5

                                          8556c04c551d35d6a80ebaef4bde9af1

                                          SHA1

                                          158feb0ecf4a6c5cdd93169cdac4c8f10db6f85d

                                          SHA256

                                          7dd496d6acdc405576d42cb50956c203f7aa69080c65e587b1629f45d0b52ee7

                                          SHA512

                                          b29ec3d8833e96ec672ac7378b86bbcd3a9a306d01ae7acb143f68686fc7416a22cf09f315cbfad0e38aa2e7d8595df2584e38bd6d9b1f3173f7b1b7b49da227

                                        • C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf

                                          Filesize

                                          314KB

                                          MD5

                                          e2e37d20b47d7ee294b91572f69e323a

                                          SHA1

                                          afb760386f293285f679f9f93086037fc5e09dcc

                                          SHA256

                                          153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2

                                          SHA512

                                          001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe

                                          Filesize

                                          652KB

                                          MD5

                                          ad9d7cbdb4b19fb65960d69126e3ff68

                                          SHA1

                                          dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d

                                          SHA256

                                          a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326

                                          SHA512

                                          f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll

                                          Filesize

                                          1.5MB

                                          MD5

                                          66df6f7b7a98ff750aade522c22d239a

                                          SHA1

                                          f69464fe18ed03de597bb46482ae899f43c94617

                                          SHA256

                                          91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f

                                          SHA512

                                          48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll

                                          Filesize

                                          2.0MB

                                          MD5

                                          01c4246df55a5fff93d086bb56110d2b

                                          SHA1

                                          e2939375c4dd7b478913328b88eaa3c91913cfdc

                                          SHA256

                                          c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889

                                          SHA512

                                          39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll

                                          Filesize

                                          442KB

                                          MD5

                                          2d40f6c6a4f88c8c2685ee25b53ec00d

                                          SHA1

                                          faf96bac1e7665aa07029d8f94e1ac84014a863b

                                          SHA256

                                          1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334

                                          SHA512

                                          4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll

                                          Filesize

                                          1.2MB

                                          MD5

                                          ba46e6e1c5861617b4d97de00149b905

                                          SHA1

                                          4affc8aab49c7dc3ceeca81391c4f737d7672b32

                                          SHA256

                                          2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e

                                          SHA512

                                          bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll

                                          Filesize

                                          192KB

                                          MD5

                                          52c43baddd43be63fbfb398722f3b01d

                                          SHA1

                                          be1b1064fdda4dde4b72ef523b8e02c050ccd820

                                          SHA256

                                          8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f

                                          SHA512

                                          04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll

                                          Filesize

                                          511KB

                                          MD5

                                          e8fd6da54f056363b284608c3f6a832e

                                          SHA1

                                          32e88b82fd398568517ab03b33e9765b59c4946d

                                          SHA256

                                          b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd

                                          SHA512

                                          4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll

                                          Filesize

                                          522KB

                                          MD5

                                          3e29914113ec4b968ba5eb1f6d194a0a

                                          SHA1

                                          557b67e372e85eb39989cb53cffd3ef1adabb9fe

                                          SHA256

                                          c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a

                                          SHA512

                                          75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll

                                          Filesize

                                          854KB

                                          MD5

                                          4ba25d2cbe1587a841dcfb8c8c4a6ea6

                                          SHA1

                                          52693d4b5e0b55a929099b680348c3932f2c3c62

                                          SHA256

                                          b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49

                                          SHA512

                                          82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6

                                        • C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll

                                          Filesize

                                          283KB

                                          MD5

                                          0054560df6c69d2067689433172088ef

                                          SHA1

                                          a30042b77ebd7c704be0e986349030bcdb82857d

                                          SHA256

                                          72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750

                                          SHA512

                                          418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0

                                        • C:\LDPlayer\LDPlayer9\msvcr120.dll

                                          Filesize

                                          947KB

                                          MD5

                                          50097ec217ce0ebb9b4caa09cd2cd73a

                                          SHA1

                                          8cd3018c4170072464fbcd7cba563df1fc2b884c

                                          SHA256

                                          2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112

                                          SHA512

                                          ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

                                        • C:\LDPlayer\LDPlayer9\phones.data

                                          Filesize

                                          5KB

                                          MD5

                                          fdee6e3ccf8b61db774884ccb810c66f

                                          SHA1

                                          7a6b13a61cd3ad252387d110d9c25ced9897994d

                                          SHA256

                                          657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4

                                          SHA512

                                          f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512

                                        • C:\LDPlayer\LDPlayer9\vms\config\leidian0.config

                                          Filesize

                                          641B

                                          MD5

                                          42d145c6123447e9899ed0b6be915f11

                                          SHA1

                                          cc69c75df734aca84bac2c47412d29274155e16c

                                          SHA256

                                          3f5bf17faa3c8f8c203cf91faa55044e51fce4d28c12d2f571d7e49c950bf747

                                          SHA512

                                          3b836ef4e890966ea4148184d01cb505573426f00bb4f821c6d2d632328b2a150e0799a81571a68e274a626211bd87e9d91bf3d91a96c7c2b11efca9c27c2997

                                        • C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk

                                          Filesize

                                          35.1MB

                                          MD5

                                          4d592fd525e977bf3d832cdb1482faa0

                                          SHA1

                                          131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef

                                          SHA256

                                          f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6

                                          SHA512

                                          afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77

                                        • C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf

                                          Filesize

                                          103KB

                                          MD5

                                          4acd5f0e312730f1d8b8805f3699c184

                                          SHA1

                                          67c957e102bf2b2a86c5708257bc32f91c006739

                                          SHA256

                                          72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5

                                          SHA512

                                          9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

                                          Filesize

                                          1KB

                                          MD5

                                          fd20bcb90b609d3cab2256118aeb19bd

                                          SHA1

                                          fbf128044c579616c874d91664f00db6adaacc8d

                                          SHA256

                                          e23d008489b2aa9c04d1c2dd06d122274edafb8f6999d6367f9e86f11e38b4f6

                                          SHA512

                                          d5185d877c1e146935339218d28e707ea5e52c41fa8790f09dd7643c06641c366ad5eff9774c682343718578269ef6b45328a49d91231cae407821216215a072

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                          Filesize

                                          2KB

                                          MD5

                                          afeb0d34f50c1ec9bf864257c72ae0ff

                                          SHA1

                                          a1e3da7d28f81c360c8d5d4cd38211f34dfc02fb

                                          SHA256

                                          6afe8843587fe041de29133b3e2712d9ba9d5239bbb4c5ac1bbdd80b0a2a37ed

                                          SHA512

                                          1fd912913c928c9adf25e22cb989a07b40e8e292ba298d15f90a4455f8600dc28707f6e58f013019eaa3095eda2c52a63f975afa2073cec5b17f1f3da2cc7831

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                          Filesize

                                          1KB

                                          MD5

                                          7908456de43cc8c61d1406346195be0f

                                          SHA1

                                          35869d9c3e1d821374b57a550e2887bdd7613bc5

                                          SHA256

                                          de8dfe1e89d15292164f6c2107b5680a4b23d5ed6483e94611ae4182e03c659e

                                          SHA512

                                          1e7697947b9ae5357368d90b55f766ec508d27a33cee8c4232ab6c68ad8b289831a59c6e414ecb3cb20bbd482348ce509922c2d081a20a219a3d8224cab6efc0

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

                                          Filesize

                                          434B

                                          MD5

                                          284112037875f024e4c7a5a91d7b3fb1

                                          SHA1

                                          5c9b5dffec3f6c65fbe03ccb9292c6811504888f

                                          SHA256

                                          0d54e3850a85e575557437ce0e786bf26fc6e2a36ccc78f30faf3f76851c4b57

                                          SHA512

                                          a0947ea41f6719a80deeb918dbd9ae9516d0956d504796a1a217552cc0215b21c5c8fb7a9a4fe9ef39fc5b68f48faa068a125a1abc7b6fc268db83e946a33700

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                                          Filesize

                                          458B

                                          MD5

                                          8f36954dc4e2e154c43059862dabbf7e

                                          SHA1

                                          678e47f2b20e78956bf26410d9e4939e3bf898dc

                                          SHA256

                                          0fbba882876862de4bf7297f656271ba93614904e2fb9f22b7b168093ca452aa

                                          SHA512

                                          98b0303715d000893b43cb0d8f303903d3488336d1ea5f1dceca34b271726e7db604e44e8f748ee965f0184b2195dfdb27083eb31647d755cf88841c27ab6bb7

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                                          Filesize

                                          432B

                                          MD5

                                          f837d08a661dc5765bf703f627ae6113

                                          SHA1

                                          c122628e561884bab2043d2285b472bbbb2e4441

                                          SHA256

                                          ce339a178439cb1e0f1dff7970e3f78547d85f545f3488a877a086d21ac3978e

                                          SHA512

                                          eb091b43c1cf918fb3898931550726078bab2c86e793644d19b4cf11eae6f71564f152e9592d5011f7a43686c3b8e53770f8fc0b246e96803177877c0c4f344b

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          ba6ef346187b40694d493da98d5da979

                                          SHA1

                                          643c15bec043f8673943885199bb06cd1652ee37

                                          SHA256

                                          d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

                                          SHA512

                                          2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          b8880802fc2bb880a7a869faa01315b0

                                          SHA1

                                          51d1a3fa2c272f094515675d82150bfce08ee8d3

                                          SHA256

                                          467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

                                          SHA512

                                          e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          7cd657689252f6e187103461e20f5b3c

                                          SHA1

                                          b7d25c41cf8647eed146807514ccd3e1a0346925

                                          SHA256

                                          de848323f395a0ebaff3073ac825f9b84aeb4855d95197f27881377d13cff032

                                          SHA512

                                          0245dd348ed45fd9fe1419868ae5c44a561cbf6d2f17ba8d51100951910c0c861d4e6d80b00e3d784e25472e48d7be11c9000b75e3a1d91af1b7dd68afb30a24

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          92b7ee90cb6ee71d3e49153ff23c6ed6

                                          SHA1

                                          868fae0e4d4169e57991c90123d7ac17dffbb0d7

                                          SHA256

                                          ed23a79b8fd86a47c392d5426b2377d01e2c653d8a0af6f8b6310be230ffd6f5

                                          SHA512

                                          74ec22f8beef2c0feefc4b3f9e261f69816b690e214d757fbffd830d51552284daa513fff83eddb60d066ac8dea7b7382e4b90f44b12aaf7461da204f7857cab

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          2KB

                                          MD5

                                          12d43adffde157f39994640928a31afc

                                          SHA1

                                          d60807350eff8a00728cf859c7ad91d63d833a26

                                          SHA256

                                          707367156b7fd26a3c7f8e996d0a0313346e32f6c6e2d64761f9b3e46bb14eaf

                                          SHA512

                                          06d3d4b3408a83fd392d34b07577131bd349d26e8c7c9042e30e21aaf9d83304aa8632bd96addfc635081d515c8364f958d1b4597289075b8ee2393f3b2f49a1

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          480B

                                          MD5

                                          413bc5ba8d4b66ef04b8a9551155b9d4

                                          SHA1

                                          993ffc5c0b4a1c9a706b803acc9a7cc0b71220f6

                                          SHA256

                                          02e8e0c4d7c2bbdf335d2199a2df188cf2fdf82f7c7f766093369f546f176508

                                          SHA512

                                          cadeffb20da1eccce48ca4ce30d1f1e0c8a21c136259de8dc4460dd576b0dd0d00334176ee46f252e5030664b9c1400330ba3445a2ec71472dbab353556fd62c

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

                                          Filesize

                                          264KB

                                          MD5

                                          f50f89a0a91564d0b8a211f8921aa7de

                                          SHA1

                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                          SHA256

                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                          SHA512

                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          323B

                                          MD5

                                          a5a1149047729a493b1a2a65063c39ba

                                          SHA1

                                          8f1f45cb0c0772dcd05795734cbf408636fb9fb9

                                          SHA256

                                          e0ef1f906ea2606c802310437fe799d93e073770ab6549060ee4b9c9c49f2006

                                          SHA512

                                          8ce257a087115e2d542657a2b4679d0c100ebdec76e3392cff1bbba133e129f2fcdbd73f9baab92e762bef47a2572d3dc8553fa3858d787d2a0b2bf8f05dc54e

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          3KB

                                          MD5

                                          4e66e19e95fd70cc17d957e3d49fd795

                                          SHA1

                                          ca6b2bacca5d3647b243490b5baa9eb06cfd0aea

                                          SHA256

                                          14b712f399c7c0209a009aacc2212379ebae57de4b0bf3ccce746de881fb5102

                                          SHA512

                                          e95ab6674e72ebf34a007916d70f2b6d1dfd3b2923f9ccc3b12094c52b524dee230b5049b14742d38df822f2fb53cedbb91d9d982c75f66b70469f29cd5bb51c

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          9e00b43745496eb97fa135d72529320e

                                          SHA1

                                          69c8714aaefe3282781da8ddef1302a3ce00ff0a

                                          SHA256

                                          f9158644087e31b203114ef2d7c8b45176699ca1ebf9f60f11a291dd4e7ab113

                                          SHA512

                                          39881583713c800994c17e51221a1efc3c2392b40ddb5540fde9fb145179297a9bec2375079a893f7ef88f7975bd3cd02e9073ec421973a04732b0c9435e7916

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          71d5ad0f0a111da03cc2ba8149730f6d

                                          SHA1

                                          6e326b4d19bacca130c24a386dec70ae77fd2b9d

                                          SHA256

                                          f17886812a02f01b59be435ab52b469b9977fdbc26420be759e7a2e812911b44

                                          SHA512

                                          88bb07c05ffe90577d28e41ef184d53e6f17b2468ba0b871a9e7299c5338187615009c2dc64eb15d4f34dd013e586991cf629de7d03259d47e62384692e9b2a9

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          b82f570d9bfb2b133f387f71d6172686

                                          SHA1

                                          4785686711dbcd873d4e69c3e7b23b5f6de3aac3

                                          SHA256

                                          57fd1724990fd73ff43a8ce6b08935a060ff7a1d1bbc1db6c54d4ad4e007cacd

                                          SHA512

                                          4f52194a84c6455f2ca51ad2d3cea01284038c0b693c1c5a5bc2b2367c63b17ec7f28dbbb4874c0d73acceca5d4c0a4ca186e9f56bb0760040fdf08b753c3be1

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          8KB

                                          MD5

                                          e845f032624423de244ef0fa70c13971

                                          SHA1

                                          96f9d438f6c983b80c3e44efe40e4e8d8a4a665b

                                          SHA256

                                          4528f51917ce79c9ea7b93bc2d523451e559d01593c3a67a7d0790e027f14a16

                                          SHA512

                                          894f215e798e908fd9dab9cccbb5914bc02d692ef2c6d94ec016b274ab360846ffe1b8b7d3763148ec8665c4751a42a878a39207ba332decadb1db3812442552

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                          Filesize

                                          706B

                                          MD5

                                          a2ac10419ff711845c11904b8be9b1f6

                                          SHA1

                                          57f79be844d627015773f6c14e9e65a7aee56e58

                                          SHA256

                                          a2d5c618a152b3a4940acefd5f6b6a2a0bc4f71a17217ac86977dc0d34d79994

                                          SHA512

                                          0fc819d296f10a8b94a389cb9fa9ea085c2b03d5feb056d61fd3f50dd9f6b3ed8fab707f85401aefdfa7b5c4bf9271c499874772c25a16576d7f6661f15bcf94

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          10KB

                                          MD5

                                          7797aade085b54aa617774081389954c

                                          SHA1

                                          2720816e17360a6c61216085d9bdecf5b186932b

                                          SHA256

                                          4234cbb8bcb061fa1d6bef086a66bd2aa12271426a9a9c8f4c4ee2cf000b33d1

                                          SHA512

                                          4fdf49a40d3ec513a597415b05233ad7e8169aa446dbbb8263a15a71ab8b61cd02ff1ead26bcbec9f3f27efc0a96bc20f118605090419ced99e1f84d564d7738

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          10KB

                                          MD5

                                          ca9e979ae9850260bea0035e1a3fd9eb

                                          SHA1

                                          e6f6e59f8859419eaa4f4f19176be47d01bb07e0

                                          SHA256

                                          87665193a8f5f22939961e3bd88cde4b22c71c580371124acb025043c886fa27

                                          SHA512

                                          f7eaccb90f3a766abbb3814920254e90b75108e9839a764a32c92244cf1847739332b8b8aa26227cfb426740b8bf93c90cb8ccf17ab37389ab677542a0249be1

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\AppxProvider.dll

                                          Filesize

                                          554KB

                                          MD5

                                          a7927846f2bd5e6ab6159fbe762990b1

                                          SHA1

                                          8e3b40c0783cc88765bbc02ccc781960e4592f3f

                                          SHA256

                                          913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f

                                          SHA512

                                          1eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\AssocProvider.dll

                                          Filesize

                                          112KB

                                          MD5

                                          94dc379aa020d365ea5a32c4fab7f6a3

                                          SHA1

                                          7270573fd7df3f3c996a772f85915e5982ad30a1

                                          SHA256

                                          dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907

                                          SHA512

                                          998fd10a1f43024a2398491e3764748c0b990b37d8b3c820d281296f8da8f1a2f97073f4fd83543994a6e326fa7e299cb5f59e609358cd77af996175782eeaca

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\CbsProvider.dll

                                          Filesize

                                          875KB

                                          MD5

                                          6ad0376a375e747e66f29fb7877da7d0

                                          SHA1

                                          a0de5966453ff2c899f00f165bbff50214b5ea39

                                          SHA256

                                          4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f

                                          SHA512

                                          8a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\DismCore.dll

                                          Filesize

                                          402KB

                                          MD5

                                          b1f793773dc727b4af1648d6d61f5602

                                          SHA1

                                          be7ed4e121c39989f2fb343558171ef8b5f7af68

                                          SHA256

                                          af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e

                                          SHA512

                                          66a92bff5869a56a7931d7ed9881d79c22ba741c55fb42c11364f037e1ec99902db2679b67a7e60cbf760740d5b47dcf1a6dcfae5ad6711a0bd7f086cc054eed

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\DismCorePS.dll

                                          Filesize

                                          183KB

                                          MD5

                                          a033f16836d6f8acbe3b27b614b51453

                                          SHA1

                                          716297072897aea3ec985640793d2cdcbf996cf9

                                          SHA256

                                          e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e

                                          SHA512

                                          ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\DismHost.exe

                                          Filesize

                                          142KB

                                          MD5

                                          e5d5e9c1f65b8ec7aa5b7f1b1acdd731

                                          SHA1

                                          dbb14dcda6502ab1d23a7c77d405dafbcbeb439e

                                          SHA256

                                          e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80

                                          SHA512

                                          7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\DismProv.dll

                                          Filesize

                                          255KB

                                          MD5

                                          490be3119ea17fa29329e77b7e416e80

                                          SHA1

                                          c71191c3415c98b7d9c9bbcf1005ce6a813221da

                                          SHA256

                                          ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a

                                          SHA512

                                          6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\DmiProvider.dll

                                          Filesize

                                          415KB

                                          MD5

                                          ea8488990b95ce4ef6b4e210e0d963b2

                                          SHA1

                                          cd8bf723aa9690b8ca9a0215321e8148626a27d1

                                          SHA256

                                          04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98

                                          SHA512

                                          56562131cbe5f0ea5a2508f5bfed88f21413526f1539fe4864ece5b0e03a18513f3db33c07e7abd7b8aaffc34a7587952b96bb9990d9f4efa886f613d95a5b1b

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\FfuProvider.dll

                                          Filesize

                                          619KB

                                          MD5

                                          df785c5e4aacaee3bd16642d91492815

                                          SHA1

                                          286330d2ab07512e1f636b90613afcd6529ada1e

                                          SHA256

                                          56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271

                                          SHA512

                                          3566de60fe76b63940cff3579da94f404c0bc713f2476ba00b9de12dc47973c7c22d5eed1fd667d20cea29b3c3c4fa648e5f44667e8369c192a4b69046e6f745

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\FolderProvider.dll

                                          Filesize

                                          59KB

                                          MD5

                                          4f3250ecb7a170a5eb18295aa768702d

                                          SHA1

                                          70eb14976ddab023f85bc778621ade1d4b5f4d9d

                                          SHA256

                                          a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461

                                          SHA512

                                          e9ce6cced5029d931d82e78e7e609a892bfe239096b55062b78e8ff38cce34ce6dd4e91efb41c4cd6ecf6017d098e4c9b13d6cb4408d761051468ee7f74bc569

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\GenericProvider.dll

                                          Filesize

                                          149KB

                                          MD5

                                          ef7e2760c0a24453fc78359aea3d7869

                                          SHA1

                                          0ea67f1fd29df2615da43e023e86046e8e46e2e1

                                          SHA256

                                          d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a

                                          SHA512

                                          be785ba6b564cc4e755b4044ae27f916c009b7d942fcd092aed2ae630b1704e8a2f8b4692648eed481a5eb5355fd2e1ef7f94f6fb519b7e1ff6fc3c5f1aaa06f

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\IBSProvider.dll

                                          Filesize

                                          59KB

                                          MD5

                                          120f0a2022f423fc9aadb630250f52c4

                                          SHA1

                                          826df2b752c4f1bba60a77e2b2cf908dd01d3cf7

                                          SHA256

                                          5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0

                                          SHA512

                                          23e50735c06cef93d11873fc8e5e29fc63dcf3f01dc56822a17c11ca57bbfb10d46fac6351f84ba30050a16d6bd0744a08a4042a9743a6df87ac8a12e81e2764

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\ImagingProvider.dll

                                          Filesize

                                          218KB

                                          MD5

                                          35e989a1df828378baa340f4e0b2dfcb

                                          SHA1

                                          59ecc73a0b3f55e43dace3b05ff339f24ec2c406

                                          SHA256

                                          874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d

                                          SHA512

                                          c8d69e37c918881786a8fdab2a2c5d1632411b1f75082aeb3eb24a8ba5f93dcb39b3f4000e651f95452263525d98fd1d3cb834de93bed16fa6f92ef271c3a92a

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\IntlProvider.dll

                                          Filesize

                                          296KB

                                          MD5

                                          510e132215cef8d09be40402f355879b

                                          SHA1

                                          cae8659f2d3fd54eb321a8f690267ba93d56c6f1

                                          SHA256

                                          1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52

                                          SHA512

                                          2f7b2ec0e94738838f755759cd35e20ab2138b8eca023ee6ef630ab83a3de1bc0792f12ea0d722abe9a6953626cbddf8ba55ea32fc794d2df677a0625e498ab0

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\LogProvider.dll

                                          Filesize

                                          77KB

                                          MD5

                                          815a4e7a7342224a239232f2c788d7c0

                                          SHA1

                                          430b7526d864cfbd727b75738197230d148de21a

                                          SHA256

                                          a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2

                                          SHA512

                                          0c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\MsiProvider.dll

                                          Filesize

                                          207KB

                                          MD5

                                          9a760ddc9fdca758501faf7e6d9ec368

                                          SHA1

                                          5d395ad119ceb41b776690f9085f508eaaddb263

                                          SHA256

                                          7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f

                                          SHA512

                                          59d095246b62a7777e7d2d50c2474f4b633a1ae96056e4a4cb5265ccf7432fed0ea5df9b350f44d70b55a726241da10f228d8b5cbee9b0890c0b9dc9e810b139

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\OSProvider.dll

                                          Filesize

                                          149KB

                                          MD5

                                          db4c3a07a1d3a45af53a4cf44ed550ad

                                          SHA1

                                          5dea737faadf0422c94f8f50e9588033d53d13b3

                                          SHA256

                                          2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758

                                          SHA512

                                          5182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\OfflineSetupProvider.dll

                                          Filesize

                                          182KB

                                          MD5

                                          9cd7292cca75d278387d2bdfb940003c

                                          SHA1

                                          bab579889ed3ac9cb0f124842c3e495cb2ec92ac

                                          SHA256

                                          b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f

                                          SHA512

                                          ebf96839e47bef9e240836b1d02065c703547a2424e05074467fe70f83c1ebf3db6cb71bf0d38848ec25e2e81b4cbb506ced7973b85e2ab2d8e4273de720779d

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\ProvProvider.dll

                                          Filesize

                                          753KB

                                          MD5

                                          70c34975e700a9d7e120aaecf9d8f14b

                                          SHA1

                                          e24d47f025c0ec0f60ec187bfc664e9347dc2c9c

                                          SHA256

                                          a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7

                                          SHA512

                                          7f6a24345f5724d710e0b6c23b3b251e96d656fac58ea67b2b84d7d9a38d7723eae2c278e6e218e7f69f79d1cce240d91a8b0fd0d99960cacc65d82eb614a260

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\AppxProvider.dll.mui

                                          Filesize

                                          22KB

                                          MD5

                                          bd0dd9c5a602cb0ad7eabc16b3c1abfc

                                          SHA1

                                          cede6e6a55d972c22da4bc9e0389759690e6b37f

                                          SHA256

                                          8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3

                                          SHA512

                                          86351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\AssocProvider.dll.mui

                                          Filesize

                                          8KB

                                          MD5

                                          8833761572f0964bdc1bea6e1667f458

                                          SHA1

                                          166260a12c3399a9aa298932862569756b4ecc45

                                          SHA256

                                          b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5

                                          SHA512

                                          2a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\CbsProvider.dll.mui

                                          Filesize

                                          53KB

                                          MD5

                                          6c51a3187d2464c48cc8550b141e25c5

                                          SHA1

                                          a42e5ae0a3090b5ab4376058e506b111405d5508

                                          SHA256

                                          d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199

                                          SHA512

                                          87a9e997d55bc6dbd05af1291fb78cd02266641d018ccfeb6826cb0de205aaf8a57b49e587462dbb6df2b86b54f91c0c5d3f87e64d7dbb2aea75ef143c5447ba

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\DismCore.dll.mui

                                          Filesize

                                          7KB

                                          MD5

                                          7a15f6e845f0679de593c5896fe171f9

                                          SHA1

                                          0c923dfaffb56b56cba0c28a4eacb66b1b91a1f4

                                          SHA256

                                          f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419

                                          SHA512

                                          5a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\DmiProvider.dll.mui

                                          Filesize

                                          17KB

                                          MD5

                                          b7252234aa43b7295bb62336adc1b85c

                                          SHA1

                                          b2c42a5af79530e7cf9bcf54fd76ae9d5f234d7f

                                          SHA256

                                          73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c

                                          SHA512

                                          88241009b342eb1205b10f7725a7cb1ec2c7135606459d038c4b8847efd9d5e0ad4749621f8df93746dd3ba8ab92d1b0f513ed10e2ba712a7991716f4c062358

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\FfuProvider.dll.mui

                                          Filesize

                                          9KB

                                          MD5

                                          dc826a9cb121e2142b670d0b10022e22

                                          SHA1

                                          b2fe459ede8ba99602ae6ea5fa24f0133cca2bc9

                                          SHA256

                                          ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a

                                          SHA512

                                          038e9abff445848c882a71836574df0394e73690bc72642c2aa949c1ad820c5cbb4dedc4ee7b5b75fd5ac8a43813d416f23d28973de7a7f0e5c3f7112da6fe1b

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\FolderProvider.dll.mui

                                          Filesize

                                          2KB

                                          MD5

                                          22b4a3a1ec3b6d7aa3bc61d0812dc85f

                                          SHA1

                                          97ae3504a29eb555632d124022d8406fc5b6f662

                                          SHA256

                                          c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105

                                          SHA512

                                          9329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\GenericProvider.dll.mui

                                          Filesize

                                          5KB

                                          MD5

                                          d6b02daf9583f640269b4d8b8496a5dd

                                          SHA1

                                          e3bc2acd8e6a73b6530bc201902ab714e34b3182

                                          SHA256

                                          9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0

                                          SHA512

                                          189e87fcc2902e2a8e59773783d80a7d4dd5d2991bd291b0976cbd304f78bd225b353703735b84de41b5f59c37402db634c4acc805d73176cde75ca662efff50

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\IBSProvider.dll.mui

                                          Filesize

                                          2KB

                                          MD5

                                          d4b67a347900e29392613b5d86fe4ac2

                                          SHA1

                                          fb84756d11bfd638c4b49268b96d0007b26ba2fb

                                          SHA256

                                          4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5

                                          SHA512

                                          af0a2a3f813e1adfff972285c9655f50ce6916caaeff5cb82f6c7d76491ffc9b365a47f19750fc02d7122182bf65aae79ed167886c33f202d5a781ab83d75662

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\ImagingProvider.dll.mui

                                          Filesize

                                          18KB

                                          MD5

                                          f2e2ba029f26341158420f3c4db9a68f

                                          SHA1

                                          1dee9d3dddb41460995ad8913ad701546be1e59d

                                          SHA256

                                          32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3

                                          SHA512

                                          3d45d7bcf21d5df56b516fc18f7dc1bf80e44258b0c810b199a7bc06047a547060956c9d79575b82d9b6992fb5fe64f5b0ef1e408363887ae81a64b6ff9fa03e

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\IntlProvider.dll.mui

                                          Filesize

                                          27KB

                                          MD5

                                          2eb303db5753eb7a6bb3ab773eeabdcb

                                          SHA1

                                          44c6c38e6ae5f9ce9d7ca9d45a3cc3020b1353e4

                                          SHA256

                                          aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f

                                          SHA512

                                          df1c8cefed4b5ef5a47f9bc0c42776611b3af709938a0900db79c6c9f4fae21acbbb6c4b1cad3c5a2051b622fe7e6e01486d34622742a981623fed933f1b1427

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\LogProvider.dll.mui

                                          Filesize

                                          6KB

                                          MD5

                                          8933c8d708e5acf5a458824b19fd97da

                                          SHA1

                                          de55756ddbeebc5ad9d3ce950acba5d2fb312331

                                          SHA256

                                          6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6

                                          SHA512

                                          ead5017d9d024a1d7c53634ae725438ea3a34eed8c9056ebbc4ebe5aab2055c0e67687ce7608724e4f66f55aa486a63024967b76a5638cde3dd88b3d3432ca1f

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\MsiProvider.dll.mui

                                          Filesize

                                          15KB

                                          MD5

                                          c5e60ee2d8534f57fddb81ffce297763

                                          SHA1

                                          78e6b0e03c8bf5802b3ef429b105d7ae3092a8f2

                                          SHA256

                                          1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145

                                          SHA512

                                          ce654295e8b16da7bd004453ae4a422fe8296a8c2343e56d819883b835c391a02537ecf4d155a281a9d38f2291ee0004506b7fd48a99c0f8881ff1e38ae8ebcc

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\OSProvider.dll.mui

                                          Filesize

                                          3KB

                                          MD5

                                          0633e0fccd477d9b22de4dd5a84abe53

                                          SHA1

                                          e04fb5c3acb35d128c1ea6ee6fb0e9b3fe90d5a9

                                          SHA256

                                          b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706

                                          SHA512

                                          e95ed1d8069d6f200f0a2ea8dd7688404af9db9ce5e229afcb625a1f9eb46ac9e7a1c2c4c5ce156b190514415679e82e213732e8e890ed1a89af9026e4e73fe3

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\OfflineSetupProvider.dll.mui

                                          Filesize

                                          2KB

                                          MD5

                                          015271d46ab128a854a4e9d214ab8a43

                                          SHA1

                                          2569deff96fb5ad6db924cee2e08a998ddc80b2a

                                          SHA256

                                          692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec

                                          SHA512

                                          6ba678da0475a6b1872c2e2c151b395a4d97390bed4671d3f918aab5e69cbc9ceafe72c3100ba060ac6586fd37682499fdeef7d7b1ab10f5ec2411c1438ed438

                                        • C:\Users\Admin\AppData\Local\Temp\A8844167-306F-4FCC-BFBE-0F006B9CEF5E\en-US\dismprov.dll.mui

                                          Filesize

                                          2KB

                                          MD5

                                          7d06108999cc83eb3a23eadcebb547a5

                                          SHA1

                                          200866d87a490d17f6f8b17b26225afeb6d39446

                                          SHA256

                                          cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311

                                          SHA512

                                          9f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nsojgyi0.4pu.ps1

                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        • C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll

                                          Filesize

                                          130KB

                                          MD5

                                          b33f2e65677a256b37e75340c167f54b

                                          SHA1

                                          735c404466aea6a70e653a6706cdd0b4d65c0aae

                                          SHA256

                                          77e81f19ef02e620898b53a308d502042b9ae732d9741b99062a1baaa164dcd7

                                          SHA512

                                          cf1bfefef47d5cee5932fc9cccf323f87640912225cb5b0f93442929fc96f32edccad48fd8c95def9be64fa62c750add4b53448e3e4a2e854f8940be7aaefc8f

                                        • C:\Windows\Logs\DISM\dism.log

                                          Filesize

                                          2.1MB

                                          MD5

                                          926f34722f2dbb44335676ee5caf839d

                                          SHA1

                                          33953eb819a5bac7f6c5f65949b04e3d630d39ba

                                          SHA256

                                          fe9cb935f9dd70a7647cc0aac5a8a838f03b1353ba89012c1470e982607fcddc

                                          SHA512

                                          2b490cf0c5cf016f1e55a5b31975db20259dbe61366dd747b0783ea1e3e0b3a378555a2a07d5e6a0dc644518683d5d9554b4023b8b3ecb17e1bcdb358c926ca8

                                        • C:\Windows\Logs\DISM\dism.log

                                          Filesize

                                          2.2MB

                                          MD5

                                          31f290e80a71244cd7ffb3b99fa05746

                                          SHA1

                                          72be94612f6b9a0a06d3ff1fcfe0b8c030d486b3

                                          SHA256

                                          c5c4f43375bce29ca8aa70d647cf3f241ca463f26963ea3e912aa61550bd0586

                                          SHA512

                                          b018a10c93f459a3a560f6a0f5d16f8ab7ec524653e66f52e080bf1198ff4057e0949890e29935bf05bd0a80c6aecbd48388b2f1391588aef230cf53ebb60766

                                        • memory/672-928-0x0000000005E80000-0x00000000061D4000-memory.dmp

                                          Filesize

                                          3.3MB

                                        • memory/672-929-0x000000006EDE0000-0x000000006EE2C000-memory.dmp

                                          Filesize

                                          304KB

                                        • memory/2800-875-0x0000000006850000-0x000000000689C000-memory.dmp

                                          Filesize

                                          304KB

                                        • memory/2800-859-0x0000000005260000-0x0000000005296000-memory.dmp

                                          Filesize

                                          216KB

                                        • memory/2800-876-0x0000000006DE0000-0x0000000006E12000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/2800-877-0x000000006EDE0000-0x000000006EE2C000-memory.dmp

                                          Filesize

                                          304KB

                                        • memory/2800-895-0x0000000007E80000-0x0000000007E9A000-memory.dmp

                                          Filesize

                                          104KB

                                        • memory/2800-888-0x0000000007A20000-0x0000000007AC3000-memory.dmp

                                          Filesize

                                          652KB

                                        • memory/2800-874-0x0000000006810000-0x000000000682E000-memory.dmp

                                          Filesize

                                          120KB

                                        • memory/2800-889-0x00000000081A0000-0x000000000881A000-memory.dmp

                                          Filesize

                                          6.5MB

                                        • memory/2800-873-0x0000000006240000-0x0000000006594000-memory.dmp

                                          Filesize

                                          3.3MB

                                        • memory/2800-890-0x0000000007B60000-0x0000000007B7A000-memory.dmp

                                          Filesize

                                          104KB

                                        • memory/2800-862-0x0000000006160000-0x00000000061C6000-memory.dmp

                                          Filesize

                                          408KB

                                        • memory/2800-863-0x00000000061D0000-0x0000000006236000-memory.dmp

                                          Filesize

                                          408KB

                                        • memory/2800-861-0x0000000005FB0000-0x0000000005FD2000-memory.dmp

                                          Filesize

                                          136KB

                                        • memory/2800-894-0x0000000007DB0000-0x0000000007DBE000-memory.dmp

                                          Filesize

                                          56KB

                                        • memory/2800-893-0x0000000007D60000-0x0000000007D71000-memory.dmp

                                          Filesize

                                          68KB

                                        • memory/2800-892-0x0000000007DE0000-0x0000000007E76000-memory.dmp

                                          Filesize

                                          600KB

                                        • memory/2800-891-0x0000000007BD0000-0x0000000007BDA000-memory.dmp

                                          Filesize

                                          40KB

                                        • memory/2800-887-0x0000000007A00000-0x0000000007A1E000-memory.dmp

                                          Filesize

                                          120KB

                                        • memory/2800-860-0x0000000005980000-0x0000000005FA8000-memory.dmp

                                          Filesize

                                          6.2MB

                                        • memory/2896-1289-0x0000000070B10000-0x000000007250B000-memory.dmp

                                          Filesize

                                          26.0MB

                                        • memory/2896-1286-0x00000000704E0000-0x0000000070A86000-memory.dmp

                                          Filesize

                                          5.6MB

                                        • memory/2896-1288-0x0000000070380000-0x00000000703D9000-memory.dmp

                                          Filesize

                                          356KB

                                        • memory/2896-1287-0x00000000703E0000-0x000000007045A000-memory.dmp

                                          Filesize

                                          488KB

                                        • memory/2896-1285-0x0000000070460000-0x00000000704DE000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/2896-1042-0x0000000035BF0000-0x0000000035C00000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/3924-898-0x0000000005690000-0x00000000059E4000-memory.dmp

                                          Filesize

                                          3.3MB

                                        • memory/3924-908-0x000000006EDE0000-0x000000006EE2C000-memory.dmp

                                          Filesize

                                          304KB