486ffcca0673fceb2741b0048d8a409ece396c552b6bca6008f342ac8c94be11

Resubmissions

17/01/2025, 16:19

250117-tszsfawjay 10

17/01/2025, 16:15

250117-tqlsssvrbv 8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
17/01/2025, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
Size

2.1MB
MD5

b38032c2aacdbf4591f3b2232aa2095b
SHA1

6d0693e138848613bb951a8d7ac0965f3e0d7801
SHA256

486ffcca0673fceb2741b0048d8a409ece396c552b6bca6008f342ac8c94be11
SHA512

e3b3681653ca8b9f8c18068cd1965e70b926581636453a963907ee80b16f942519832467a8be6653718ef057f6a792b808b6cc8b1dff28be402d673cb5380b2e
SSDEEP

24576:tFwpqSq7cwxsmDRpnt3O3a0iD3MzvD/RXNgZ2Ppm+x9nGWTysehNBN88LcpmZQ46:2wntJ3MQ2PQ+3Gnb88amDeqhSSwr+I5

Score

8^/10

discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "GenericChainCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4\FuncName = "WVTAsn1SpcIndirectDataContentDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCertPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\FuncName = "WVTAsn1CatNameValueDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15\FuncName = "WVTAsn1SpcPeImageDataEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004\FuncName = "WVTAsn1SpcPeImageDataDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2005\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverFinalPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12\FuncName = "WVTAsn1SpcSpOpusInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.2\FuncName = "WVTAsn1IntentToSealAttributeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002\FuncName = "WVTAsn1SpcFinancialCriteriaInfoEncode"	regsvr32.exe

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
4656	icacls.exe
2540	takeown.exe
3312	icacls.exe
4384	takeown.exe
2780	icacls.exe
2872	takeown.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3312	icacls.exe
4384	takeown.exe
2780	icacls.exe
2872	takeown.exe
4656	icacls.exe
2540	takeown.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
74	discord.com
76	discord.com
81	discord.com

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\api-ms-win-core-namedpipe-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Core.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-file-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf-PreW10.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\EGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_V2_utils.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libOpenglRender2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxSup.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxManage.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\ucrtbase.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxSup.inf	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\dpinst_86.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES12Translator.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l2-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-utility-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9VMMR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\ossltest.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\crashreport.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-locale-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxBalloonCtrl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-localization-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-convert-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetDHCP.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSDL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-conio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\load.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qminimal.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxExtPackHelperApp.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxC.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-runtime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vcruntime140_1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\loadall.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdp6Install.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ossltest.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletionStress.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-util-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\libssl-1_1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxNetLwf.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VirtualBoxVM.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxStubBld.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-processenvironment-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-processthreads-l1-1-1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-stdio-l1-1-0.dll	dnrepairer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Executes dropped EXE 15 IoCs

pid	Process
840	LDPlayer.exe
4428	dnrepairer.exe
1552	dismhost.exe
1472	Ld9BoxSVC.exe
1012	driverconfig.exe
2120	dnplayer.exe
1084	Ld9BoxSVC.exe
1028	vbox-img.exe
2512	vbox-img.exe
3732	vbox-img.exe
1444	Ld9BoxHeadless.exe
2576	Ld9BoxHeadless.exe
3516	Ld9BoxHeadless.exe
2184	Ld9BoxHeadless.exe
4856	Ld9BoxHeadless.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4068	sc.exe
4596	sc.exe
1692	sc.exe
984	sc.exe
3640	sc.exe
4188	sc.exe
2380	sc.exe
3576	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
4428	dnrepairer.exe
4428	dnrepairer.exe
4428	dnrepairer.exe
4428	dnrepairer.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1552	dismhost.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
1472	Ld9BoxSVC.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
1828	regsvr32.exe
520	regsvr32.exe
520	regsvr32.exe
520	regsvr32.exe
520	regsvr32.exe
520	regsvr32.exe
520	regsvr32.exe
520	regsvr32.exe
520	regsvr32.exe
4396	regsvr32.exe
4396	regsvr32.exe
4396	regsvr32.exe
4396	regsvr32.exe
4396	regsvr32.exe
4396	regsvr32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dism.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6588-40A3-9B0A-68C05BA52C4B}\ = "IGuestProcessEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2F05-4D28-855F-488F96BAD2B2}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4A06-81FC-A916-78B2DA1FA0E5}\ = "IAdditionsFacility"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4737-457B-99FC-BC52C851A44F}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-BCB2-4905-A7AB-CC85448A742B}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-787B-44AB-B343-A082A3F2DFB1}\ = "IMedium"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C6EA-45B6-9D43-DC6F70CC9F02}\ = "IGuestProcessRegisteredEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4C1B-EDF7-FDF3-C1BE6827DC28}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7193-426C-A41F-522E8F537FA0}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E4B1-486A-8F2E-747AE346C3E9}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-394D-44D3-9EDB-AF2C4472C40A}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1A29-4A19-92CF-02285773F3B5}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32	dnrepairer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4430-499F-92C8-8BED814A567A}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7193-426C-A41F-522E8F537FA0}\NumMethods	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4A9B-1727-BEE2-5585105B9EED}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E78-11E9-B25E-7768F80C0E07}\TypeLib	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CB63-47A1-84FB-02C4894B89A9}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486F-40DB-9150-DEEE3FD24189}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8ce7-469f-a4c2-6476f581ff72}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3618-4EBC-B038-833BA829B4B2}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9536-4EF8-820E-3B0E17E5BBC8}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F6D4-4AB6-9CBF-558EB8959A6A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7556-4CBC-8C04-043096B02D82}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-42DA-C94B-8AEC-21968E08355D}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-A862-4DC9-8C89-BF4BA74A886A}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E64A-4908-804E-371CAD23A756}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6B76-4805-8FAB-00A9DCF4732B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20191216-1750-46F0-936E-BD127D5BC264}\1.3\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-26F1-4EDB-8DD2-6BDDD0912368}\ = "IGuestPropertyChangedEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0FF7-46B7-A138-3C6E5AC946B4}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-07DA-41EC-AC4A-3DD99DB35594}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CD54-400C-B858-797BCB82570E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-762E-4120-871C-A2014234A607}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-23D0-430A-A7FF-7ED7F05534BC}\ = "INATNetworkPortForwardEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-659C-488B-835C-4ECA7AE71C6C}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7193-426C-A41F-522E8F537FA0}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox.1\ = "VirtualBox Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7F29-4AAE-A627-5A282C83092C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3618-4EBC-B038-833BA829B4B2}\ = "IExtPack"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C71F-4A36-8E5F-A77D01D76090}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5F86-4D65-AD1B-87CA284FB1C8}\NumMethods\ = "28"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7532-45e8-96da-eb5986ae76e4}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1207-4179-94CF-CA250036308F}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBoxClient\CLSID	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E191-400B-840E-970F3DAD7296}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-BE30-49C0-B315-E9749E1BDED1}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0547-448E-BC7C-94E9E173BF57}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2e88-4436-83d7-50f3e64d0503}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-762E-4120-871C-A2014234A607}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CC87-4F6E-A0E9-47BB7F2D4BE5}\ = "IInternalProgressControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-799A-4489-86CD-FE8E45B2FF8E}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7F29-4AAE-A627-5A282C83092C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C9D6-4742-957C-A6FD52E8C4AE}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-07DA-41EC-AC4A-3DD99DB35594}\NumMethods\ = "44"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\ = "INetworkAdapter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486F-40DB-9150-DEEE3FD24189}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
840	LDPlayer.exe
840	LDPlayer.exe
840	LDPlayer.exe
840	LDPlayer.exe
840	LDPlayer.exe
840	LDPlayer.exe
840	LDPlayer.exe
840	LDPlayer.exe
4428	dnrepairer.exe
4428	dnrepairer.exe
1624	powershell.exe
1624	powershell.exe
3616	powershell.exe
3616	powershell.exe
2136	powershell.exe
2136	powershell.exe
840	LDPlayer.exe
840	LDPlayer.exe
5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
4504	msedge.exe
4504	msedge.exe
2552	msedge.exe
2552	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe
Token: SeDebugPrivilege	840	LDPlayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2552	msedge.exe
2120	dnplayer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2120	dnplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 840	5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe	87
PID 5008 wrote to memory of 840	5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe	87
PID 5008 wrote to memory of 840	5008	LDPlayer9_ens_com.ewt.purble_25567197_ld.exe	87
PID 840 wrote to memory of 4428	840	LDPlayer.exe	88
PID 840 wrote to memory of 4428	840	LDPlayer.exe	88
PID 840 wrote to memory of 4428	840	LDPlayer.exe	88
PID 4428 wrote to memory of 4608	4428	dnrepairer.exe	89
PID 4428 wrote to memory of 4608	4428	dnrepairer.exe	89
PID 4428 wrote to memory of 4608	4428	dnrepairer.exe	89
PID 4608 wrote to memory of 652	4608	net.exe	91
PID 4608 wrote to memory of 652	4608	net.exe	91
PID 4608 wrote to memory of 652	4608	net.exe	91
PID 4428 wrote to memory of 4936	4428	dnrepairer.exe	92
PID 4428 wrote to memory of 4936	4428	dnrepairer.exe	92
PID 4428 wrote to memory of 4936	4428	dnrepairer.exe	92
PID 4428 wrote to memory of 3112	4428	dnrepairer.exe	93
PID 4428 wrote to memory of 3112	4428	dnrepairer.exe	93
PID 4428 wrote to memory of 3112	4428	dnrepairer.exe	93
PID 4428 wrote to memory of 4520	4428	dnrepairer.exe	94
PID 4428 wrote to memory of 4520	4428	dnrepairer.exe	94
PID 4428 wrote to memory of 4520	4428	dnrepairer.exe	94
PID 4428 wrote to memory of 4236	4428	dnrepairer.exe	95
PID 4428 wrote to memory of 4236	4428	dnrepairer.exe	95
PID 4428 wrote to memory of 4236	4428	dnrepairer.exe	95
PID 4428 wrote to memory of 2712	4428	dnrepairer.exe	96
PID 4428 wrote to memory of 2712	4428	dnrepairer.exe	96
PID 4428 wrote to memory of 2712	4428	dnrepairer.exe	96
PID 4428 wrote to memory of 3388	4428	dnrepairer.exe	97
PID 4428 wrote to memory of 3388	4428	dnrepairer.exe	97
PID 4428 wrote to memory of 3388	4428	dnrepairer.exe	97
PID 4428 wrote to memory of 4368	4428	dnrepairer.exe	98
PID 4428 wrote to memory of 4368	4428	dnrepairer.exe	98
PID 4428 wrote to memory of 4368	4428	dnrepairer.exe	98
PID 4428 wrote to memory of 2540	4428	dnrepairer.exe	99
PID 4428 wrote to memory of 2540	4428	dnrepairer.exe	99
PID 4428 wrote to memory of 2540	4428	dnrepairer.exe	99
PID 4428 wrote to memory of 3312	4428	dnrepairer.exe	101
PID 4428 wrote to memory of 3312	4428	dnrepairer.exe	101
PID 4428 wrote to memory of 3312	4428	dnrepairer.exe	101
PID 4428 wrote to memory of 4384	4428	dnrepairer.exe	103
PID 4428 wrote to memory of 4384	4428	dnrepairer.exe	103
PID 4428 wrote to memory of 4384	4428	dnrepairer.exe	103
PID 4428 wrote to memory of 2780	4428	dnrepairer.exe	105
PID 4428 wrote to memory of 2780	4428	dnrepairer.exe	105
PID 4428 wrote to memory of 2780	4428	dnrepairer.exe	105
PID 4428 wrote to memory of 5012	4428	dnrepairer.exe	107
PID 4428 wrote to memory of 5012	4428	dnrepairer.exe	107
PID 4428 wrote to memory of 5012	4428	dnrepairer.exe	107
PID 5012 wrote to memory of 1552	5012	dism.exe	109
PID 5012 wrote to memory of 1552	5012	dism.exe	109
PID 4428 wrote to memory of 3640	4428	dnrepairer.exe	110
PID 4428 wrote to memory of 3640	4428	dnrepairer.exe	110
PID 4428 wrote to memory of 3640	4428	dnrepairer.exe	110
PID 4428 wrote to memory of 4188	4428	dnrepairer.exe	112
PID 4428 wrote to memory of 4188	4428	dnrepairer.exe	112
PID 4428 wrote to memory of 4188	4428	dnrepairer.exe	112
PID 4428 wrote to memory of 2380	4428	dnrepairer.exe	114
PID 4428 wrote to memory of 2380	4428	dnrepairer.exe	114
PID 4428 wrote to memory of 2380	4428	dnrepairer.exe	114
PID 4428 wrote to memory of 1472	4428	dnrepairer.exe	116
PID 4428 wrote to memory of 1472	4428	dnrepairer.exe	116
PID 4428 wrote to memory of 2744	4428	dnrepairer.exe	117
PID 4428 wrote to memory of 2744	4428	dnrepairer.exe	117
PID 4428 wrote to memory of 1828	4428	dnrepairer.exe	118

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.ewt.purble_25567197_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.ewt.purble_25567197_ld.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008
- C:\LDPlayer\LDPlayer9\LDPlayer.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=25567197 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=459032
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:652
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:4936
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:3112
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4520
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4236
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:4368
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2540
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3312
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4384
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2780
  - - C:\Windows\SysWOW64\dism.exe
      C:\Windows\system32\dism.exe /Online /English /Get-Features
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\dismhost.exe {CBAE6AED-0EDB-4CCB-8698-99C1ACD26554}
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1552
  - - C:\Windows\SysWOW64\sc.exe
      sc query HvHost
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3640
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmms
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4188
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmcompute
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2380
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1472
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:2744
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1828
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:520
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4396
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3576
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1624
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3616
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2136
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1012
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2872
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/4bUcwDd53d
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffaf7ee46f8,0x7ffaf7ee4708,0x7ffaf7ee4718
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,3789755175949434739,5487174320354364455,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2576
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\dnplayer.exe" downloadpackage=com.ewt.purble|package=com.ewt.purble
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2120
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4596
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1692
- - C:\Windows\SysWOW64\sc.exe
    sc query vmcompute
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:984
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    - Executes dropped EXE
    PID:1028
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:2512
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:3732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x494
1⤵
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:1084
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4856
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LDPlayer\LDPlayer9\crashreport.dll

Filesize
51KB

MD5
41ea74c355a2692893c408af9ec5719a

SHA1
aa7a5306ebca91782e8e2099512161964c2a3e37

SHA256
d8a1501e6b1e3de316f631d7c69540548c9e3b29559331b288fcb131c12612f8

SHA512
5b850acbcf6c174fcd0cf110af2cc7ff5351426902c49086da090e99f38ceaeeee11c163497a6e2d7b0ab4ef985e951caf0d947bd9100fd62fe5e2a12dbd6734

Download Submit
C:\LDPlayer\LDPlayer9\dnmultiplayer.exe

Filesize
1.3MB

MD5
6b9a90218a9dfbd5d57e5df0cac7ac5b

SHA1
3d94fbfb04679cceac92f16433ab2d891d18e415

SHA256
bf3ce593afd4e83c319b3d2ec3a41561c0c58d7ffbaf8014c214c66029722efc

SHA512
152174e688527bf58215971831640b2abcbfb7a978967b60bf1eb959333a09f2038698463e16feca26f27e7ca59247747dbb9726fc42b4b795e6a2fcc3c4c1b3

Download Submit
C:\LDPlayer\LDPlayer9\dnplayer.exe

Filesize
3.7MB

MD5
c1455dc2a6b37767c094fc38d78ea99d

SHA1
786f9f5cffdca865f70d60f8bd16f8043637a7bd

SHA256
6b09c7ff6a6880f78be3eeb99ad0bfd08a174a3cea2a73807dae73ce76c3dd4d

SHA512
b62447009c3fae0881d8cd3d0aee6bea2facee8d691b127fa7a49c36764554af1cdc49486ecb8da36ce88d8027efff054483b8bee907952cf02c94ed796dd412

Download Submit
C:\LDPlayer\LDPlayer9\dnrepairer.exe

Filesize
41.9MB

MD5
4429724df73e9a4e5634635797d16c64

SHA1
2ff75d075962de7a3ee0be4ebe1da19eecea255e

SHA256
0b2f863d93549629cc5e1954e358ad14a007a2cfd82a7b4bce9e820ee3f9ca6d

SHA512
0bd508c89b60538aac2e5b038fa128ae7b88a44bdbfa39fb5351ad486707163983a30402fcc3c951920ec133462a733e8faed3b12da5fc82f391810b7a0c87cf

Download Submit
C:\LDPlayer\LDPlayer9\dnresource.rcc

Filesize
5.6MB

MD5
49da1d5a1a21329e701481307cb088e5

SHA1
d00e04a18ebb5a926105a2cae87413cfc2216dcc

SHA256
e5811b8eecb6ac812b609c031db6f920654a07aae766ee329a343d39cd6eeedd

SHA512
4960b5d5ccd802d97daea872409865cfff0f2a5f7ef60b8f24b48b67a686c8f633df401c7724dd7146b9d3ec077ec7122994627b7312a2e7f16fe84679b4559c

Download Submit
C:\LDPlayer\LDPlayer9\fonts\Roboto-Regular.otf

Filesize
103KB

MD5
4acd5f0e312730f1d8b8805f3699c184

SHA1
67c957e102bf2b2a86c5708257bc32f91c006739

SHA256
72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5

SHA512
9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

Download Submit
C:\LDPlayer\LDPlayer9\msvcp120.dll

Filesize
444KB

MD5
50260b0f19aaa7e37c4082fecef8ff41

SHA1
ce672489b29baa7119881497ed5044b21ad8fe30

SHA256
891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9

SHA512
6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

Download Submit
C:\LDPlayer\LDPlayer9\msvcr120.dll

Filesize
947KB

MD5
50097ec217ce0ebb9b4caa09cd2cd73a

SHA1
8cd3018c4170072464fbcd7cba563df1fc2b884c

SHA256
2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112

SHA512
ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

Download Submit
C:\LDPlayer\LDPlayer9\phones.data

Filesize
5KB

MD5
fdee6e3ccf8b61db774884ccb810c66f

SHA1
7a6b13a61cd3ad252387d110d9c25ced9897994d

SHA256
657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4

SHA512
f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
cde2424d99db56dd0d1eaf34811738c1

SHA1
cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f

SHA256
4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131

SHA512
d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll

Filesize
17KB

MD5
acf4321ac8c8ff4d0442c799d621f8d9

SHA1
b12f87e6afc48697f1ce8b587715361e89b79cae

SHA256
69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725

SHA512
7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll

Filesize
17KB

MD5
3c47c25b8141d20b2b4d576000000a61

SHA1
04543f9cdd847ff66389c9fd1e12b444dae6383a

SHA256
290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956

SHA512
c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
e05ce0232e64328c62c9da37698566bf

SHA1
50c25e6ecec2cd17ecf3117bb9a646ba107d2b84

SHA256
573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410

SHA512
8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
a26c7ffcf18b62904dab7786de638ea6

SHA1
b28489bc38ee2f522ee83dcf49faeb96f39a77e3

SHA256
74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830

SHA512
768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
6a55a7e284b51b086b63cc6f2061ce8b

SHA1
46a48a1ccf5262038b71ed4be09cf625009d078d

SHA256
d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb

SHA512
6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
6e38a6bed88e1c27155e4dc428188ef0

SHA1
8b47a1960ed157f7beeb80fa4a16a723279c4efa

SHA256
144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924

SHA512
3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
9304209688e2a18d0b26997bc78fda7a

SHA1
5d4332cf1c5123418c6419d0291486c3939e8785

SHA256
d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4

SHA512
5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
f42a84d78a5a15ff1a4dbac591e95783

SHA1
1cd5b5e68fd729bdd340463b53728634d342b0cd

SHA256
f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234

SHA512
89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
9f286e57e5b1c1a347adf9eef059ad5d

SHA1
631aa1aa364234acc5ad20b27f926e9cb9ee4276

SHA256
f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970

SHA512
6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
beaae8294db31afa04fa60795c6e02ae

SHA1
8a32ebd843e461864747fe0aebf4bbf83c4ec093

SHA256
f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141

SHA512
dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
2ac1289e4dbab076b332869bef26d3ce

SHA1
60570ddd06b671e26c6a814b9c08cdfa0ef38aba

SHA256
6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26

SHA512
e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
a2661a468bb87ee9cc5dee968fd3805c

SHA1
9b17fbd552e34888f1453f9113ff4c42efaf6d6a

SHA256
dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd

SHA512
b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
acbfc011d5842ba60c372ba3d222ab70

SHA1
16b8014060a04bb03215f6ce4c118bae48653bd5

SHA256
b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e

SHA512
dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
19d14d348ac38737431a7ee2f82973e6

SHA1
11cd8f5dc5c08d133b9b006da5c84946f012cbb6

SHA256
1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae

SHA512
b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
ea0e13feac13dc18c79eb682bef4676e

SHA1
b9db47624345c68cf07bd2677df537e0f975caf9

SHA256
2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0

SHA512
540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
1af2a91dc0a4e48bab0ca123073adf30

SHA1
cf6625fd31b17d46dd31b16372840c74026d0ba2

SHA256
ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc

SHA512
45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
9b9d1949b75df171884f6f8caba7ff59

SHA1
411adf413f53c56488d5cf68e9b4b692889f3c4b

SHA256
cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786

SHA512
dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
18KB

MD5
c6e268c877a9be5b43877308b1231120

SHA1
949105c826dee6a32fe1288285e3e41cb7d04821

SHA256
eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f

SHA512
776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
5122b8aa14a25c8567d9d0335036446f

SHA1
81961f2c8a331136f8156930779964a71e0badc4

SHA256
7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c

SHA512
758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
e1b30d56617709cf7dff5f464d7566d9

SHA1
e29646b1c90550cb86ed42782c764d41f2c70651

SHA256
5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b

SHA512
e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
e4b64b2710725ec3332021bd8044d884

SHA1
2d7f8d87d0f395296ecdf277084d23cb9e0880e8

SHA256
9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65

SHA512
ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2

Download Submit
C:\LDPlayer\LDPlayer9\vms\config\leidian0.config

Filesize
641B

MD5
73e6ee33f93b9bb8f565932f5898685b

SHA1
841f340528a66679837ea701ad09b2bebd992288

SHA256
0d0a8a1f0bf57d78b4124a8a6e1f25686a343b807197bdcc0b2c5fa4502c0b86

SHA512
064aeccc3c6f86387844f3c81971d8f01139752f81ae31ac6587de3cabf9115f386c89f876f6d35e63aef0b52ac93d7f9566b492ae525b6d3f7f0286169998e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\772D055D5E4421B179898A4E6FBD9ACC

Filesize
471B

MD5
14f9e3a303579ed9e2815fad5092f643

SHA1
43b492f0599a3bb48c85c9497152fc587240af16

SHA256
aed2efd5b8b126edab9a659929e607b06fde8f9c3078266b780c32f37e7e95a7

SHA512
fcd57499407ec0fcb933663a17c8c28458db25c6a6de35b650072bf1e366a78c2a30b0f857db188671f69165c594b46265511aa1465035496aaf78f0061e5cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D

Filesize
471B

MD5
3bde5158b78df09417a7212e947cf6a8

SHA1
37c36c5f0d2d27439ab2c71e59c62a3314d729cf

SHA256
ad5a9804e1225ca86b55eaff9e0a9211ed40cb7b3144745cac8613173501cf84

SHA512
4fc81babbc627bb51220c231456ee042d588856914920359d17e6d5d181d0c167b846d100535b7ea94d229f7c91adc052f4c035587b3b4d2c1af3719dc28687a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\772D055D5E4421B179898A4E6FBD9ACC

Filesize
400B

MD5
7f1a3867097dce456df13963f28ee3b8

SHA1
7aab6765a2f6b036703379a0a4a7796c28154fda

SHA256
87c18fe5ef4bbc6cc7bc6350ee9de9931f95d042fddc873f716b351939f1f1b4

SHA512
e89e1d7bc9e80efafecdae7523b0088be0082f0f4c6ed4452530d0debd624e41032881bf37034b2831e77f960073e02b306d68356d2cfcda4972b85d596fd7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D

Filesize
404B

MD5
eda0ff3527ee363b316a82674cfde0e7

SHA1
5436c10e89c0ea252c94b5d2020550942e6ba692

SHA256
2c1ef1424336c79bb8be5623ce6ff4e107c245a87fb41dc1a0681b53147fd02c

SHA512
357fa909370a6c90d9ce89c66ff0387fb9c702f5f40cd686a7cc961f96bea43b7bfa2568651a0eff70efe75dfd73fae95f14a54c82f1b28a164fe1c5445b0118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c58ccb4da696442ae40d3db9e4b41c3f

SHA1
e27933a94d57f04c75b8bff25ad7012171917f87

SHA256
d0d75be801bf0c5f715665c73214bfa38fd714dd9ee846de410855d96dd75931

SHA512
82a7cd39758d67f1d177ce7f46a5ee560eb60207ca7ca1e39b9a08a269ed140532bf1ec85899a033a54d20a0d59592d1cd5f5d35f71da98f6b6e35cd904e1872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef0e81b130f8dcf42e80097a75e5d04d

SHA1
d8694b7c5fba1ee2e73e69dd7790ca5b1cb882db

SHA256
fc53158d948d1742e3f960124f9fdb138eaa4aa711d0f43833fa893247de4918

SHA512
c85df1696537dfce601de46183b1b22d7f0007b0f695f1904bbd1a6e429d7787c3d6199bcecdb21936d811b35eeca57a9800bcd3a3b585569aabeb0b5b497efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
155ee2f079c2a3fdc6c1b55261453990

SHA1
61e692b9f0a0a1be6250c4d228494473d1f1958f

SHA256
7871d8e75fb7a97a864452f00601242dd4381b22d73a6e9d55973a95afd5618f

SHA512
a621f752a0935293630f9589d8d5d202d2e9ce6497433e677f249ed0847036c6607a5c9f67b5fe4d8fc3e6c542c6040a894f9d8f243cc61696a772ec6c86d12e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
62aee047a3c6cf2fec2a29a34157633b

SHA1
51b6eed704d65a62d8793ea18885d12aa39a5cf2

SHA256
342e67b65a4070bbd6e7c2fbf75c98e727d9db45fa071181cae0f5eade726ddf

SHA512
21ee4907a0dcf077f9233542462b8bfd01d976dc1fe4a7b7c4ad70d691e7b9101bddcc292e13fc83a22f56355aa5b93949ac124c84da1f43a80851bf313d895e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\AppxProvider.dll

Filesize
574KB

MD5
eb9cbac1aa278b6a8afdb95a9feb4dcc

SHA1
9f12442d4cab56ab451d3954783632f77be7f8e4

SHA256
1bf704107250f4c08fdf2c450d4ab402ba5317a8c026cddf98c0ce225f487d4c

SHA512
ea86c2360622401aa61c8932571df2dbf6c5fcc438d5b1048d61cfe9542cba0b74c1454dced6a13a7cd20fbbe5cbaa0b1432b8e4a6feb6702fd0b7cc37b436f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\AssocProvider.dll

Filesize
113KB

MD5
b7db592706d3eefbcf0d5a166d462e56

SHA1
935123fda68594f0c52a765c4bbf468e4458189f

SHA256
de21321272862e7c332e1724dc315f06f3abe7a0340e61d351cab208d6bbf059

SHA512
91a1529db5816695c4424eaf71923ec63430b872cb1e179b6fa63c84acf0ac94baf71f39217f6c28818cd74fcad954a29f1e2efe655c5a0353f7aafdf8740f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\CbsProvider.dll

Filesize
918KB

MD5
57a9a702d5f51b625a869cb6ac0ede0f

SHA1
e5db4003f5a82ea666bbd70083edcb9ca38446b4

SHA256
b19a6d57b76593369e7e06cbcc5bcfd03e18adaa3934fd59c8705213fb5779ee

SHA512
818420f8196f964a2998b1176e87399f3d473237112b877c4e5662b3f601f8492fec3ec2ecd39822bfa12134cc2dd85ddc9e1409ea15ae6b58d8021c69840a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\DismCorePS.dll

Filesize
187KB

MD5
35a07968ec37231249f3f072ae555e3a

SHA1
a6b5be5daff384d24e68c7d3d540e9edd1e95ce8

SHA256
e5f25e5a170cb3d165c3d143eae967b96ab80f88fb09176da8591b0b68c77e00

SHA512
4806377c40eb0604410bf4760a3bf3ed99a1506af023977f6ad04090d790818034f8ffaeb6f51cf3a16a2109e0f567ddf5d182a50468481a2ed9adb2fe899261

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\DismHost.exe

Filesize
143KB

MD5
97cb1e2fcab378421c4b91df0c9f8310

SHA1
1227ce5f3a75bbbcba54708fcf73a131b0887a29

SHA256
e36bcf02bc11f560761e943d0fad37417078f6cbb473f85c72fcbc89e2600c58

SHA512
1b4668daacbebbe79bedc508f81f0e5ff0545c5823f05c7a403f4e8eb58bbf866f975b8e41a9148f6455243fe180c1afa32cd6b337f7d73ba0cbdf00f7e32de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\DismProv.dll

Filesize
256KB

MD5
ab0dbc4f05b33eaaa447e31accab8d21

SHA1
7064962fbc7e1fdf0cbb13a44e587e28168cd299

SHA256
6a3c3f07bddbc3079873f8799f2c19adddc59f15d6b2dba6e9314e5626bfd2a0

SHA512
a4fea2a0d5a9da86cc1f3868882a4ac661581a77f57251ea073259e0421d6f047b9da7b19e3916a970d7ecda652b4d51d0e64c7ef5d59338eb209b580be85b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\DmiProvider.dll

Filesize
416KB

MD5
0c2e5696f987350b0ae36e692d10ffb2

SHA1
31b0eb2cca497dc532a61bcefe1813641049a0e6

SHA256
52fd26a88d386b906cd1034df69618195e98a3a2743fe4aa185c461b24d5eba3

SHA512
1f20c7002fec8cd7395a93e204f6b3bd33ea4b2d693cd0b04554ab6ffe6458505289c92914bfb56850f5ba43bc60be3a436f6a7b0268dcd8542ca767b2d5cf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\GenericProvider.dll

Filesize
150KB

MD5
972025e2a66cb9a86173223c70ef5421

SHA1
aea2430707dd822904b5762d3e3d9dcc4ca0bab0

SHA256
ba683e9cf490d59aa1092e9f29196d6b48702ce8913d19f167870907ff50c424

SHA512
27e45bda0e699b0cd660b1ccd5873238ab2137067dc3b595a67e8632812642edc6f06da9169f5e38152b921cef47924e75226655adf9b71f64e509a91879a1f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\IBSProvider.dll

Filesize
60KB

MD5
b5b8c30b6eadc678f37d865061684219

SHA1
c78dc8160d7f0d794d6a156d9194f16314a0a361

SHA256
f1bcba5928da73db1a78355afd4cedb8d66e09d28fcfa6ae75112c5e10b0d841

SHA512
de2b7c5a03298a467152a8adc308c4355ca420438b96035083d524b2058daec9d2434eb62d329f747eb9768af8324a306d1e257005df7ddc2ff093a73068e06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\IntlProvider.dll

Filesize
297KB

MD5
18d4bd2bc601dbd4ca32e46f052fd152

SHA1
c0c04c30b9248c06a4f488d7921e1067518f2a2f

SHA256
207c51a4acfb244f05804b54c4d4f71fd5de4745434e40c969d888a4109677df

SHA512
583993ab11f59a4f0a3ff00382323f2ecec735ad8ed55d4ba388ea4e661edec99f4f7f9914b826dfd5ed21a24af719a4e0bdff6b5fc10dd08be21fcbab627394

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\LogProvider.dll

Filesize
78KB

MD5
1176e91f4f663b03515b4d944dcdd72b

SHA1
fa341a412720fd79fe1e1f6e11d850a4e103871d

SHA256
a4ae8aac8660aaa255cc8318c7971273201e62954d6d36ac5d7ec738fb218258

SHA512
c31f3bbff71ebc3f29813cf55754593262884fc71327db58622da62daa92062b1e8e2f6877a71ca832f40e7127c478d931661527485e801b74dcfdfaf6670874

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\MsiProvider.dll

Filesize
208KB

MD5
0655a77306506895e5d3b5e7dbc833e0

SHA1
51087449d02fb42c948a1f53735bed1ccedd1ad8

SHA256
bfac469b3bfe0dc5419059d889eabb2ab1bdf1a6298a6de743cf0f189a48c679

SHA512
dab8ce18208670e720927f3d6bc317cb81b72c6ca95a92e637d9e19bec4666b3607747bbb3f0ef7285a41c49a26c2a52fb225224ece22aff391f89df2f9df61d

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\OSProvider.dll

Filesize
150KB

MD5
684fca651758ba405144d5fcab6ab7fe

SHA1
da595c60fbc4336fd2c61b45384dc0dbc3bf599a

SHA256
ae9b66a6e0b1949890241c67037cef2c59d4f4faef84849789e0fee9184f41c6

SHA512
4f8a9c524dd4e0f2a2f6f67a1ce42a7e9590fc5715f9538d8e0c7ff0c67d4bcbe10318bebd6328ee29c6c3b9842d0e176da7e663a88d9ecdec8c6404571c3756

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\OfflineSetupProvider.dll

Filesize
183KB

MD5
db1c840507ea36d04d8f8f503804daad

SHA1
990152a67191059ac486074f0a50b97b840bd8e3

SHA256
23fac2578e222a023c7b67186d67070518c17f08a6c39644fbef76293751efc4

SHA512
90da4d328c27f1379f7f9e65019aa242e1899b1a2a5f9626f08aeea020b8f46583878891b8a73b4c555e381f1e8f8c5be5c54dce2d7a2498c2e3a40c8abcb5a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\ProvProvider.dll

Filesize
754KB

MD5
5d7572a7a3724966cf940465ac6e4fbe

SHA1
cab0fdc627744e0f3d99dcc1ca8e8c1b9309301a

SHA256
2d3af1a4c4733d01c46ab82cb7e8ff0392db91db207ca9437a956c9bc5e2186a

SHA512
fc8fe42a23f1c4dca3205c63b22e8717f03c51307267367e0334e1326e47055abbb4738d003bf3340d3a15365c2625c2b791b3a083128e15d37398aaaa969e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\SetupPlatformProvider.dll

Filesize
160KB

MD5
c35697a1ce80b310b670c2aec0c0234f

SHA1
0b4c0bf45f008c09aa51d0152390b4d198df2eb4

SHA256
1467d5059e367ca56a80fc7f169d8f562026f7020e64f12b97a6ee94f92f086d

SHA512
17d8c5ddc72dc7eadd6ece79f432b03fec38e6f494f65318326fc1aef64b52ad2658c29583f7f5b15a11c45102917cec57e8f08828d3a7a97aab508f53e3c5cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\SmiProvider.dll

Filesize
276KB

MD5
97e089eec3c6898bd4159c39853f0dc2

SHA1
ffd3d226ba179abac9d2b24d9081aae1f9c42326

SHA256
bea12ec326503df121ea00e2ab05235d5c89f7040e7481f723acd62feb92f319

SHA512
1ddc5fc98ed3daa5e279693e850e99c14f04b216bbec3460422b29b30085ef2003d0519add06ced7640ff6e14ee3aa0000ebe093bb6da4e40ae34b0fba676f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\SysprepProvider.dll

Filesize
779KB

MD5
d2b254097ee4c8d3d87e6b450e38e8a6

SHA1
2fb26e509ca4261e660ee8f1da1a0e9db12925bd

SHA256
663d8e04f20c8ff6256e680e57cdc738cfc3cf7564ec5f507493dd5ddc72b27c

SHA512
6fbdbc93fc565f1882ad1ba4996eec35510d67330330e2421c86df41284d97293a0d25034c228e0f2430e727125499522be6572adaef1ff31ee3499f9f573654

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\TransmogProvider.dll

Filesize
1.3MB

MD5
e60476d1585d1388e6e1761ad1fde0b4

SHA1
18422195c4ffca0e8ba54d81fbe8500096acacd1

SHA256
d9bb6d4e87c1d869a2a8e03d2b0e5ddfeb086207f10d6c559a939f644d31af88

SHA512
0ee8a343b37c0b61a9f112689d9428978db997a217b8057a6932fab806968ccd63c5560f19895b50c9a01d57588e574a5308ed06d7f57ca37c2f8d51fed2a8bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\90464F7B-0C84-4785-86D5-82C08C4B390A\UnattendProvider.dll

Filesize
229KB

MD5
4fa1ca63b1f8fe59d6074ca92fad82d2

SHA1
9da8e65c3196984544db3197cf0b554a8e800a8d

SHA256
201ea386a50b5d4317a66c1889c669ffd2e545a2531e33806aa00605f8852a52

SHA512
9d1a44b1f09a28c91edd7b727abbabbc57b7b72cc2e00973eda8d1af2861d1128be09fd8ffa43dd5a0d163010bba7da58285384e889259121dc772d8bf3b464b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_13bklux4.cx4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
2.2MB

MD5
d6f3477b762723df27ee40c90bfc59f8

SHA1
83cac0a4928be1066f137af563e63a4b6afd5513

SHA256
03a31283a2b7367ae5d821c99c377088281d00435d3a1280d167433c753a5aa2

SHA512
e763bfebe831949bb63bafd9cc542d5e41ce2e790c2c692c802bd4f9c0a90df7d99155c2ec147106002ab2ba14c5009aa986a750ab59e61a4c78358c681dc6db

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
2.3MB

MD5
f5b37fc1464bea249d93064193eca929

SHA1
0332a3bb8f46785e16ebd021dc18bfdca9c702a0

SHA256
d5f935fc7283fa787d3719987f284c8f6cbd9c5b09fd11ef6c493f1eaa621db5

SHA512
ecea1cb890208e30b20dc6730a7069e1b92a2005a3f198f1b4715cd3790167af51b35de3fe5c6be203b917d0393bd9c92d2ea66a94d09b97631aa3d4c52a9d23

Download Submit
memory/1624-563-0x0000000007BB0000-0x0000000007BBE000-memory.dmp

Filesize
56KB

Download
memory/1624-537-0x0000000006070000-0x00000000060D6000-memory.dmp

Filesize
408KB

Download
memory/1624-558-0x0000000007FD0000-0x000000000864A000-memory.dmp

Filesize
6.5MB

Download
memory/1624-559-0x0000000007980000-0x000000000799A000-memory.dmp

Filesize
104KB

Download
memory/1624-560-0x00000000079E0000-0x00000000079EA000-memory.dmp

Filesize
40KB

Download
memory/1624-561-0x0000000007C40000-0x0000000007CD6000-memory.dmp

Filesize
600KB

Download
memory/1624-562-0x0000000007B60000-0x0000000007B71000-memory.dmp

Filesize
68KB

Download
memory/1624-564-0x0000000007BE0000-0x0000000007BFA000-memory.dmp

Filesize
104KB

Download
memory/1624-531-0x00000000058B0000-0x0000000005916000-memory.dmp

Filesize
408KB

Download
memory/1624-544-0x0000000006660000-0x00000000066AC000-memory.dmp

Filesize
304KB

Download
memory/1624-542-0x0000000006230000-0x0000000006587000-memory.dmp

Filesize
3.3MB

Download
memory/1624-543-0x0000000006610000-0x000000000662E000-memory.dmp

Filesize
120KB

Download
memory/1624-530-0x0000000005810000-0x0000000005832000-memory.dmp

Filesize
136KB

Download
memory/1624-529-0x00000000059A0000-0x000000000606A000-memory.dmp

Filesize
6.8MB

Download
memory/1624-528-0x0000000002C50000-0x0000000002C86000-memory.dmp

Filesize
216KB

Download
memory/1624-556-0x0000000006C50000-0x0000000006C6E000-memory.dmp

Filesize
120KB

Download
memory/1624-557-0x00000000078A0000-0x0000000007943000-memory.dmp

Filesize
652KB

Download
memory/1624-546-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

Filesize
304KB

Download
memory/1624-545-0x0000000006BF0000-0x0000000006C22000-memory.dmp

Filesize
200KB

Download
memory/2120-675-0x0000000000E70000-0x0000000000E86000-memory.dmp

Filesize
88KB

Download
memory/2120-765-0x0000000036850000-0x0000000036860000-memory.dmp

Filesize
64KB

Download
memory/2136-597-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

Filesize
304KB

Download
memory/3616-577-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

Filesize
304KB

Download
memory/3616-572-0x0000000005F80000-0x00000000062D7000-memory.dmp

Filesize
3.3MB

Download