500cd8d0e8d7eb3cf7da63dd93978bf36a07fdc6b5a844de30cf84ccb38eedc4

Resubmissions

21/03/2025, 21:50

250321-1p8z9s1sdz 10

21/03/2025, 21:49

250321-1pefnavkw7 6

Analysis

max time kernel
624s
max time network
625s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LDPlayer9_ens_1001_ld.exe
Size

2.1MB
MD5

2b259cd02570e0d7103c70fe9a9e4d17
SHA1

035fe918c59274c1fc662e7d88d0d92d1150fa19
SHA256

500cd8d0e8d7eb3cf7da63dd93978bf36a07fdc6b5a844de30cf84ccb38eedc4
SHA512

2547a8b631ca07270668741612a8a0d3935008a98ab538f6a14fb1cf3e8d2d82ae7bbe9fe22a495b32ee16b038aaa268b2750ed42705fbf6d080249279cdcb27
SSDEEP

24576:Ezvv2Jddh0hXxwQNBH5ffUX5zAEefc5Urz5Eo7zrrdXbETyLAyNBN/8LcpmZQ4J/:22e1iify35cdrrFJAWb/8amDe8hSSw0r

Score

8^/10

discovery execution exploit persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubDumpStructure"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15\FuncName = "WVTAsn1SpcPeImageDataEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2004\FuncName = "WVTAsn1SpcPeImageDataDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2000\FuncName = "WVTAsn1SpcSpAgencyInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25\FuncName = "WVTAsn1SpcLinkEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11\FuncName = "WVTAsn1SpcStatementTypeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\FuncName = "WVTAsn1CatNameValueDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2005\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubDumpStructure"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4\FuncName = "WVTAsn1SpcIndirectDataContentEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27\FuncName = "WVTAsn1SpcFinancialCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30\FuncName = "WVTAsn1SpcSigInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26\Dll = "WINTRUST.DLL"	regsvr32.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2220	icacls.exe
2732	takeown.exe
2396	icacls.exe
1280	takeown.exe
548	icacls.exe
576	takeown.exe
3008	icacls.exe
2932	takeown.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
548	icacls.exe
576	takeown.exe
3008	icacls.exe
2932	takeown.exe
2220	icacls.exe
2732	takeown.exe
2396	icacls.exe
1280	takeown.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
29	2068	LDPlayer9_ens_1001_ld.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer9_ens_1001_ld.exe
File opened (read-only)	\??\F:	LDPlayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
73	discord.com
76	discord.com
77	discord.com
79	discord.com

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-convert-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_CM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\bldRTIsoMaker.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDragAndDropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-namedpipe-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\libssl-1_1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf-PreW10.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxRes.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-multibyte-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_V2_utils.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetFltNobj.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcr120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxCAPI.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-processthreads-l1-1-1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\concrt140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\concrt140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\UICommon.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxRT-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\comregister.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\bldRTLdrCheckImports.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libcrypto-1_1-x64.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstAnimate.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxGuestControlSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxInstallHelper.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-convert-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libcurl.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-synch-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libOpenglRender.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qoffscreen.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxC.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\capi.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-profile-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-utility-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxSup.inf	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ldutils2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qminimal.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-stdio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetLwfUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDD.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSharedClipboard.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-rtlsupport-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-filesystem-l1-1-0.dll	dnrepairer.exe
File opened for modification	C:\Program Files\ldplayer9box\Ld9BoxNetLwf.inf	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxDDR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf.inf	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\loadall.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-filesystem-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-private-l1-1-0.dll	dnrepairer.exe

Executes dropped EXE 15 IoCs

pid	Process
1004	LDPlayer.exe
3068	dnrepairer.exe
2404	Ld9BoxSVC.exe
2952	driverconfig.exe
1600	dnplayer.exe
2072	Ld9BoxSVC.exe
3020	vbox-img.exe
2748	vbox-img.exe
2500	vbox-img.exe
2756	Ld9BoxHeadless.exe
1724	Ld9BoxHeadless.exe
1592	Ld9BoxHeadless.exe
2672	Ld9BoxHeadless.exe
2000	Ld9BoxHeadless.exe
1752	bugreport.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1872	sc.exe
2864	sc.exe
704	sc.exe
2600	sc.exe
1528	sc.exe
2972	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
2068	LDPlayer9_ens_1001_ld.exe
1004	LDPlayer.exe
3068	dnrepairer.exe
3068	dnrepairer.exe
3068	dnrepairer.exe
3068	dnrepairer.exe
3068	dnrepairer.exe
2404	Ld9BoxSVC.exe
2404	Ld9BoxSVC.exe
2404	Ld9BoxSVC.exe
2404	Ld9BoxSVC.exe
2404	Ld9BoxSVC.exe
2404	Ld9BoxSVC.exe
2404	Ld9BoxSVC.exe
2404	Ld9BoxSVC.exe
2108	regsvr32.exe
2108	regsvr32.exe
2108	regsvr32.exe
2108	regsvr32.exe
2108	regsvr32.exe
2108	regsvr32.exe
2108	regsvr32.exe
2108	regsvr32.exe
2212	regsvr32.exe
2212	regsvr32.exe
2212	regsvr32.exe
2212	regsvr32.exe
2212	regsvr32.exe
2212	regsvr32.exe
2212	regsvr32.exe
2212	regsvr32.exe
2088	regsvr32.exe
2088	regsvr32.exe
2088	regsvr32.exe
2088	regsvr32.exe
2088	regsvr32.exe
2088	regsvr32.exe
2088	regsvr32.exe
2088	regsvr32.exe
2220	regsvr32.exe
2220	regsvr32.exe
2220	regsvr32.exe
2220	regsvr32.exe
2220	regsvr32.exe
2220	regsvr32.exe
2220	regsvr32.exe
2220	regsvr32.exe
1004	LDPlayer.exe
2952	driverconfig.exe
2952	driverconfig.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1600	dnplayer.exe
1600	dnplayer.exe
1600	dnplayer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_1001_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bugreport.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2256	systeminfo.exe
1884	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "325"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "11779"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "407"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "233"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "11779"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "407"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "448755906"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "233"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "233"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\MAIN	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "407"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000050311b662e55224192af41c8b31af5b200000000020000000000106600000001000020000000347d0df187548f62f24c0c8e570857594910861e6854c660a4b8535c38b2a96c000000000e80000000020000200000008751825ea9e5cdd94d857c5f5e0cba77512785520e857732f46b1ce02a27b4e0900000003c9972560d1ab6742e797d13c1120d2cfa3f3c15cc96b08ef8ad8219b4dba5cc995411a90fb0945553cfec588a5ffa691476d6c1e5ef1d2693b8bff86b2f7aefcd42e97d97dd236f3da233080378ca8ae5a32a5755cc518284b321f79da8950616417a33887ff8815b74428ff1c48f55cfb09e4eaa2cb2c498f35d1f0cb86cc004118c6cba19949292e3bd8f98d038484000000098b4463d766bfd42283576af013ff1dfe71cb15f1c3060ce8b3a5089e96c1b6f4f3cfc6e7e74d72ca7ed7ac01d937992d7c8198f16ca9886d5728ba841983260	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "325"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC9AD3D1-069E-11F0-A540-C28ADB222BBA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "492"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\ = "INetworkAdapter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-8F30-401B-A8CD-FE31DBE839C0}\ = "IEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-08A2-41AF-A05F-D7C661ABAEBE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-DAD4-4496-85CF-3F76BCB3B5FA}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-4521-44CC-DF95-186E4D057C83}\NumMethods\ = "4"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-AC97-4C16-B3E2-81BD8A57CC27}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-d4fc-485f-8613-5af88bfcfcdc}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-48DF-438D-85EB-98FFD70D18C9}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-BE30-49C0-B315-E9749E1BDED1}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-6038-422C-B45E-6D4A0503D9F1}\ = "ISnapshotTakenEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E64A-4908-804E-371CAD23A756}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-604D-11E9-92D3-53CB473DB9FB}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-800A-40F8-87A6-170D02249A55}\ = "IExtraDataCanChangeEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-1C58-440C-BB7B-3A1397284C7B}\NumMethods\ = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.Session.1\ = "Session Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E8A-11E9-8082-DB8AE479EF87}\NumMethods\ = "16"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.Session.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7966-481d-ab0b-d0ed73e28135}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9B2D-4377-BFE6-9702E881516B}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-394D-44D3-9EDB-AF2C4472C40A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-CC7B-431B-98B2-951FDA8EAB89}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-057D-4391-B928-F14B06B710C5}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1A29-4A19-92CF-02285773F3B5}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D4FC-485F-8613-5AF88BFCFCDC}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-477A-2497-6759-88B8292A5AF0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7708-444B-9EEF-C116CE423D39}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9536-4EF8-820E-3B0E17E5BBC8}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8079-447A-A33E-47A69C7980DB}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AEDF-461C-BE2C-99E91BDAD8A1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-3534-4239-B2DE-8E1535D94C0B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-07DA-41EC-AC4A-3DD99DB35594}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C9D6-4742-957C-A6FD52E8C4AE}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7006-40D4-B339-472EE3801844}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-D8ED-44CF-85AC-C83A26C95A4D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B855-40B8-AB0C-44D3515B4528}\NumMethods\ = "15"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5F86-4D65-AD1B-87CA284FB1C8}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-3E78-11E9-B25E-7768F80C0E07}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-9536-4EF8-820E-3B0E17E5BBC8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-EE61-462F-AED3-0DFF6CBF9904}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-3534-4239-B2DE-8E1535D94C0B}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-00C2-4484-0077-C057003D9C90}\ = "IInternalMachineControl"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBox.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-73A5-46CC-8227-93FE57D006A6}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-6989-4002-80CF-3607F377D40C}\ = "IUSBProxyBackend"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C927-11E7-B788-33C248E71FC7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-44A0-A470-BA20-27890B96DBA9}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0B79-4350-BDD9-A0376CD6E6E3}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0002-4B81-0077-1DCB004571BA}\NumMethods\ = "48"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-47C7-4A3F-AAE1-1B516817DB41}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-477A-2497-6759-88B8292A5AF0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-6588-40A3-9B0A-68C05BA52C4B}\ = "IGuestProcessEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D8ED-44CF-85AC-C83A26C95A4D}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1640-41F9-BD74-3EF5FD653250}\ = "IKeyboard"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-C196-4D26-B8DB-4C8C389F1F82}\ = "IVirtualSystemDescription"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80F6-4266-8E20-16371F68FA25}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-FA1E-4CEE-91C7-6D8496BEA3C1}\ = "INATNetworkStartStopEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8079-447A-A33E-47A69C7980DB}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-A862-4DC9-8C89-BF4BA74A886A}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-057D-4391-B928-F14B06B710C5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6B76-4805-8FAB-00A9DCF4732B}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80F6-4266-8E20-16371F68FA25}\ = "IReusableEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{20191216-70A2-487E-895E-D3FC9679F7B3}\ = "IGuestFileRegisteredEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C927-11E7-B788-33C248E71FC7}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	LDPlayer9_ens_1001_ld.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	LDPlayer9_ens_1001_ld.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2068	LDPlayer9_ens_1001_ld.exe
2068	LDPlayer9_ens_1001_ld.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
1004	LDPlayer.exe
3068	dnrepairer.exe
1392	powershell.exe
1588	powershell.exe
2248	powershell.exe
1004	LDPlayer.exe
1752	bugreport.exe
1752	bugreport.exe
1752	bugreport.exe
1752	bugreport.exe
1752	bugreport.exe
1752	bugreport.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1600	dnplayer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe
Token: SeDebugPrivilege	1004	LDPlayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1796	iexplore.exe
1600	dnplayer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1600	dnplayer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
596	IEXPLORE.EXE
596	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1004	2068	LDPlayer9_ens_1001_ld.exe	36
PID 2068 wrote to memory of 1004	2068	LDPlayer9_ens_1001_ld.exe	36
PID 2068 wrote to memory of 1004	2068	LDPlayer9_ens_1001_ld.exe	36
PID 2068 wrote to memory of 1004	2068	LDPlayer9_ens_1001_ld.exe	36
PID 1004 wrote to memory of 3068	1004	LDPlayer.exe	38
PID 1004 wrote to memory of 3068	1004	LDPlayer.exe	38
PID 1004 wrote to memory of 3068	1004	LDPlayer.exe	38
PID 1004 wrote to memory of 3068	1004	LDPlayer.exe	38
PID 3068 wrote to memory of 1952	3068	dnrepairer.exe	39
PID 3068 wrote to memory of 1952	3068	dnrepairer.exe	39
PID 3068 wrote to memory of 1952	3068	dnrepairer.exe	39
PID 3068 wrote to memory of 1952	3068	dnrepairer.exe	39
PID 1952 wrote to memory of 2568	1952	net.exe	41
PID 1952 wrote to memory of 2568	1952	net.exe	41
PID 1952 wrote to memory of 2568	1952	net.exe	41
PID 1952 wrote to memory of 2568	1952	net.exe	41
PID 3068 wrote to memory of 980	3068	dnrepairer.exe	42
PID 3068 wrote to memory of 980	3068	dnrepairer.exe	42
PID 3068 wrote to memory of 980	3068	dnrepairer.exe	42
PID 3068 wrote to memory of 980	3068	dnrepairer.exe	42
PID 3068 wrote to memory of 980	3068	dnrepairer.exe	42
PID 3068 wrote to memory of 980	3068	dnrepairer.exe	42
PID 3068 wrote to memory of 980	3068	dnrepairer.exe	42
PID 3068 wrote to memory of 1996	3068	dnrepairer.exe	43
PID 3068 wrote to memory of 1996	3068	dnrepairer.exe	43
PID 3068 wrote to memory of 1996	3068	dnrepairer.exe	43
PID 3068 wrote to memory of 1996	3068	dnrepairer.exe	43
PID 3068 wrote to memory of 1996	3068	dnrepairer.exe	43
PID 3068 wrote to memory of 1996	3068	dnrepairer.exe	43
PID 3068 wrote to memory of 1996	3068	dnrepairer.exe	43
PID 3068 wrote to memory of 2080	3068	dnrepairer.exe	44
PID 3068 wrote to memory of 2080	3068	dnrepairer.exe	44
PID 3068 wrote to memory of 2080	3068	dnrepairer.exe	44
PID 3068 wrote to memory of 2080	3068	dnrepairer.exe	44
PID 3068 wrote to memory of 2080	3068	dnrepairer.exe	44
PID 3068 wrote to memory of 2080	3068	dnrepairer.exe	44
PID 3068 wrote to memory of 2080	3068	dnrepairer.exe	44
PID 3068 wrote to memory of 1796	3068	dnrepairer.exe	45
PID 3068 wrote to memory of 1796	3068	dnrepairer.exe	45
PID 3068 wrote to memory of 1796	3068	dnrepairer.exe	45
PID 3068 wrote to memory of 1796	3068	dnrepairer.exe	45
PID 3068 wrote to memory of 1796	3068	dnrepairer.exe	45
PID 3068 wrote to memory of 1796	3068	dnrepairer.exe	45
PID 3068 wrote to memory of 1796	3068	dnrepairer.exe	45
PID 3068 wrote to memory of 1600	3068	dnrepairer.exe	46
PID 3068 wrote to memory of 1600	3068	dnrepairer.exe	46
PID 3068 wrote to memory of 1600	3068	dnrepairer.exe	46
PID 3068 wrote to memory of 1600	3068	dnrepairer.exe	46
PID 3068 wrote to memory of 1600	3068	dnrepairer.exe	46
PID 3068 wrote to memory of 1600	3068	dnrepairer.exe	46
PID 3068 wrote to memory of 1600	3068	dnrepairer.exe	46
PID 3068 wrote to memory of 1692	3068	dnrepairer.exe	47
PID 3068 wrote to memory of 1692	3068	dnrepairer.exe	47
PID 3068 wrote to memory of 1692	3068	dnrepairer.exe	47
PID 3068 wrote to memory of 1692	3068	dnrepairer.exe	47
PID 3068 wrote to memory of 1692	3068	dnrepairer.exe	47
PID 3068 wrote to memory of 1692	3068	dnrepairer.exe	47
PID 3068 wrote to memory of 1692	3068	dnrepairer.exe	47
PID 3068 wrote to memory of 1804	3068	dnrepairer.exe	48
PID 3068 wrote to memory of 1804	3068	dnrepairer.exe	48
PID 3068 wrote to memory of 1804	3068	dnrepairer.exe	48
PID 3068 wrote to memory of 1804	3068	dnrepairer.exe	48
PID 3068 wrote to memory of 1804	3068	dnrepairer.exe	48
PID 3068 wrote to memory of 1804	3068	dnrepairer.exe	48

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1001_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1001_ld.exe"
1⤵
- Downloads MZ/PE file
- Enumerates connected drives
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2068
- C:\LDPlayer\LDPlayer9\LDPlayer.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=1001 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" listener=262542
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:980
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:1996
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2080
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1600
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1692
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:1804
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1280
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:548
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:576
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3008
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\Users\Admin\.Ld9VirtualBox" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2932
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\Users\Admin\.Ld9VirtualBox" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2220
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2404
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:2108
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2212
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2088
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2220
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1872
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2864
  - - C:\Windows\SysWOW64\sc.exe
      sc query HvHost
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:704
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmms
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      PID:1404
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        5⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:1884
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1392
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1588
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2248
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2952
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2732
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2396
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/4bUcwDd53d
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1796
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:596
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:537608 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2384
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\dnplayer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1600
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2928
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:2256
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    - Executes dropped EXE
    PID:3020
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:2748
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:2500
- - C:\LDPlayer\LDPlayer9\bugreport.exe
    "C:\LDPlayer\LDPlayer9\bugreport.exe" pid=0x00000640 context=0x6eef90e8
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1752

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1028

C:\Windows\system32\SystemPropertiesPerformance.exe
"C:\Windows\system32\SystemPropertiesPerformance.exe"
1⤵
PID:2740

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2072
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LDPlayer\LDPlayer9\dnmultiplayer.exe

Filesize
1.3MB

MD5
c4e98fdba5d3b3a95f96abf279bf240a

SHA1
c6bce2c2ae044fd4054a58f2fd9757252b4e9afe

SHA256
1f817c6cf7ba37f0d89e45640639e1b8256639045de98bfa63f17de3f4eacb16

SHA512
799cfbda36d41e2029b1d13a600807731cb230b2ceb96f2b77a260f4ea174af810ba1e64dd04d43a38f9caa6775ae0523c61f614e5b8c857433cb02ae06ef5ac

Download Submit
C:\LDPlayer\LDPlayer9\dnplayer.exe

Filesize
3.7MB

MD5
b668762c83ea3cb69a400824e3c56c23

SHA1
087621217249a70dfd7cbf2c46ee7a3053636d9d

SHA256
c167875d270e8a307dc7c125a118d2fce8b61425dded1bff0486115e6677afb9

SHA512
819928240e9f005cee2101f84d7c27bd1036f625d77ddd12f672b54d993fd4bdce32189f369f18ac36786b07d8d6602f281aa5888db7a86f92ee5ba2d179ec29

Download Submit
C:\LDPlayer\LDPlayer9\dnrepairer.exe

Filesize
41.9MB

MD5
10b376bf925c50a88096b601abef4d80

SHA1
24a3d1ecb2e0087b2140c6674453fcf9d82cf150

SHA256
13a241b6d1144cbe2e11c9d46ebd26a649f574db8c4bf1a98a92fbe824038912

SHA512
fb7dc9db718dd94c7d275388aa376ca219b8c865d6a05b6392d5acc964c67980458ef2ad7746ac8589e01cb95e4830c7ca0301c15300de1c6c02d2a8bf52bde1

Download Submit
C:\LDPlayer\LDPlayer9\dnresource.rcc

Filesize
5.6MB

MD5
ba84bf6204db711f866adb2841d5c91c

SHA1
807a03b5ddb07b9e8e30c8261e3ba5514cc537e2

SHA256
dad6ee5a8b12b9396b56d827fe91fc8d3f9468428e32902390c0ddef596f2f26

SHA512
ad18d5a353add4e7ffc8868c9ce62ebea947531684e4a054dce116a97a8397dfce39dfc7744cf416fc1259035824645a8ae71b4eed9f8fd5d534c29995c0578a

Download Submit
C:\LDPlayer\LDPlayer9\phones.data

Filesize
5KB

MD5
fdee6e3ccf8b61db774884ccb810c66f

SHA1
7a6b13a61cd3ad252387d110d9c25ced9897994d

SHA256
657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4

SHA512
f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512

Download Submit
C:\LDPlayer\LDPlayer9\system.vmdk

Filesize
246.5MB

MD5
90548594b9aa447ff155d5085cdf0717

SHA1
1edca1a1aa628eaf5612dc7b6f03690515e4e52a

SHA256
b67ec4671cd6644f606de4f66b9f2679d40aedca2887690408574af974a4276c

SHA512
4d91c8fb243818adc560bc355ba98a51b2223fa25174bfbd2e8720d8e3c2039a18e06dd7c6696496604b1547be206b6c3c236863483a20b2ce0cc8bf63d40d08

Download Submit
C:\LDPlayer\LDPlayer9\system.vmdk

Filesize
245.0MB

MD5
4aa7e52e7d199530d31ebcfc00dffa23

SHA1
0b4fa470e439ffcc9688148e99cb4751de62c8ab

SHA256
6fea73169f4b40387f9819d1b963964490ecfe64f8774342017c0a249b0f19a3

SHA512
15641f41e17367a51bf01bbc601ed2a491dd430b71c7bf089179a566f72ea218862806813439d93956b4e00abf6baffa4f35930a3422a36cb01fb39653da4b76

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
cde2424d99db56dd0d1eaf34811738c1

SHA1
cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f

SHA256
4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131

SHA512
d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll

Filesize
17KB

MD5
acf4321ac8c8ff4d0442c799d621f8d9

SHA1
b12f87e6afc48697f1ce8b587715361e89b79cae

SHA256
69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725

SHA512
7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll

Filesize
17KB

MD5
3c47c25b8141d20b2b4d576000000a61

SHA1
04543f9cdd847ff66389c9fd1e12b444dae6383a

SHA256
290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956

SHA512
c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
e05ce0232e64328c62c9da37698566bf

SHA1
50c25e6ecec2cd17ecf3117bb9a646ba107d2b84

SHA256
573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410

SHA512
8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
a26c7ffcf18b62904dab7786de638ea6

SHA1
b28489bc38ee2f522ee83dcf49faeb96f39a77e3

SHA256
74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830

SHA512
768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
6a55a7e284b51b086b63cc6f2061ce8b

SHA1
46a48a1ccf5262038b71ed4be09cf625009d078d

SHA256
d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb

SHA512
6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
6e38a6bed88e1c27155e4dc428188ef0

SHA1
8b47a1960ed157f7beeb80fa4a16a723279c4efa

SHA256
144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924

SHA512
3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
9304209688e2a18d0b26997bc78fda7a

SHA1
5d4332cf1c5123418c6419d0291486c3939e8785

SHA256
d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4

SHA512
5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
f42a84d78a5a15ff1a4dbac591e95783

SHA1
1cd5b5e68fd729bdd340463b53728634d342b0cd

SHA256
f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234

SHA512
89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
9f286e57e5b1c1a347adf9eef059ad5d

SHA1
631aa1aa364234acc5ad20b27f926e9cb9ee4276

SHA256
f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970

SHA512
6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
beaae8294db31afa04fa60795c6e02ae

SHA1
8a32ebd843e461864747fe0aebf4bbf83c4ec093

SHA256
f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141

SHA512
dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
2ac1289e4dbab076b332869bef26d3ce

SHA1
60570ddd06b671e26c6a814b9c08cdfa0ef38aba

SHA256
6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26

SHA512
e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
a2661a468bb87ee9cc5dee968fd3805c

SHA1
9b17fbd552e34888f1453f9113ff4c42efaf6d6a

SHA256
dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd

SHA512
b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
acbfc011d5842ba60c372ba3d222ab70

SHA1
16b8014060a04bb03215f6ce4c118bae48653bd5

SHA256
b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e

SHA512
dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
19d14d348ac38737431a7ee2f82973e6

SHA1
11cd8f5dc5c08d133b9b006da5c84946f012cbb6

SHA256
1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae

SHA512
b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
ea0e13feac13dc18c79eb682bef4676e

SHA1
b9db47624345c68cf07bd2677df537e0f975caf9

SHA256
2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0

SHA512
540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
1af2a91dc0a4e48bab0ca123073adf30

SHA1
cf6625fd31b17d46dd31b16372840c74026d0ba2

SHA256
ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc

SHA512
45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
9b9d1949b75df171884f6f8caba7ff59

SHA1
411adf413f53c56488d5cf68e9b4b692889f3c4b

SHA256
cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786

SHA512
dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
18KB

MD5
c6e268c877a9be5b43877308b1231120

SHA1
949105c826dee6a32fe1288285e3e41cb7d04821

SHA256
eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f

SHA512
776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
5122b8aa14a25c8567d9d0335036446f

SHA1
81961f2c8a331136f8156930779964a71e0badc4

SHA256
7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c

SHA512
758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
e1b30d56617709cf7dff5f464d7566d9

SHA1
e29646b1c90550cb86ed42782c764d41f2c70651

SHA256
5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b

SHA512
e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
e4b64b2710725ec3332021bd8044d884

SHA1
2d7f8d87d0f395296ecdf277084d23cb9e0880e8

SHA256
9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65

SHA512
ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
67fd470a60fe8fb3f9fbe32fa52871d0

SHA1
09aba019a0d0dae7415b6d9a39e1dc67d93f130b

SHA256
1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8

SHA512
f8c3f1e3bee196487aec704f128240acb57fb392db918a97176793b07726f017177abbb5a6c68822fc59ce06f04d489a78284a865efdc2de518f34ecfb0cc1e6

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f53ed8a0c18157b9e37500621dfab9ee

SHA1
b8a3131150cfd46052353309843c802d9f43df03

SHA256
5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47

SHA512
2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
2b9f551cddd662c618432a75c546b296

SHA1
1ddd65fcc8bb401c734ebc2014d057328f771744

SHA256
070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b

SHA512
54df6e692ac630d969a697c9e6f379c4826ca71b7e8eaefdf502405b1333a6b483256aeba609a4a1c61e73f72d2958aaf3eb31538cc5e7a91101d7d09e3ed9dc

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
7d943f85ff8d1515a02d202ae79453d3

SHA1
94def1f7368172ac50b665e74b89e8f7aae2857b

SHA256
1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89

SHA512
e111dbef97c6c6cb3b5c2d183294620792c48a2cb16d9d91c12cede757a1c0c53d707f4294542bef47eae784893bf63fe0f0229bed4b2d0a961c8d1cc1cf43cb

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
278857b86f667c47cbcce94f5ec73ca8

SHA1
a0f5b7e7c67f3c6b8f285d39d08b740e49445755

SHA256
91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9

SHA512
ebc02d1a2e223eb0b30a8e62089735faed83add4161094493f62561a09c13a426815e7f06c20c44477691109a8c3040dc68527023bfee6d9984c42d6a05208c9

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
6493b21fefae874655c62a56a156f3eb

SHA1
c65beb46f9f03d35867ff008026d3a56fa26fb65

SHA256
8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab

SHA512
93cbe187f7fa86ac58191b5384a993135e3291873a76cc2cf81dd60c68ad7591386e4eb5ab53aaac2a6f48f7f778263b7fa0a4ea0863361910a9f1efee92b64b

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
ae83311041ee793253ff10736317a09e

SHA1
c62d06cb6cbd9d997c42a6ad7f13c06f38725069

SHA256
8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702

SHA512
0fabcb0370330460f8f525401f339535c08d768f075816989a16eff2256584cfa8fd6832df3ce3d9c2a5364b4ef58bfff53cc486e3b48d11b654f7174aa18458

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
12311308d7d65895b3920b3dd3e54b3b

SHA1
3faa74c6913f451d9c575761630b507af0c15ee3

SHA256
76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc

SHA512
67fd047e760dbdadb06cc2c34b935fdabc629fa988484a9f5120cd59d6167d943b612df65626701022b5e73c5b1177a8d813e90c5990468f51a5a11932c008ed

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
3dafcf25a2ac1becf40acbec8fc7134b

SHA1
0729fdc617403622c2edd77fdb7dd49b530e2037

SHA256
ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c

SHA512
9dbb487489c8a6af8dbd6326fe4958f489552af268f2937495ada35bb8404cfaeaf54833d8bba2966e72cd0ba3284a5fd167baf4cd6d905870f5d1ed3e5ff6c0

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
f32bd567d35d2e85504c39dede609e72

SHA1
b7a7145956466e45bbe6f7fe41e935a152c2c325

SHA256
5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e

SHA512
55396f3e5821d3f3eb5988bd3362a0cddf036de4afa8cc1214813834b5a152fc3df787a8347a7aff3de6bf112e1d2a354790f593854a59f1f49393ddf967d085

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
25KB

MD5
56c02fabc2c64174009c905570c3a22d

SHA1
e52154112ad127ab01937453490091def4d21ad2

SHA256
0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc

SHA512
9f22f70b5de4078fcbfdbb186d6cf220561200092eb7ceaaad9d44a5281f84abfb1729f4e447dab3753225d5fc6c44d94363e3729e5765dd2213213c327c4c1b

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-private-l1-1-0.dll

Filesize
69KB

MD5
4b27cf5cdb20aebf113df752019ffca3

SHA1
b02c6e45f704dac118f81c324122c189e3e61e17

SHA256
c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac

SHA512
cd4df2478d719e159e2252e6784d24e4260c13d8f47774ac33a8e10b1fa96d38236bf2c3ebc060a5801fc19392cbe5c636befa898721bf114956c2be6476bbd1

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
fa677cfb18ba1370d8bb98681c48cfbd

SHA1
cbccd561bf53c59254fb04ab136996b81cc80d3a

SHA256
36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8

SHA512
9312acd4955d4950d851910198d4ee622b75e11262e409c79391078d12d2d0db320723a1552048acc0e9deb30378e3cd27d4fabcf2077d429eedfb275cdb73e3

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
595a997bd415c8ae0ef1e3c3b73e6091

SHA1
10f34bc2f474a43bfaac26f66ec8081106c12253

SHA256
11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f

SHA512
944f6bc405c69d6bf6dc97652e9f296658bd3de078dda50ac680e56818c00dfee909b100fc2fa9c6a891c55dbc66dd62ac52819950732c83198dbb8c04f3c9b8

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
415d765aa267382a79e56e428c80b1e1

SHA1
1bf13460b8aaac1538bf45186a1624825bb8c355

SHA256
cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15

SHA512
7236ef7b2937718409ef4eeda20318b1697e7c1c868d0df263f4be8673365d48ff6ffa2317bfd1881b6cb3dd1300410ad4f715b8e01ed321c4011aac88490d21

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
5bd5a9001cb0555c5b2b14e0cbc8d922

SHA1
4562d23fba312fe95cbc777fd7c2e37ca1e76ad9

SHA256
b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7

SHA512
a6271f28f069a00c2912f80552bd54bf0d8461886adff626b336d25943dd0ade19eb88c718602017a1986317af3eb5f94f8896e88b9367207e8b53225322cb84

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
f719ad4c04043f55a21e73805997b287

SHA1
0e88b1271b242f7933e78edcb05131612cea061e

SHA256
a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983

SHA512
752b9b4385162126729c3f09b3b75d7121c8dec00cce11f7cf1ecaffed3e79addcbcfe8bdd4e20e15b8494bfe2d24c3f2d11583860b1e03be021196bc83fc3bf

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
a405399d5b958a03e6054307a631553a

SHA1
dba43f0afd8c6e1f61cf0be7503c6f70b48b8240

SHA256
d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd

SHA512
33c64766053058fa9fa4fe689f1ca5a345b8b70443995d71aa65b64c7bb38d4dc3a2b37ad06a4ce5ca1c927ed9ea4377443eaaecc69b0e758ff265e755194287

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\concrt140.dll

Filesize
310KB

MD5
67a3ad0fec3eb767e423e3d7a9134343

SHA1
42949506bc8451031425840df33f3acab5637b52

SHA256
01729ff33c2e3db1033fb86e899d62026dc1c03705269bb9636227f61934d9b3

SHA512
f3b13d38f44acf37c5002f08b684cb2955b778c8a703c8fca6e07eecaac45e1bf4bb036dda055114152390322351ef936492abbf6532d1a48fcfd29304b4db1b

Download Submit
C:\LDPlayer\LDPlayer9\vbox64\crashreport.dll

Filesize
51KB

MD5
8a2ef730063317fcecc510063c11c28e

SHA1
6992058fa89a2c6ed41ec02afeab0dc9c7d96a51

SHA256
f404f48b5d8223571b4697ababf7da60404ed5fec958bff698d7cffaa6a4fff9

SHA512
c88035598f187125139b93756e5f4324ed253494d63262c9a153a0f4a450a1aff9ccf594e7c82fe6245bac3c055b3c60d84eaa0f5a70d11ef974ad8752686771

Download Submit
C:\LDPlayer\LDPlayer9\vms\config\leidian0.config

Filesize
641B

MD5
f79baca2db92e8a3ae44c29e4c5320c9

SHA1
1f0b7df4a1bf849431d720cd96cee512eb2168a2

SHA256
fb8280faa1f64b0d33d3de6e9d765758d975c3e391772801fbfddefcb324aceb

SHA512
c43ef80840cd69aef8241c4768e7aeb0a704efe815bc7a72020ead954335bb8569e752b7c01ae22ae52706cde07157f185a434f565b850d3cb238142d7a9dab3

Download Submit
C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk

Filesize
35.1MB

MD5
4d592fd525e977bf3d832cdb1482faa0

SHA1
131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef

SHA256
f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6

SHA512
afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77

Download Submit
C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf

Filesize
103KB

MD5
4acd5f0e312730f1d8b8805f3699c184

SHA1
67c957e102bf2b2a86c5708257bc32f91c006739

SHA256
72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5

SHA512
9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\772D055D5E4421B179898A4E6FBD9ACC

Filesize
471B

MD5
cf2e0722747b50ce215fc3dadec4e003

SHA1
05647ada04495a03f1d25ec341e20495093e42b0

SHA256
f358a88588f82db7dca9b43aee2e3d20e211d780b9eca8497ae617eb8cbb705c

SHA512
5a229b6ef40c6d523d6fdb0dd83c706f946b2e40c8633f8e78255dcb255f4de8a38b0c3eec8223b291354be43a0ddf78fa6e2255ebae3869076e7bb6eedf6269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D

Filesize
471B

MD5
252533cdae77757b002911f524cd79df

SHA1
a093915fcbc25cd84bf9df16dc94635f3be2c453

SHA256
0e6a34e423ab3ff7113ec77ff0505f306faa9932d08cd3eeb4237a9944325111

SHA512
e208ede4ca54b7ec1cfbfdf43cb681b2364a42bcd8b64264fe7769d5fcfd7700c969b5064784ed1b6264ded42da5f60ba7bc7a7ea9c60d9e7b227c15b4e1e8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
352ce149bc86e2c54100335e660aef07

SHA1
d4382d13b0b68b69f5b0bd3ceeded3560f62f05c

SHA256
026c44aa0d689092858d327fa8901dd62723994d5630173a511882191f23c8fd

SHA512
f3a0c45c120891a1f6e46501edfc86f5ccff4536a42c5628415ca2f7bb8937d3495fc5c98378b2e3735f1d79a3deb9479c48c32e48eab7e8999a362239d5a1a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\772D055D5E4421B179898A4E6FBD9ACC

Filesize
400B

MD5
6d6fe2ea4ab1aea764a3bbe9bda76c30

SHA1
9b72a706e01633638cd80246dee4f05ddccf8790

SHA256
b538cf9a743ff0618c0aab387d26510e86f086d27b02117315ee7caf99c05909

SHA512
8a092cfb948e234e9908c90fc4b38ca574582f4a3c0fd432f324877c868bbab0e17d1691ee7cddacb2462fa958d19d62a6b4b1a463d2275087dc39ea2d18709e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
480f23aafb38b828a627a640cf6ed9c6

SHA1
c46b83638a0a8a76ef82b07823ed74fcc885d0ef

SHA256
d6ddbe1826e5a72bd9b17f47f7e84b29d1c88c433222c42ee090aa6dd19259df

SHA512
86c55ee2ee1443fb381579427c25a6d55c649530f595b082c6e4ab2b6b6de6067c6c013b453bd11e88e9a96f8a1ced3eb192af5e27a51513da77fd0cf66d9535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2b090e27ea6827b58a57fb7abafe666

SHA1
a01742e57384de4b8517f5304c8f4de47587693f

SHA256
6d0d86f8caf95876643c00b3dcf3d88e191993f9b4f5c7e5a210d0c938ad7978

SHA512
d5daebffce408c5b696ca53a5643bdf5903ac68bfe632ee9d0511513b8959132324ec3beb358b9862bcc417da30776aab050c32c716c92c9f2dce3c0cfbd3e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69ae32b4694dd03c85cf65cce7e6f91c

SHA1
ad7bf7d48348fc4f20cd22fea31797a99683813e

SHA256
2573ad209a61b97e588d11640b339146809f53c29c1e005651beb9f029a45664

SHA512
0b540351b764349383b6aac94e578717bfcd491db83f0c4e063548adaba9564fd7577fb0a1a83481b51b4687d3ea754b4d97befe9920648a062808ff164d5135

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d0621879a4f16baeeb709b179870792

SHA1
8c435f7cd68bb044c5865e149f860f28e25abe59

SHA256
dff4f5d05c747f7d0d8540503a4929417f7ca66c244096aa9bd7a739f8c10add

SHA512
bed4a99262b952e0595b8a7c919df4750640b53493b28be6432bc93767388dcfdcd2e8d61165e8b7ae168b5fce68dc2f81795823f84a37211c59fefd473b88d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5de9f6787dfc17f8f99f9233fc268b8f

SHA1
0f993f60cf57b65d35c96ac95a2d884cdb55779c

SHA256
434dfc1291f7f22d3952f97c79a5aea5c48b7ae13585c17b66f7b854c8614dea

SHA512
6ed954f539297e5d9bfa99c40b156b207ed001b7314e0b5df21f10526cede40c026c7f8e387ad7bdc071136387a0e6903ed69c561be2af9750e4980438907b58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b06e446936385b91e8b33f2686779d4

SHA1
78c2721821eb5e31549b5a7e976daa5955cffb81

SHA256
eb4cc4890cba10d19e2217841122c737c19f197988a71ccbe8987313d9d769f9

SHA512
8385be1de8f16b9bde4ae257b8b91f9e8a1641f0d9bfe6397d2d4afe986ac797c3663b0734eade6a6377f6a0a2f5958e1f6dd9805bd18dcb39bc7790bcaa7ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c059e53737a5db530fbd5350f695ddc8

SHA1
71444f876f2dc52850da77389c30f06baeaee492

SHA256
01d255f4097e6ee3f1a7fcbf2598e9a1061c7f46f997b8b3d94e97514611853d

SHA512
c153e831401bb29035f068c7aa209c9a29210c2f5f5f02dbed822646cfe934d1bf0ca02dc50d06e6d9333784d11dc1925b7b5ae13199d281b2c19b3b391c65d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0e28f4ae9c757e703101062c4278c95

SHA1
a1b9ff6dcfb7b0867fae7284ca5c40385429c316

SHA256
e14553a5305def2566aaae50cc9e2aa16d5455b00846318d37a936152301bd2a

SHA512
277fc22874a6009ffcccb5d33e01190c8c8d017008c78b479db99cfe64aa48893ef408efc90a8e17bbc920dfdc08f6b978a392708a59961777b38468f8f9dd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3b7873a1fe63c6fa2ff2eeec14bc519

SHA1
021d5f447cb1f2b340408b5acbacb8f8a7c03d44

SHA256
37e170d9e387cc99f38a096aa2e5695c2661710e44bf5f02918f0736ca8e75ec

SHA512
9135350d2267eef95e560e260dad298b5fb8168838b8f10c9a976cb55cdf6fcee554ebfc771391e73da6254f6b00b24c218d15369d763dfe991069fc02e34403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ef8b9a02f07340f9afd8b722ada5483

SHA1
e8218beb37c79c08ecfe0d082af2a12070723e5b

SHA256
306ca1a6815cf7c79c14c45414f3bb44b8889524c6d9c5a1e3da3f56d93e75e1

SHA512
0dc5479327252d56e2cae4d7bca0f38008ab980a019e28a7e55b01cc501be11289891758cb56499d0b82c129c03198de60de398425b72bbfaa91ca985cac597e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22bd1379c03bc659e700731533bd7d16

SHA1
73c7f4c3d93813729d9c73ea5e45af51ae92b3bc

SHA256
0dc87e8c05496477805bbde67d5c5034b772a6ddaad61532267135fe074645de

SHA512
62a27c2cbd0329b4c26b998a084694513530eead45baeef4d36eb1773fbf3be57811ceec948b74321f5cb6602f1dd09c25a34e1d924c446164c17c86a7799b4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aba5a002d4cf6731bdfcea09f3691179

SHA1
2cf4e0f43d13ce4a153702e6b44e84f77d6268b5

SHA256
67d0dfcd63e8e9d3c18d6c8e51fe2c1efda45c625d05c69909ddac70eb5074a2

SHA512
7c9f1c83e0f1355e67649138665d6472bc26bbfddb42b2a9e2353a06fd6f3f69dfe13f39e747b581fe73d2a17da6f682287294d63ed4111af1f4ac3aef570685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2be4add185e725116b30175d672e407b

SHA1
80abd18c6b6d24f218ee0ed43b639b825a69e983

SHA256
75a239457d17d77828db2541968829a4487857829069989f2c1a17537b5976c0

SHA512
22d46480ab8dc334ecef01d21367352baa4dffefd5ff49868a6eee8d47a33bb64f79d2368a938d0adddaa7960159799a1e2d09ca1193b12fd36864fd58fe4d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da7b157c2a2740ee979ff3b1b659c203

SHA1
4d558da8a56fdfeed7fa11ad8e249793d6f3c3b9

SHA256
48ced4c53505f69ecd49a348fa266ceb38023fc4f21b2a0c50020cd2c7b175ae

SHA512
f3c77f555b3b35761cedd6cca95e941f266d0bf6f275179f8169f72666526e4368cc1700bf44de13d62add60b505e7ae1179423489fb541e75b2b38c4edc04ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90a4f8d2e44fc9c3bcba82aa89a70872

SHA1
32f624d253dff613f753b6e431967fb32537fa0c

SHA256
4f916a86e91b010e295d077297617930453c98cbc1b620cf6e0aee526b34748c

SHA512
0bba1a3a4fc99bdc8b51d251c1f77b5acc715ea9bdb788c479be70eddca2c62db9d8b1b5fba7a3e68c805a21462967c61be8230bc91fdd3ec85dcc8f0946d583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab8914e45b69333b9c0c9d188f13d760

SHA1
c181a478e94abb3aaa4399d3a8e8f2ebc0176a01

SHA256
7d8bdd6a29da5214bd331c57504db4a25a4eb4faefa5af9add169151fea47678

SHA512
b750bf09a7543af147dbe942c85555a5828c03ae70256fbb8b945e9930fa0a0e6112245da939a77cee21e9f9650a88c96031d8e59dc092bb8a38ba51e95d4de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de46cbc6129db59e6ddbf9a2f70ce759

SHA1
cc5f4b1a6338693b84db640631ca65b91a2f70a9

SHA256
e89a029aa0324dd045a7b607effe0055d09e985f6ec8dfb89c95f7494a16ad5e

SHA512
d6430b5071c4504696982a1332afc17f4324f8facd73d7604678a63996dc0afaaba550afa5952d6546a72e209cf17abe79b18136911d185aa802f60485d5b7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68ddad87aa9d09162383ae9cf2ea146f

SHA1
289d88d19e82ae5dff783a06e18940547efaf6e9

SHA256
31c69b4b6ffeba642ec82f5d21da7a8a083e21014a963848c3f567e223ea332d

SHA512
9f6789f25e7b5950285e62f57500e4967dd9b9139a7bdec62bc79e1a00167913d06a3042e5303292f91bb8c93d1560fdb50b69b9478dbe001aaae2e016ff5fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8859ab4e5fa77ad6fc5a3b0e0e768e5

SHA1
9a34a3b6cc85ddce097def8e10f1d9a954eea0ae

SHA256
4d709b3c47a3722baf7d9510b88c37b2df20e06480a75f14e1e12b75fc2de594

SHA512
8e316659069180a32374c203a7feb8d5e3e27225fad0b914f7dc0cd39d8c64586cb582d1c5103f25f6417090659d0dd8b16d7363a1e0dd02bb9c820455ece77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b6795ed7d95efb6744090714b3ecd3d

SHA1
899643d39ac5d717fcedf2fd3d30d41af9458ffb

SHA256
7f7c19cf07221238ae9a85a31bb0865baa705e1e0e218f5a1197acf3e5b1829a

SHA512
c68bc77424ec868364863b24af9840b8a06cb9998926b1e5cc9cdf038ff1a5618cd471adbe6fa6c93d8e1d6b1983a56cc4326ff98623b075ea6394e4061c96b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06eb87fdd5c370d21b2b700df112ef0e

SHA1
b3b1049c0d8e7d336405a3783fe784792d64888b

SHA256
f57b0f570beadbd8be6141f38d5627feba64e100afa48ce48db923de13c2e987

SHA512
c1aa387d759695bbb7b2fa3bb9ae6a1dc0c4689cd0484504a6c4a057c9f7f1b5eb17d678942ca791e742dd5bff4c75b9c16911ce3218b26936cb965c0d8a4bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bd03ed28d64469fb06a4c1440ee1269

SHA1
9dabdf33420cc0e0f6390e3e2b2c42583f28af77

SHA256
05909a9e3328510cf15086d20fe39d5e62013339ce25271c0c51711f53375204

SHA512
c50f8c5122f501f0a5200cfe44330cdbf921f4704035c7aa44aa58c6307ee72876fb26a59393f1b25d3d01f477ab1e247287fe020c1d1abbb6c4cc9c3062ac4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e152708f1d5286a9b1faa3e3ad683398

SHA1
f8b11dcc268f55b92f3656fe05024d75da12d37b

SHA256
247c0519555535335bb91a11aa7b0c6ed3f2cd4637534c7ed37dacc7ac549e3f

SHA512
f7783560fbbda1270868a62016bb9cdc5f52453cc5645a9745b66a077f32f39791614acd65652f7379af0908688670353a06a4c71926aaf05d6ff70f4866bdd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832e122f0f1f061b99b51de4763e7e8d

SHA1
2721bd786d419fc21b0d913ca89eef413a565c42

SHA256
b22d3981c81993bc178b60f38df821c7e917de8facc2688ad840574261a38282

SHA512
f63a9e419d53b0f8e248eace3a19aae5f8584335a9e31355e40da92e6361fcefdc0951df8530b2344255628e8a37e8b5146fa70d8c0fc566bbc90ba0794d7c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ded2b71780919690bc7f277a9dcfc74

SHA1
89cc861e4dff32f69fef0c118db761fbdf9fd1b8

SHA256
1f28b54a697f54c6f14289664ffbcedac0635f7a1b8ee64f4c1ced7f51ef6a66

SHA512
46ee3bcfb202d9adff9c46e46a427e6b4a5f66b70dcdedeee5f6686682ef62725c7f9f9e74f830c5c40f3cfe01b6455606a8a748708550b07d525fe474ca175e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db4adcf39bedbd761709465bab733592

SHA1
5d16b3b90a4a92d08d0a7840ff158f87047a176b

SHA256
ae42210fca0c8181dbd837d80daa97df2e03e457537ff55efa1007ab2a416462

SHA512
e036ef3ed50ff2702720f04f9f148afeceaf4f4634b95ef053685dc7a248c2d606787225098a49121808442863359db0696c0ec755e4bfcd5c912c8411165e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a40de8f45552bf550aa82fc7e572d38a

SHA1
970368d38fa37eb00a741b7d47688004ebbbfabf

SHA256
8862718c0cf02bd313c0005373b33052e59f695c7c21ff7c9e23a5ea384451af

SHA512
6466d87b2f67ffb2f4fcb9dc1244952c6b4846887c8ea38253a2a7f9387e90d2b1c6edc79df0f728f1f88e34a4eeb34a9f24ffa2992c3c9b4f8e13c321cf5f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a37a116db102e895482cb77ffa171dea

SHA1
e200be603e2f3250a8f8c2b7f6cac8e964d969de

SHA256
4846cd36970513aeaff412982c94fb3fea8c261e9475a5ef51128b95cd841ccf

SHA512
e8587fa60812b46e20d49cb10f4cb95a8d533d1907630fda05b46ac393edef993358c3f5cd8fbb513786bcff6721f134e5916f57ac1b54d73d277db8066fab16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e8e964f037e203cff7583c18b76b283

SHA1
b1dcd47cb8f5ae1a8fc46bbad7e375272816043b

SHA256
45e8d6456f6a5b3015fbf3dc71a05eb2542a04a6beb1112706e4961289fe403c

SHA512
3c4429d7510698404208529333ab17b03c2b5d63a03de7cfabe7f8e5aae39dbdd98bf7f731fa5a7bb17953e21ce36b98160f65001df6b36a299e72b246994aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4428b2e66fad4f9236763588b994405

SHA1
204a4537ae2cd714d494dd14a888cba479b13a32

SHA256
f5ea3dbb7bd2c2a4224f118c406331b1090b7c89446d90e4de50325ac76d4797

SHA512
bf5f7924812081a5d31cf0abb948f59a24fa97cb41a05f61bc6753f399d82c1ae71ae1264c8d72c846ccd098af1c22b13b8edb781375f728647893f4519422b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d25ce608f2a89e65a8ca2c2e13bec0f8

SHA1
cf7757d262969f5d869aec207da550fdeefc0011

SHA256
b89fa5b809ad26c4fc1f2501dc06a0c53b69e1d55ad9303b3518993e7309e731

SHA512
7b3227c15efe016fa27b3e1d3c8534b0081af19a30eee2d88c42732199dbeb7e389645522ea281e69d688c3f6ad79c8fed7cac13fc905d70b0beea70106f2f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c6ce92e8df04808b35f154519f810e7

SHA1
234159871ac1596f5a6e7e898939b2159f0a458c

SHA256
2cee42d21290693263962feb8343b2eac19f6d062d9f4c770366c9359b923039

SHA512
733d6e01d9d42827786fb4471cffe5b2aabfe3cebf749210a6e229e67aee3b3c3d58cb2493f8d812679b1b30b28e2df5f8eacf0440987589064fe07bb1c1c471

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63da545fcfc28eb609c4e224bd47e7f3

SHA1
fba892420ceed73477c92124a1ed7f063a8277ac

SHA256
5381cdd9486b2924de6d6f99756cfc0ceeaf9980a9d565e319c7b0163a7793ce

SHA512
4a4cbceb8ff539fcdb96652dc5a352b6b515c602e7815c21a1c673d5572baeafa96b140c0605c425470b8c9622fc1d116843fb8456c680aa068174dbee3d953c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20175d5d5f22f3be9f1379b0cc66d490

SHA1
b2d69d3897445158aff6dc1f5d8552d101b0b0f1

SHA256
814b69d4684c77f1bf9b08757440603e9f66212207ef43fa10c61c8a7f32ec17

SHA512
e06840fe807d4c84af42d53ba51dc2ac466a1278803e1ed7e6bf681cb53429b6462b24e58e91bbc83f90997ca248e7cf1d15af02bd60536d714bc84499a1aba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ebbcebd8a4c4bde1de4b94805dd6921

SHA1
176bc613e7a4b3c04be4ccfeb9f3a80667c59646

SHA256
61ac7510e80efe4d8f2a570b213323304df1d7cb6a44effd5afadad16753599e

SHA512
10a84c03ee04352fafe7f7c422eac3b4c87e3fd20ec77d4cddd0e4841ecf45f3e900f0a63105cb381c3603595357db2568aa919f7bb26ba270d9b202535c6cce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7be1d3870370bfbd8ba179fa6f22d91b

SHA1
9ad2611851103f00cc9e51333549bc2444b09f18

SHA256
39599b406fc279d8eb1dd2c1176f692ea4d64946cfa23b3c51ffa005e86ace7b

SHA512
e5a6b11b884541f561d2fc741873a8796fe9881e28b84ff883c8369ed92c93f756e7978c56de98127f3c01bc3a49dccc7dfa2636ecbebf512d5734ca9cb90423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec2201cae30a8cef790604e217b35a27

SHA1
9320a23f716cfcb8fbcf7c8ac699859bfbf08ba9

SHA256
4cd94ddb4d5e8b00f731f969885e6bea2e25189cd971768b490ad0402defc290

SHA512
8acf8ed293fc3e9a323b55449fb2afff8ae4922a1bc110ca584ab5ced0feeb3a2aee5a7a4b8d4dec8dc5aa2b5aac8b4255d3277bdb63ef1029b88bce30cd0c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d09af791a436113713b8501d8c3acad9

SHA1
5c2146b38f0d972fff4a56e26614d6446623c398

SHA256
370e0d458f08cd615767e1b823b96b08a096e3dcfe9bd24c246e9caf10476954

SHA512
7212498b5c43a2fe575d712bb817f5d1f8c3d46faff9966b25b9a9f9afd936498e45994727386081c4448273fc6f26a0f2832bdec98ef4ec8018b2d92435e9be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78717ac616dafdb9ac9496a325fbb848

SHA1
b11a886839407504ca52063c183ecb7ae1c29ca7

SHA256
14571692d5e3641152bb0357bfec2c8c87db071d3a8fb363de6d22993dda489d

SHA512
80d60ded0a2f9eee6e881fb50b57b47846d8e292312093852b6ecebb598c902c1604fdfe095c8ece418b5656c7df3ea6362eb1286685bd84068b55eb40fd0c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
228568f6cc159e9157dc14e19161f944

SHA1
4008e2cfa0c715647294c2c7f0180a9e71fcb653

SHA256
d7756d70a539605fc1ad1c839da3fa82a3ba0961d0ba5d9a9768f011f935eebd

SHA512
377fa93c7e3b2cd17d729c3e5e1cf322b4258f816d8a59d4cf6e1a254db58851155af10938191b9c2ff749c149b1d91a26057cfa3168797552a09a7614472523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6da4e77d0aa8d04432a90b93d544142d

SHA1
0c533a72b25ec4bb315d738148082c26228b44b1

SHA256
407411a34ac431ff1eb9feeb6d191137433e48a4f42278419b38c560f0de1360

SHA512
386c6414e1da31b72b2b2397659c71f9c8f331c7559143137f7f88ba8db148b14da3f94981c6cf3d524c334ea795e90836ebe77c22b931f791c601fe0d12091c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
503d29ecae4ae7750836f0a4db24aba8

SHA1
32a5b45b67ad5976b8ee4df9fcb946162a4e3f60

SHA256
ba1aec71051d48e59b45784d12f24c85e66963a4bc32bb1947757becfb893770

SHA512
ec1b8e971418a8faec26366b4be251c7b5e19fd4c1d22c03f8bde3fd52decc2b8ed587f88c167a154721ca221b7dc7f6846813611e34860e55d99aa151a4b785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee226807979784ea696596f443ee8bee

SHA1
fef39d44d159c83e864152ddad7d1c8e0ce839e9

SHA256
69b4d8ed7cf6f78f6d7f69f8d6c2a6b1559c910df124654bdf411a99153deb49

SHA512
22fffe5db94dd3145570657367ecd5203f5f9b95b696c26bb4edfe0431c564b88e4d2653bfe25afbfc4ea334030d5e73f15587073d060196aa83989eda90f0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b29cad8a12383b82184464b103b9436

SHA1
886f853d62faed1ac1d66bab0c86286b14d97c41

SHA256
da3dc462fe25af80f4a2094ed70acf26d8b171646cf01e29f6d9577049e99d14

SHA512
e6df25bfbc838d8ac7d0cf4968b61b0122bab31b5aaf3c94e7d348ec882fe289fd3914dc56f680be1082bc77db29650077c07a2767e0aa1f55eec9ca1cdb85a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d0ad10cc3fe022387fa7774b73bb33c

SHA1
42b7cec6c04b14d8d421c0a526d6af5980b5f678

SHA256
fdad5d7eaca0b3d3c35980b434f83e1c4f114c15be5cf9428bf64d557f503d1e

SHA512
e42f1b885bcf72b010cb28aaf07ca31204b9f88196acb723c8903c41eb8f628bf6637f959171f0bf4dbe6c666247e3eca336b8ced8cc0fc50699e23375b817b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19721c0a27793bd425c9d2e31647c840

SHA1
2450d5fb7698649fea55a13957c5251f8af5b504

SHA256
692f6a88580431bd792559345d4f08f57c04ee04bf66e6378023116f17c16cf6

SHA512
880e43ee523dea80df2cd216258c55c0eb45e932abec655bdd8d1e25d834fe957c9adb348d0e2e5f7b6863c75cd053a22279db03b0efeff6c292f4b93c1c55a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53e7f41eb798cdd43bd5184ffad8672e

SHA1
ca109bb3f65e81198bc8c569da34e436088f2603

SHA256
9d6bd1f30f5b03ca8afe8ec424833d36c62fa5c66934500044ddb4b0d9816fb4

SHA512
9cbf4e0fe685b4bac485a1121d3a23e93cab1ef524e2a9c970c03a7d717fdf6fd2fcf2784db77a3128baec2c614ae1af6e60287f921b82d3af93029a9ffd8436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29b69658f659d47178f2132f949d54ee

SHA1
9c9393cd34d426b6f5e34f0bf3cfe9f3e8e48c6a

SHA256
7c9d6c4f82154ef5f081fe926b0db33a76194569dd2a30d9b3869911b4bf2099

SHA512
1405b70de0baa06afe6917d0db752dc922df347ac9358ce986e4b03dd23ad7d19ac496acdaf561f62e8f28b01835c6ceeda4e2477d86f65968ab425509d12138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdf67ea5c6ba40aeb7818bfc2e990584

SHA1
bb25671cfd06302527915555dea0d02ac0dd8b57

SHA256
37429bd33c34e7f9118e5eb06efeb36918a3b794ab26800d3bbb26d8527c3d92

SHA512
ea46cefdc65fcc2513f71d4bb8a6dbb346325cadd432c438f6d3beadf1a23001e71e7ab69ba16a8e5103c56b0dcc48cb2f3a77e4252ff95827d178ef6e16e0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc6db2578374b2868bc089c430122385

SHA1
3df978b23805836989e99bd3c405600a4c7f95e5

SHA256
1c5a34e6044fbc29505224d7178e4dd015652c6cd6f2e9ab311af53a73aee73f

SHA512
e49307ffbc2488aa5a94411020947ce15dc7a12c4c765cd22988a7d972c678ada70f1d712e7ab8666ad6bbe5126996ac5acf8c868d394bff69c01d22a9ba8ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d7e716c3a337e7dd38d08cf8e09a09b

SHA1
248f5adc49aa9cd68eddaf5956147648fc35c0c4

SHA256
b535d8584f2787ba9f9bdc62d00c51e391bd758b9401c65f93d95ebdcfe4dbe9

SHA512
28a6d38b368dbb899729bcb2a81b78e8d2579580df5fc5b84a8f7e6f59d286048c20e290c2df50c95967961eb1268b5ec2682c499f6a4021fc6634069cc67a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac752d23cebf4394abbede8d68951d9e

SHA1
2e6b5aea1fe257625011e470a656e07b4d07738d

SHA256
3e9feecd215c35917b443e61c19dec519eb84394b6eb7e67a94781005e51128b

SHA512
0a543a38548690181aeea752e13c25e9aaa7539274c73196089b53b4cb61c4c20801b04d3bfd914e1f164bd1c08a4ee2b9618a61f437f996549cd58f991f0c9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0879217e242bd1715d9bd08d5d2b5d49

SHA1
beccd63f62ca9f60797bc59ce158d687c0b5f105

SHA256
446830281589822d3131b5bd1882d0dd0a84ebb03b2bac4384ffd49bccc3b4d7

SHA512
c757bed3ba4debef03fa51a58a2e6de7788a2ce1ac41bb6c57b19192e5180043100ec1d41cef73d6557798c60dd49c867e222d39931669665e6e685323410165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7fb4288d39bdeacbbf7a794d833895a

SHA1
4729f276ffa92bf18e2cfd6bc40f589d61508228

SHA256
df7d99049b4cb384380bf722f46aaf9593252efa007a3e52f7ded6c0fa25a761

SHA512
9e0e8ab78ee94d64fc34120eeade0218b99c994cdaae86c2ba709f592f8f21861af87260c5bff0c860bf7c67bfd457c8993e4f5ec478226d5e883cad2dfa1f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c8d2136b0e570052e09ac8fb52f80be

SHA1
a58ffe22fdfb0edf5bd03f3e2d22bff74cab281a

SHA256
5f4a0d4748e82d7e7ec2fade72d25c360f50b5fda61b8133a84a92ccd85686f0

SHA512
dbad059ca092e2361459d0191da457259a29fbef77503bb31c23fe9545f0562ce5286ddcfe3e90cb5d08ceaa1f1d2c71c7f1191255636fc18ade609511040bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae773e350b9e6358219ca75609a652d3

SHA1
70d1cb74a801cc1e738557c24d56ee8a36d2009f

SHA256
d41a2b824fba6e5a88e91509df0bf2f5e6fbf936d869c198bf2818b651b47afd

SHA512
0f02760ecfc78ae561a343007c64f4493af2bc62da0aad77e9c469a342688a709b047df55cefc0516d0d650f7281350c0c24b20ce13d709e5dafded4e8e61f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c2418d1c42b5a76b93dc405d55fcf36

SHA1
b9f5f73d405ddf5c30291ebb6287edaff672ec92

SHA256
cd0c647c8e9f85d64799465d82393d7db0e2b1209a3d40d0c76caadd55cd9bc8

SHA512
dbe0b250860e0b0703f606a4700eb50bcd0b03d322a0ab6effe121dfa9025a9ed15c26412627cc16776cab2dba94d069da149aa4dfb786d6d9778984add2898b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7972d7e36d7ebeeac51570c647f7b961

SHA1
b3eff17fd75293e680c2eb74aaed7eae6acb717c

SHA256
a085e667c47956ec7cf396ea7a956c820bbca6bd4155ed539c322f64df95ee0f

SHA512
58e1c13dfbbad0d2def0ad414010510be4fbfbcf63818f65a19bb30d5aa426d72288e597dfa77ece45c13fa660698207b62bdb3f490d608301c90353261ec1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b62ad600b0c320f06ae37550d7b19de3

SHA1
66e482e78a1e93393e1dfa0372d15b0ec5940967

SHA256
a209717d7ceb004d4f0c206254e8e188d17ba368fb6eae2d93b8488ceaadbfa3

SHA512
283e3397c2b69ca2c89525c7e3edf4008f22542d79ba38b472e4827c6e48182f013488d73bb6060f626b5cdb63807827a246a72d4840c199f6a89ecd20062745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3072a3b597c5cb612f83a7f2a0174fe3

SHA1
b7ec9c3169c56e8b392212d5e8f6261e753d3da0

SHA256
07c36fdf49e9f43c2de317cb4009dede7ab7f23a51636f4daffd7da1cb14c1e7

SHA512
354b1dfb4a7e0cfd908302a9bb68394197fcdcd8c60241a9f466c528ae14017be711eb90642342082cc79176255cdd9ca972f9375e703edd46ab58c8383c5b69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
576c0637942768ce6be89112affc8c08

SHA1
e13d2ebd502dec8e0f2ffbf67f94b211b993bf33

SHA256
72858728c8cec39e47a9329a0bfadd38adc84cb53324d38caf978c148f800bac

SHA512
42daccc7f9ecf5f4afd94a0bb77f656f3a9397f422c7aaee286fbd89f84c497f340a1e6930d035b9d044bccc6a7e1c12a626af4f81a6a4a2d65b6e1820acf5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f14744270ce01b156917482af138f69c

SHA1
92209df58a2fafe5f551221d0d9ebed0bca71b52

SHA256
c40fd3f4f81ec6b548c0468e79d42dc5000482c4af632d845ac68ede8dd3f03d

SHA512
b9537c81c486b157772270909100a6e7ed119526848c40ce3418615c6c4522dc08e71c965ff327544f99af6c5ce47bc3990737cbb388f75f9d44f408b74e5d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6547633e652eaa29f57a1ecfbebbe767

SHA1
0a70d9f234c0a9281102238b2953728ff84a1a98

SHA256
f91b2782a928069759d11c4df44940e820b3ba4a1317a97c1f88f8129a396136

SHA512
67a442b39533b2519172224d381febd7adf6fd303a6d756dd1849f2169a1019a6606f41ee7de9b356fa9deb04be232565eac0b2dc7ff9a3ff4843b6ba2ab43af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c3f88c3404128bba7b0173232e908e4

SHA1
be3b0a503b6643d37f7bb4ff487dfdc8f90f1abe

SHA256
f3db20aa978059b6f8b296f206c0fa5575fb7d3911e88ea357f3aac16133f077

SHA512
9d91a3ab9755e3fd76941a17ef1dad0b1ad68bee2f5e0765b97d1e7754e7adca1f079b75d36b77f203a9eb763d81b9c3f259c972ab8a665443ea9ccf7dae22de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e9e07ad8bcae1601979312047a0e20d

SHA1
4065ac7967385895184c307efd88345f51e73e92

SHA256
c8de64246b015a6a1f213c96a9120e3699e3bd1036b585a1279c5479f8705a3b

SHA512
2abc811cb4b052f17504fd94e4ce8655698aea62ef8d370e991482e5e85fc17b6ebf3230a41633a71d8b54c3fc75efda49ee13ff7d27185de44b81134f991479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f78e3cfc4abb8d821c75616389e2629

SHA1
67442e78182a0259849728fe2f0b890b49faefaa

SHA256
9b7840fe75525268bf39227eae1fbf94cd343552b651ef601da516cb682df962

SHA512
ba3aaa872080c8126882dca3e85928391b8b7c088ab5245599c117f4baa9b46f11d5eece156d186e97228008ac385d8cc044fc14fcc76ed862da9213689a85e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d893483ff8bce2b3231a2a9c7fdfec0c

SHA1
a59a952209ba38718bcec4de2888ff59110a127f

SHA256
42b49ca34f8e70cca879190d8685d5c78bf83eff00c6122790b60368a20aa10a

SHA512
cad3b32b5663513ecc412ac1c7cb118bfb4afa4eb20b7acf4bfc1f3663b8392c10f0adb6971c7d3069d8a9735d8865bcdf7565d984970d127c7a2873cf07c3a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461ccbd55a32e31ab72bb6811b080948

SHA1
1f5e866a6400d8f5ec3ebcecde6a6b9cea768b20

SHA256
fb9634b608330c9026abcb82c7efd21f6f2fd507c10db34a810b29586f2d8e9d

SHA512
f816b1e95d475bf6538b125f215b6622238c67f745021ee77d1bcdba6e87f50be5c30b9553f3863ed54efc21ff2b0aff3170d7c6d5ff52e7d5d47fa4eb9a34f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12db89a7660594e71738417e9304f9de

SHA1
1087f6d16b8495b2bb8ebd693a99dc8c3d97feaf

SHA256
8c0a0580271e07913fa01041461d9cfbdaa39af0c1cc8533bde018c1ddc0aaec

SHA512
385b6fcf554cbcde07f501617f8c41dad1581d7c0726be86df095887f47c2ebc9185ffcbfeae22be595e911019423188e33fc1814dc22e66b33bc0519154af78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86e46789c44c74389d365997c87f2d33

SHA1
7c19a6342a30baf9aab8b3c237f03dc48b7ac965

SHA256
fa26ef12e1afe3016a38ca1be453a470c3d2c9d027c3aa9b2eadf71746973d32

SHA512
b632408a4d7ee1374a31011892f75142efac05065b7190c4199fb3591c729131c95eb14cd4a9cd40e06f70977e3152377902796050fa4b5cbcb6eaba173e11aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7b1238aa5b07f20f77ab2ca750af560

SHA1
ea9bcd46c0d268a32f574ff11c3b2819d433f1c1

SHA256
de7673f982c7a22405f84539240bead1f0201bc91a30df5796858713d71715ba

SHA512
ab793e1f917913822bcad2d3931722d72935ed61d1dbf47f770b93db8527bdb3ba31f13bce0d93699edb888344d391fea02204b5a7ced7009b978f6c108fb4d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fb3f60b299e92c5635f5dbf9918d074

SHA1
f9ad8ada00b56135f0473a5bfda24113fa51daa7

SHA256
915dc1ecd123e22b35280caa3eaaa021f7af8d8136f9afaa9ba87e9420b68d19

SHA512
3238b2c6029db2c712e12fabb9f3cac37e771ea33854be3fb8e32a63c4a239284ba1469984f18356565705a1061ce2b73ec1b5a3f530180d1c3585bca2b99663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df8c610a8639c296def36e25aa672a0b

SHA1
e572a98074e4150b2e6ce43cf3be97a1ffe3d61f

SHA256
40e0a0c68458fbb181bd2cc51b2a9ead160d750963549fa221a94f0b24e5a661

SHA512
a29ec1f8ae4577f863478181d5b6dffb13ff6658d8a5c967fa011561517cfa2b3c6bb22762b7185b6fe267904000744e334ddb1705bdc403dce1408357bddd9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72da972d05655b0deb626698b92df9f2

SHA1
e387d86c29933c93d292717e7ee4e6d2de432993

SHA256
75937d4de78c482eacb55f8952cbc27fd55cba9cc0d7b001418d676ae3fcac6a

SHA512
311d0d61c1bace5b2e55d1157a8bec40a61ece71c26c76bcc16557f44ad4f3acc19fac95d69252f8fc483f1b7705d8ca87ff354cc6176dffda09bac4f1fbec22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
769596c163e2821764dcfb24cbf2e996

SHA1
4314dbd4b977d76ade288e632efc2ce7afe77c17

SHA256
1acc3a25f1e4ca83e982d93a859fe274a46edd4b982149364432439836c00c17

SHA512
9a2c85392c11fe323210db963b17ec72bcddf450d29ee2e64f8c8f00805f8668ae5740b7a99a9688ebe99c33ae0ef1d767bcb30f8f0213b0265a7a4121306a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e656466f48061520dc20d57ec06f189c

SHA1
f66be175be87dea74ab904d54e75b18f719536aa

SHA256
5b28e16b2161b6c4a2bbcc0da6b70fad2ac3c52f960159c07f230c6354116617

SHA512
d5243085dacd6ddee8488054cd9b81abaf4a21b49faac562b7dd05b7779f99afe60e6239c4fc92fae605b950da1c6eaf4a7c1bcd56822ae9925f15a9674f200f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0da48697f0eb6ccc33f37fd3ef0ab73b

SHA1
73d23440c3c9c4c7750bf5259b4b620996e9e144

SHA256
c185e0794880c79975798cb76bd81023142538a30199069f9c12733be85572ac

SHA512
db41cbc48aae55f08a052b3a9ec31b3b8808bdce00b34c70db2959bf59a87dc7f473149dd742d39998b94403ef17c17b534fdaa76de1c4f95853bec0be72e800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f53e886d792b51522c0c7b44eb5fa7f

SHA1
850b30c139d3f18908242d0c41dea70a54cfe18c

SHA256
61ba096b85eb50fb714526a3dbb3eb6b1c1a19cd11bc6f5eec8aaefd95e1d747

SHA512
2a0b270e49f6e56668776103884a1ec8a56b0719199e2ca6500c8b64e35993cd113802fe83adc704f43c3252986aaec7098993b8ebbca3ab8365044f30bb0aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c05951191f297ecf591a3afa4e1579b2

SHA1
a671cf332b6a486f41484dcbd0685c10e49a83e0

SHA256
b37ab8ed36c978b4153a84d6dea892c48f6529d7f82068a45054ffc479717462

SHA512
d449ff89ffaf780b14defbafdb532c11aaa3eaed51d97bb55a1246cf8d9de8b3e80df29fe0fef00b59a3d87c3357c17d360543b1df926085595ad93a2f02a314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25d5b210d76f7bd8ef7982081f3a65e8

SHA1
729a8abdda1d13ffe4f9502d3b68aa8c847ce19c

SHA256
d50adcdef4f8b1380ac69515e924e89bb9bb93bb7a7130a2994a10284c551289

SHA512
934b271f45fd6987ffe24d0ef6d9c371c86fdab89c866006a866c1ac78e928d826fe922afe901622dd41b86269d7c704aecb347feeeb76fd9df1ffd428a745fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9d49806dba76def38e257cf00ff7892

SHA1
f4031c5e476bc938e8a7c06672244a3ff56c3786

SHA256
54180bd107799078f818f01b0a5d2017f8d21c23294434467aa383fa5efed118

SHA512
81a17d9e1c1dca4e3d73195eb945f791b265b231a82978761bb90d8d922f4b0bca041bfa860f2eff4efbd3a7b4f5f961da99c573b40f8b9b0c758f5b4f7e2d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d79c6920979e405f753d3a4aeb39792

SHA1
3d7fcc098797aa258d091d40c46b7cfffc6dfbf3

SHA256
882862d8c5334c461cb7b99ba7aed7b32d163e33a11ab571e7d17a93b9e39f4a

SHA512
b232e203d5717b58df33d81d0753f1b7a9cd8398d590972f2dae6a83789616878cbce38b9a21ef6633c0b22b388da1b1654a9d8a62fe5045224c787bd46f4e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7507203f10c17f6452c7a69aa2e6d61

SHA1
b4de24bde121edb43c2f626ed3e02ad1aca791ca

SHA256
e6050329269701bc4d0b69106ffdd92526fd4f18a940e2cce5077048fadfa485

SHA512
7af4bfd6e75900052d9155296793dfc8ff8862e3616df1442842c33528daa6577e674c203eb1078bd2e80a1433e72d64507e8c6081ee0cef3b6eefe01081a521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de3c8df99378c7968ea139f8f4ebd9ea

SHA1
936c7d8fcadb739ea6bd324521d9839ffe87fc18

SHA256
78213a62280c5d13fc1e856bb82868ebc24e89bd051a4189956fba1a40b92fc1

SHA512
f73f7c814f039699dbbe0a657414431cdd1cf84a135f1ecff2d1d6cdd00b091e72e76bb3dbf1bbba4e361c9b30033321d9c3769eb19204ec402e0c6c4b581e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D

Filesize
404B

MD5
7be0efeb2b5f510c4e656ec2b8737263

SHA1
0dbc49d247d13c003a4409b2c0599a40d26ac756

SHA256
ceb13647ea84ed6f9eba2c3e1cb28fa34694634d1e0110737bf8cf2403e1d25e

SHA512
494a6bfd165d660d1d095b5081959752a51c9545c571dbb9b7e3caf953b31488d06ce26c285a8272171f139fcfc0895c78cccc97fdf5211d2491668eaf137eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
229B

MD5
4bdfc36d8adba052dcd77e5012c7aad3

SHA1
2d225c38bc0efed8b1224a90aa39783b66419545

SHA256
f6781eb5c4b264d3a2dd9ab1aea967a788f40570afbaa3644d1807027b2e09b4

SHA512
7f9a6aefad5217aa34e40dec00b062f5f45c063d869ee1203594883d228fa59225892200cb5f4ed16f7dd7d9e1644563b2aa2274e1046283d4f89aa4f2810566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
641B

MD5
7c7ae286bfa4aad7b5fd7f9a35809b57

SHA1
8293879df29776999e5c9f577bb457b2d783bddb

SHA256
d639be750d7f630fc505ee6f2cb2890177cf704ff80fb0640c76edd1f6b8ffd3

SHA512
8a192296fa5bf94d0d6e1a0e4affab53fa3c505f6d0967971b33dbd6802a888aa3f34b53c5d0718d34070798e2a6454748d019773ffa9c65bf304ed628d172cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
18KB

MD5
35a458521ecdc3b233386774fe3cc9eb

SHA1
e4ab2611ba204b2bc0105d30e19ae7fb6a102c0e

SHA256
061f8fbe815886b292a03e943b5310c82e99a6665001039cb8e6892ee4d3d082

SHA512
9b60bc7ec2785f3a54c6fdd12b31214023577f19747614cd1be5a48dd3821cba9f37827703f165d5776b6302a3f2a292094163898694067d94677129748eda70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
990B

MD5
b405c1ad187786ea7b13e0456ae34af1

SHA1
8971a87d929e1b19a57c5cbb0e50864b4e34812a

SHA256
93df1c30f7ec74307ff7c46efabd5322b54b0d9ac93c096f508e3ccba28ad61e

SHA512
7bdbeb4fd253b2e4a9b0cff87a2b0507e4a458dcdd25470cfa3bc59eaf82cdbdfa99edb945332b2ee18c6769460a60162599128dbefd7f1c3703269eb5f44820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
1KB

MD5
78e9bc42b1f71cc5814fe00da1425740

SHA1
72d04c8053ff0f711ec8a7d1261b07bf1425cad1

SHA256
9b95532182c6106c526f81d9e65cdb2d86048e45cc18e11f5083ce35f6017de8

SHA512
a624e5e2b065211a08c87489eea0f1836ef6213e66b7c1b702c8ba444eb80f85d465a2217126f3cd21460b57c5293c515dc668636c048795e042a53eba255e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
990B

MD5
7818fbe73dfd7220c2f79509c3b941fd

SHA1
3121169eaa1021bab307c78574c43cf0d4b0c32a

SHA256
abd675e832083b2f1660e261c960bfe4a32227698c336c5bcbab6638e47ee9b5

SHA512
adc23636f21c5fc36033b610a0824a7697a26878664f178b647640b2e8558df80884f4f75374cb93ac200da22e836f15e4d1f3ef9347bc62c9384e9d4bf5393e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
990B

MD5
9b61b4bd976a99e99c781c16096d5c0e

SHA1
778da3b7e94d6a0f561b1ddfba4cce0579c849a4

SHA256
52cb5e8527588b387948d0e08a4634083a448ee23ee9af457fc3747d1eabc3f2

SHA512
ba7396e3349d0be9fe89a490264a6c278b517ad476be7a10924f09f39a3949f913e59d06a5a7ebe6d7ea87af214fb0b93138d90eec80239194e4beeb5774a79e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACMYC9U\www.youtube[1].xml

Filesize
990B

MD5
21e75f2ad057a492e6aa387f9fd379f6

SHA1
34f9ec1c923c53c5389b50679003601b9ee5ba97

SHA256
81ad481698b11d054de386427f38afa7d8d83103a1850ae2a37c589154a7fb3b

SHA512
26ed47de4a794b5abdb1b55445dda90754bc51089ccdc27104f10f7a884d3b79a3e4bf04c9dfd7be4ee96a40d73e6e5eb01a76bc55909d4efa19196dc39a7b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S8GI6B9B\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5C8.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\96EMG90O44OR6TF6G98R.temp

Filesize
7KB

MD5
24763b82c0b8a1f5e185e24134d6a126

SHA1
0f32ed81e37d4f58142f327509cb12e1a52fc4c3

SHA256
eb136145fe85151a411bc7cd7df02e84474503b9ffa0d713c466ddb5e145790f

SHA512
0213b36741290a5efa8984938edcb676acc024adfb920a36712dbf37b0dbdec0aece8331af13bd0bad4eb187cbd19ae191eefe45ed179180658b88b6f2750b8e

Download Submit
\LDPlayer\LDPlayer9\crashreport.dll

Filesize
51KB

MD5
1ea48ba4040743ffc511b0cc923a178b

SHA1
72b76002087d62c9580ff2a1655b41095826acc4

SHA256
1e2e3ca8d4bfe01a68586e3568b8964eba8bf92a6bc19b7c245865ad9ba7280e

SHA512
20bc651739a267514cf2b7d158c2d0a56ac0251fe8c5f79eed7d88f6628d92d3bd3b697a6c958fb1f46f853c6defa204a6557996ad9d32a741e787cb8188026d

Download Submit
\LDPlayer\LDPlayer9\msvcp120.dll

Filesize
444KB

MD5
50260b0f19aaa7e37c4082fecef8ff41

SHA1
ce672489b29baa7119881497ed5044b21ad8fe30

SHA256
891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9

SHA512
6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d

Download Submit
\LDPlayer\LDPlayer9\msvcr120.dll

Filesize
947KB

MD5
50097ec217ce0ebb9b4caa09cd2cd73a

SHA1
8cd3018c4170072464fbcd7cba563df1fc2b884c

SHA256
2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112

SHA512
ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058

Download Submit
memory/1600-943-0x0000000036510000-0x0000000036520000-memory.dmp

Filesize
64KB

Download
memory/1600-1248-0x00000000715B0000-0x000000007162E000-memory.dmp

Filesize
504KB

Download
memory/1600-949-0x00000000045A0000-0x00000000045A2000-memory.dmp

Filesize
8KB

Download
memory/1600-1249-0x0000000071000000-0x00000000715A6000-memory.dmp

Filesize
5.6MB

Download
memory/1600-1247-0x0000000071630000-0x000000007302B000-memory.dmp

Filesize
26.0MB

Download
memory/1600-948-0x0000000004590000-0x0000000004592000-memory.dmp

Filesize
8KB

Download
memory/2072-946-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2072-947-0x00000000021C0000-0x00000000021D0000-memory.dmp

Filesize
64KB

Download