6f2d0f89930a4ea9854071442a7c72a1e657c5958759fee694acf6bf24623698

Analysis

max time kernel
1049s
max time network
906s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
20/10/2025, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
Size 3.3MB
Sample251020-v11kdacm2x
SHA256 6f2d0f89930a4ea9854071442a7c72a1e657c5958759fee694acf6bf24623698
MD5 07c349f93e45d03454a0d80813e03a5f
SHA1 d0a64ce4e049baa6e9202a71377d440e5bfe4096
SHA512 f36d73e314c59b5059911d1dfc17e1759b3eb2badf8d47a1eb1d87edd880f8a8d04c46c637a66738614519efaccb45c4d7077c97d0cc50ae9799f5e0d4b44e01
SSDEEP 98304:3+dbSgylNqr0ZQc8l84dG4cisobqbbW8S:OdbSgylN18lsVbNS
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware defense_evasion discovery execution exploit persistence privilege_escalation spyware

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221\FuncName = "WVTAsn1CatNameValueEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPCreateIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222\FuncName = "WVTAsn1CatMemberInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2\FuncName = "WVTAsn1IntentToSealAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\FuncName = "WVTAsn1CatNameValueDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012\FuncName = "WVTAsn1SealingTimestampAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "HTTPSFinalProv"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2011\FuncName = "WVTAsn1SealingSignatureAttributeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27\FuncName = "WVTAsn1SpcFinancialCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.12\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011\FuncName = "WVTAsn1SealingSignatureAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "HTTPSCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28\Dll = "WINTRUST.DLL"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLREMOVESIGNEDDATAMSG\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2\FuncName = "WVTAsn1CatMemberInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData"	regsvr32.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
5896	takeown.exe
2380	takeown.exe
1168	icacls.exe
3928	takeown.exe
1748	icacls.exe
1640	takeown.exe
3048	icacls.exe
1940	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1640	takeown.exe
3048	icacls.exe
1940	icacls.exe
5896	takeown.exe
2380	takeown.exe
1168	icacls.exe
3928	takeown.exe
1748	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Windows\CurrentVersion\Run\Easyfun = "\"F:\\Easyfun\\Easyfun.exe\" autorun"	inst_X.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
195	5132	msedge.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
File opened (read-only)	\??\F:	LDPlayer_0900016300.exe
File opened (read-only)	\??\F:	Easyfun_en_50000_ld.exe
File opened (read-only)	\??\F:	Easyfun.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5764	powercfg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\USBUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-synch-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-environment-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\swscale-9.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\dpinst_64.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\libcrypto-1_1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_CM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NvLowLatencyVk.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\nvngx_deepdvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxHostChannel.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-private-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetFltNobj.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSampleDevice.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMMPreload.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.common.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxEFI32.fd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-interlocked-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-locale-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-process-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\avformat-62.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\concrt140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5WinExtras.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vbox-img.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-libraryloader-l1-1-0.dll	dnrepairer.exe
File opened for modification	C:\Program Files\ldplayer9box\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.interposer.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qoffscreen.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcr100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSVC.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetFltUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstVMREQ.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcr120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\crashreport.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\driver-PreW10\Ld9BoxSup.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxManage.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxStubBld.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-stdio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuthSimple.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDbg.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSampleDriver.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxExtPackHelperApp.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxGuestControlSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-runtime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstAnimate.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-synch-l1-1-0.dll	dnrepairer.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_223382311\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_402695993\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_402695993\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_229453050\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_229453050\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_223382311\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_223382311\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_418271967\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_418271967\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_418271967\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_418271967\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_223382311\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_223382311\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_402695993\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_418271967\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_229453050\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_223382311\_metadata\verified_contents.json	msedge.exe

Executes dropped EXE 33 IoCs

pid	Process
2456	LDPlayer_0900016300.exe
3460	dnrepairer.exe
3676	Ld9BoxSVC.exe
4956	driverconfig.exe
2920	dnplayer.exe
1344	Ld9BoxSVC.exe
4744	vbox-img.exe
1920	vbox-img.exe
1088	vbox-img.exe
4676	Ld9BoxHeadless.exe
3392	Ld9BoxHeadless.exe
4240	Ld9BoxHeadless.exe
948	Ld9BoxHeadless.exe
5388	Ld9BoxHeadless.exe
1756	Easyfun_en_50000_ld.exe
3932	inst_X.exe
6032	Easyfun.exe
4656	Easyfun.exe
3044	EasyfunCef.exe
4412	dnplayer.exe
3268	Ld9BoxSVC.exe
1808	Ld9BoxHeadless.exe
2336	Ld9BoxHeadless.exe
1160	Ld9BoxHeadless.exe
456	Ld9BoxHeadless.exe
4256	Ld9BoxHeadless.exe
6072	dnplayer.exe
3280	Ld9BoxSVC.exe
3548	Ld9BoxHeadless.exe
1160	Ld9BoxHeadless.exe
456	Ld9BoxHeadless.exe
1728	Ld9BoxHeadless.exe
3904	Ld9BoxHeadless.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5592	sc.exe
3932	sc.exe
5388	sc.exe
824	sc.exe
5688	sc.exe
4280	sc.exe
6088	sc.exe
5936	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
3460	dnrepairer.exe
3460	dnrepairer.exe
3460	dnrepairer.exe
3676	Ld9BoxSVC.exe
3676	Ld9BoxSVC.exe
3676	Ld9BoxSVC.exe
3676	Ld9BoxSVC.exe
3676	Ld9BoxSVC.exe
3676	Ld9BoxSVC.exe
3676	Ld9BoxSVC.exe
3676	Ld9BoxSVC.exe
3476	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
1372	regsvr32.exe
2332	regsvr32.exe
2332	regsvr32.exe
2332	regsvr32.exe
2332	regsvr32.exe
2332	regsvr32.exe
2332	regsvr32.exe
2332	regsvr32.exe
2332	regsvr32.exe
1744	regsvr32.exe
1744	regsvr32.exe
1744	regsvr32.exe
1744	regsvr32.exe
1744	regsvr32.exe
1744	regsvr32.exe
1744	regsvr32.exe
1744	regsvr32.exe
4956	driverconfig.exe
4956	driverconfig.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe
2920	dnplayer.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Easyfun_en_50000_ld.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EasyfunCef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer_0900016300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inst_X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Easyfun_en_50000_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Easyfun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Easyfun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 3 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4324	systeminfo.exe
3744	systeminfo.exe
2524	systeminfo.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
5864	taskkill.exe
3108	taskkill.exe
3816	taskkill.exe
6032	taskkill.exe
2604	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-1644934582-3155071241-5924616-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134054550758234691"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-58D9-43AE-8B03-C1FD7088EF15}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32\ = "\"C:\\Program Files\\ldplayer9box\\Ld9BoxSVC.exe\""	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6679-422A-B629-51B06B0C6D93}\ = "IUSBDeviceStateChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-42F8-CD96-7570-6A8800E3342C}\ = "IDnDBase"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C380-4510-BC7C-19314A7352F1}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0126-43E0-B05D-326E74ABB356}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-00A7-4104-0009-49BC00B2DA80}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-2354-4267-883F-2F417D216519}\NumMethods\ = "18"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4289-EF4E-8E6A-E5B07816B631}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E1B7-4339-A549-F0878115596E}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1F8B-4692-ABB4-462429FAE5E9}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-23D0-430A-A7FF-7ED7F05534BC}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-73A5-46CC-8227-93FE57D006A6}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5409-414B-BD16-77DF7BA3451E}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B5BB-4316-A900-5EB28D3413DF}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-08A7-4C8F-910D-47AABD67253A}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-42F8-CD96-7570-6A8800E3342C}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-604D-11E9-92D3-53CB473DB9FB}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3188-4C8C-8756-1395E8CB691C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\ProgId\ = "VirtualBox.Session.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-92c9-4a77-9d35-e058b39fe0b9}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CB8D-4382-90BA-B7DA78A74573}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-e4b1-486a-8f2e-747ae346c3e9}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-416B-4181-8C4A-45EC95177AEF}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-800A-40F8-87A6-170D02249A55}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6B76-4805-8FAB-00A9DCF4732B}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8A02-45F3-A07D-A67AA72756AA}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7708-444B-9EEF-C116CE423D39}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7619-41AA-AECE-B21AC5C1A7E6}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E87-11E9-8AF2-576E84223953}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0B79-4350-BDD9-A0376CD6E6E3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-808E-11E9-B773-133D9330F849}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7E72-4F34-B8F6-682785620C57}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3534-4239-B2DE-8E1535D94C0B}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0002-4b81-0077-1dcb004571ba}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4974-A19C-4DC6-CC98C2269626}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B7DB-4616-AAC6-CFB94D89BA78}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8690-11E9-B83D-5719E53CF1DE}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0547-448E-BC7C-94E9E173BF57}\ = "IHostUpdate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D8ED-44CF-85AC-C83A26C95A4D}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-44DE-1653-B717-2EBF0CA9B664}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7997-4595-A731-3A509DB604E5}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AA82-4720-BC84-BD097B2B13B8}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486E-472F-481B-969746AF2480}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6E15-4F71-A6A5-94E707FAFBCC}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-00c2-4484-0077-c057003d9c90}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\ = "INetworkAdapter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-BCB2-4905-A7AB-CC85448A742B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80E1-4A8A-93A1-67C5F92A838A}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E78-11E9-B25E-7768F80C0E07}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-cd54-400c-b858-797bcb82570e}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\ProgId	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-44DE-1653-B717-2EBF0CA9B664}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D545-44AA-8013-181B8C288554}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-44A0-A470-BA20-27890B96DBA9}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7619-41AA-AECE-B21AC5C1A7E6}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5ba5-ea42d66af0bf}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-787B-44AB-B343-A082A3F2DFB1}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2d12-4d7c-ba6d-ce51d0d5b265}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4974-A19C-4DC6-CC98C2269626}	regsvr32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Easyfun_en_50000_ld.exe:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
3460	dnrepairer.exe
3460	dnrepairer.exe
2284	powershell.exe
2284	powershell.exe
5988	powershell.exe
5988	powershell.exe
2940	powershell.exe
2940	powershell.exe
2456	LDPlayer_0900016300.exe
2456	LDPlayer_0900016300.exe
4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
3932	inst_X.exe
3932	inst_X.exe
3932	inst_X.exe
3932	inst_X.exe
3932	inst_X.exe
3932	inst_X.exe
3932	inst_X.exe
3932	inst_X.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
4160	powershell.exe
4160	powershell.exe
4160	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
6076	powershell.exe
6076	powershell.exe
6076	powershell.exe
1756	Easyfun_en_50000_ld.exe
1756	Easyfun_en_50000_ld.exe
4656	Easyfun.exe
4656	Easyfun.exe
2920	dnplayer.exe
2920	dnplayer.exe
4656	Easyfun.exe
4656	Easyfun.exe
4412	dnplayer.exe
4412	dnplayer.exe
4656	Easyfun.exe
4656	Easyfun.exe
3260	msedge.exe
3260	msedge.exe
3044	EasyfunCef.exe
3044	EasyfunCef.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2920	dnplayer.exe
6072	dnplayer.exe

Suspicious behavior: LoadsDriver 16 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeTakeOwnershipPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe
Token: SeDebugPrivilege	2456	LDPlayer_0900016300.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
2920	dnplayer.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4656	Easyfun.exe
2920	dnplayer.exe
4412	dnplayer.exe
4412	dnplayer.exe
6072	dnplayer.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2920	dnplayer.exe
4656	Easyfun.exe
2920	dnplayer.exe
4412	dnplayer.exe
4412	dnplayer.exe
6072	dnplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 2456	4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe	78
PID 4080 wrote to memory of 2456	4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe	78
PID 4080 wrote to memory of 2456	4080	LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe	78
PID 2456 wrote to memory of 3460	2456	LDPlayer_0900016300.exe	79
PID 2456 wrote to memory of 3460	2456	LDPlayer_0900016300.exe	79
PID 2456 wrote to memory of 3460	2456	LDPlayer_0900016300.exe	79
PID 3460 wrote to memory of 4520	3460	dnrepairer.exe	80
PID 3460 wrote to memory of 4520	3460	dnrepairer.exe	80
PID 3460 wrote to memory of 4520	3460	dnrepairer.exe	80
PID 4520 wrote to memory of 1968	4520	net.exe	82
PID 4520 wrote to memory of 1968	4520	net.exe	82
PID 4520 wrote to memory of 1968	4520	net.exe	82
PID 3460 wrote to memory of 1268	3460	dnrepairer.exe	83
PID 3460 wrote to memory of 1268	3460	dnrepairer.exe	83
PID 3460 wrote to memory of 1268	3460	dnrepairer.exe	83
PID 3460 wrote to memory of 4912	3460	dnrepairer.exe	84
PID 3460 wrote to memory of 4912	3460	dnrepairer.exe	84
PID 3460 wrote to memory of 4912	3460	dnrepairer.exe	84
PID 3460 wrote to memory of 1680	3460	dnrepairer.exe	85
PID 3460 wrote to memory of 1680	3460	dnrepairer.exe	85
PID 3460 wrote to memory of 1680	3460	dnrepairer.exe	85
PID 3460 wrote to memory of 2360	3460	dnrepairer.exe	86
PID 3460 wrote to memory of 2360	3460	dnrepairer.exe	86
PID 3460 wrote to memory of 2360	3460	dnrepairer.exe	86
PID 3460 wrote to memory of 1608	3460	dnrepairer.exe	87
PID 3460 wrote to memory of 1608	3460	dnrepairer.exe	87
PID 3460 wrote to memory of 1608	3460	dnrepairer.exe	87
PID 3460 wrote to memory of 5412	3460	dnrepairer.exe	88
PID 3460 wrote to memory of 5412	3460	dnrepairer.exe	88
PID 3460 wrote to memory of 5412	3460	dnrepairer.exe	88
PID 3460 wrote to memory of 5628	3460	dnrepairer.exe	89
PID 3460 wrote to memory of 5628	3460	dnrepairer.exe	89
PID 3460 wrote to memory of 5628	3460	dnrepairer.exe	89
PID 3460 wrote to memory of 2380	3460	dnrepairer.exe	90
PID 3460 wrote to memory of 2380	3460	dnrepairer.exe	90
PID 3460 wrote to memory of 2380	3460	dnrepairer.exe	90
PID 3460 wrote to memory of 1168	3460	dnrepairer.exe	92
PID 3460 wrote to memory of 1168	3460	dnrepairer.exe	92
PID 3460 wrote to memory of 1168	3460	dnrepairer.exe	92
PID 3460 wrote to memory of 3928	3460	dnrepairer.exe	94
PID 3460 wrote to memory of 3928	3460	dnrepairer.exe	94
PID 3460 wrote to memory of 3928	3460	dnrepairer.exe	94
PID 3460 wrote to memory of 1748	3460	dnrepairer.exe	96
PID 3460 wrote to memory of 1748	3460	dnrepairer.exe	96
PID 3460 wrote to memory of 1748	3460	dnrepairer.exe	96
PID 3460 wrote to memory of 1640	3460	dnrepairer.exe	98
PID 3460 wrote to memory of 1640	3460	dnrepairer.exe	98
PID 3460 wrote to memory of 1640	3460	dnrepairer.exe	98
PID 3460 wrote to memory of 3048	3460	dnrepairer.exe	100
PID 3460 wrote to memory of 3048	3460	dnrepairer.exe	100
PID 3460 wrote to memory of 3048	3460	dnrepairer.exe	100
PID 3460 wrote to memory of 3676	3460	dnrepairer.exe	102
PID 3460 wrote to memory of 3676	3460	dnrepairer.exe	102
PID 3460 wrote to memory of 3476	3460	dnrepairer.exe	103
PID 3460 wrote to memory of 3476	3460	dnrepairer.exe	103
PID 3460 wrote to memory of 1372	3460	dnrepairer.exe	104
PID 3460 wrote to memory of 1372	3460	dnrepairer.exe	104
PID 3460 wrote to memory of 1372	3460	dnrepairer.exe	104
PID 3460 wrote to memory of 2332	3460	dnrepairer.exe	105
PID 3460 wrote to memory of 2332	3460	dnrepairer.exe	105
PID 3460 wrote to memory of 1744	3460	dnrepairer.exe	106
PID 3460 wrote to memory of 1744	3460	dnrepairer.exe	106
PID 3460 wrote to memory of 1744	3460	dnrepairer.exe	106
PID 3460 wrote to memory of 3932	3460	dnrepairer.exe	107

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.innersloth.spacemafia_44657388_ld.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080
- C:\LDPlayer\LDPlayer9\LDPlayer_0900016300.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer_0900016300.exe" -silence -downloader -openid=44657388 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" cmd=install|listener=328174
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1968
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:1268
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:4912
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1680
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2360
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1608
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:5628
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2380
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1168
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3928
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1748
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\Users\Admin\.Ld9VirtualBox" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1640
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\Users\Admin\.Ld9VirtualBox" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3048
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3676
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:3476
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1372
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2332
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1744
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3932
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxSup" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2284
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "Ld9BoxNat" -Direction Inbound -Program 'C:\Program Files\ldplayer9box\VBoxNetNAT.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5988
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" New-NetFirewallRule -DisplayName "dnplayer" -Direction Inbound -Program 'C:\LDPlayer\LDPlayer9\dnplayer.exe' -RemoteAddress LocalSubnet -Action Allow
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2940
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4956
- - C:\Windows\SysWOW64\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /powerthrottling disable /path "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"
    3⤵
    - Power Settings
    PID:5764
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5896
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1940
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\dnplayer.exe" downloadpackage=com.innersloth.spacemafia|package=com.innersloth.spacemafia
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2920
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:824
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4324
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    - Executes dropped EXE
    PID:4744
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:1920
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.easyfun.gg/?utm_source=emu&utm_medium=pop_up
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2c0,0x7ffe63dff208,0x7ffe63dff214,0x7ffe63dff220
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1796,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2084,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
      4⤵
      Downloads MZ/PE file
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1824,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4860,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5872,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5872,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:3648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6208,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1136
        5⤵
        
        PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6388,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4140,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6348,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6904,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      NTFS ADS
      PID:5436
  - - C:\Users\Admin\Downloads\Easyfun_en_50000_ld.exe
      "C:\Users\Admin\Downloads\Easyfun_en_50000_ld.exe"
      4⤵
      Enumerates connected drives
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1756
    - - F:\Easyfun\inst_X.exe
        
        "F:\Easyfun\\inst_X.exe" from=install|path=F:\Easyfun\|openid=50000|language=en
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3932
      - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /F /IM bugreport.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:5864
      - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /F /IM EasyfunCef.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3108
      - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /F /IM Easyfun.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3816
      - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /F /IM EasyfunYun.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:6032
      - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /F /IM EasyfunYunCef.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2604
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" New-NetFirewallRule -DisplayName "Easyfun" -Direction Inbound -Program 'F:\Easyfun\Easyfun.exe' -RemoteAddress LocalSubnet -Action Allow
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2736
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" New-NetFirewallRule -DisplayName "EasyfunCef" -Direction Inbound -Program 'F:\Easyfun\EasyfunCef.exe' -RemoteAddress LocalSubnet -Action Allow
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4160
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" New-NetFirewallRule -DisplayName "EasyfunYun" -Direction Inbound -Program 'F:\Easyfun\EasyfunYun.exe' -RemoteAddress LocalSubnet -Action Allow
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3380
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" New-NetFirewallRule -DisplayName "EasyfunYunCef" -Direction Inbound -Program 'F:\Easyfun\EasyfunYunCef.exe' -RemoteAddress LocalSubnet -Action Allow
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6076
    - - F:\Easyfun\Easyfun.exe
        
        "F:\Easyfun\\Easyfun.exe"
        5⤵
        Enumerates connected drives
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4656
      - F:\Easyfun\EasyfunCef.exe
        
        "F:\Easyfun\EasyfunCef.exe" mainhwnd=328424|language=en|url=F:\Easyfun\html\dist\index.html#?languageCode=en&machineCode=e05c476faf66c6085588f63825faf689&channel=44657388&version=4.0.12| -single-process --force-device-scale-factor=1.000000
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
      - C:\LDPlayer\LDPlayer9\dnplayer.exe
        
        "C:\LDPlayer\LDPlayer9\dnplayer.exe" index=0|from=playerx|package=com.innersloth.spacemafia|googleurl=https://play.google.com/store/apps/details?id=com.innersloth.spacemafia&hl=en_us&gl=us|playerxid=44657388|clickedid=|language=en|directlink=
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4412
        
        C:\Windows\SysWOW64\sc.exe
        
        sc query HvHost
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\sc.exe
        
        sc query vmms
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c systeminfo
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        8⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:3744
      - C:\LDPlayer\LDPlayer9\dnplayer.exe
        
        "C:\LDPlayer\LDPlayer9\dnplayer.exe" index=0|from=playerx|package=com.innersloth.spacemafia|googleurl=https://play.google.com/store/apps/details?id=com.innersloth.spacemafia&hl=en_us&gl=us|playerxid=44657388|clickedid=|language=en|directlink=
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:6072
        
        C:\Windows\SysWOW64\sc.exe
        
        sc query HvHost
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Windows\SysWOW64\sc.exe
        
        sc query vmms
        7⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c systeminfo
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        8⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:2524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.easyfun.gg/?utm_source=emu&utm_medium=pop_up
        7⤵
        
        PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=736,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:14
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7736,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6924,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7496,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5276,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5288,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5348,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6496,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:14
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:14
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6280,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5564,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4712,i,16570604691286214554,16183825177194639231,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:14
      4⤵
      PID:2716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004D0
1⤵
PID:3120

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:1344
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:5388

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4732

F:\Easyfun\Easyfun.exe
"F:\Easyfun\Easyfun.exe" autorun
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6032

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3268
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4256

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3280
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 51KB
SHA256 75d098831096cfbcf23d5a8444a5b9505504c37e971c3d72bd5e2e180290049e
MD5 5ba973445c863d1884f8806cb66c8c8f
SHA1 c3efd029fc67e7c344926e0a0a726f7c0546dc68
SHA512 0d370fddcf19a6cf270a9d12e83cc13dfe744c6980567262d1e4936848f9f1db665b90f02e327aa570495bdd1b2a37c6e673a1f6555eb8688e690e0de7e299bb
SSDEEP 768:MQ+agNztWyGOiprkvcocNcb0H/GEM8Jf360sbG7nQL448YiDLk5wkFQOoYiXkFQ6:MPGyMprkvxXb0HOafKEQM4875Oo7Z6
MD5 SHA1 SHA512 SSDEEP

Submit Download

device.ini

Path C:\LDPlayer\LDPlayer9\device.ini
Size 92B
SHA256 a12fd80cedd3e2067eb14eb44cdebb5b1caa929e4b9438d6d1f744ab34324040
MD5 1e81c72753c08cb6eb5a1a9ea451d5be
SHA1 240a247f99212b92f3ce5ef23d6efbb1bf69f955
SHA512 b5a8aeea46da99e32f5e4be0b675b8792d7a5ffd7209633105860e15f01ac4ae7fd5520ffa7e549edb9b25fe14271fea7d31e46a157c8c7efdfa1b8791deff2d
MD5 SHA1 SHA512

Submit Download

dnmultiplayer.exe

Path C:\LDPlayer\LDPlayer9\dnmultiplayer.exe
Size 1.3MB
SHA256 4d275d0305cdb908309f68b57755bbd2451b77e3ed5f7337f7fca9bf5da9d2e1
MD5 3bbbf4f96994c23744ae8901b4e8d476
SHA1 ff44967802edb824ab087894241a4e41d2893bfd
SHA512 50474dd1288195ba6e68c4824c01333356da0db6a7441e36ca3e2736bc497e4fc0bbd65e32086d1e1802219fb6ee892c3b1b22a64c7631110ffd312f57eab99a
SSDEEP 24576:sBnKAYV5zsVJ9gxxYFTJf8TUZxmNxbthGxsA0DRkZcyk:hIVXgxeF6T9bthvlyk
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnplayer.exe

Path C:\LDPlayer\LDPlayer9\dnplayer.exe
Size 4.0MB
SHA256 524d9cf9bd8a9ccd1da9bead658c17625b947c5eab5b0e9d0a15e9b59049726d
MD5 29afd0fa3f8d7f1fe06ad3b388187cfb
SHA1 adf9cade28a1fff70cf51e4d07626ce4f8664f63
SHA512 0744a8ea99df8ad2ff4864e0f3593a329dff6e5954c8cebbeb7990321f2e02730cae54531fcbf43febc56d88bfeb3e241406fbf7ebe6c1f8d1934d4f91876dee
SSDEEP 49152:E85cqVJ3eZIJyEp/hiAjy1x2C08uAOiLWcrVXsmYI52ShiyG8Vpa1c+zru28KR:EkcqHw6jy/2NAOiLZXsvI99Vpa1pR
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 42.1MB
SHA256 2e352592ede5f506f72d20fd57ae3e0319ba0d975453ef32b364d409e9847244
MD5 a22bbfc3bd5c8f1a22a51f5881144bb2
SHA1 039a45216c6b19665291f0403592c69d85f69efe
SHA512 e617e7789bb561162ae9a44e72682e36584223fced8bb6db1b20db086a82f623c23bdb185a6e3872f718bbd8dc5ce38ccab315551557e95275bb8e06e8592342
SSDEEP 786432:Zy8xP01JACZWJ81NV3YtHuPrlZQ+qbNL+aFRx0gjc/wWZ2xZ2juj7G:HxcFY0n4WpZubLvOgjgCjj7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 6.3MB
SHA256 377baa44b1832f78de58f61b077c24df6d19fe6cef41b4038f370f0f7b35b090
MD5 b591492fbc9b43d38dc0239c17d48242
SHA1 bf6b4a1a666a198e1ba26b8a09f4a14b1f9f60c8
SHA512 0e2f9236642f061d36d4e4a78fbac3f73d9eead0ae03be06e3b6a81932599ec933a73f18cc76cef9e10c1ccf0292f4fea3d3bfed411bca630e279fd837d79c37
SSDEEP 98304:U3E1mpyFBCFMsAgIV5r7Aj7aHa4jJqqhqwaJ/RRX9APMvl5h8H7WdzlpCbOcX1i3:U0b7C5A1vr78a1FqqKZRx9n07WdzlkXw
MD5 SHA1 SHA512 SSDEEP

Submit Download

NanumGothicLight.otf

Path C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf
Size 314KB
SHA256 153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2
MD5 e2e37d20b47d7ee294b91572f69e323a
SHA1 afb760386f293285f679f9f93086037fc5e09dcc
SHA512 001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901
SSDEEP 6144:6kyWbmIwXcviKE2SmwxjVGZ/YKNSfuWBl/3DAJHu46ldvtQqu+EGi:6kXbmBZjjaHN2uQlPDAJHu46l16tGi
MD5 SHA1 SHA512 SSDEEP

Submit Download

7za.exe

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\7za.exe
Size 652KB
SHA256 a6c324f2925b3b3dbd2ad989e8d09c33ecc150496321ae5a1722ab097708f326
MD5 ad9d7cbdb4b19fb65960d69126e3ff68
SHA1 dcdc0e609a4e9d5ff9d96918c30cb79c6602cb3d
SHA512 f0196bee7ad8005a36eea86e31429d2c78e96d57b53ff4a64b3e529a54670fa042322a3c3a21557c96b0b3134bf81f238a9e35124b2d0ce80c61ed548a9791e7
SSDEEP 12288:aCEg6ksPgamGycPycplunzCke+tMU0gKVDrnI/Anky3ZDHg:aCCks4ECO8zfeJ3rnI/A93FA
MD5 SHA1 SHA512 SSDEEP

Submit Download

cximagecrt.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\cximagecrt.dll
Size 1.5MB
SHA256 91e3035a01437b54adda33d424060c57320504e7e6a0c85db2654815ba29c71f
MD5 66df6f7b7a98ff750aade522c22d239a
SHA1 f69464fe18ed03de597bb46482ae899f43c94617
SHA512 48d4513e09edd7f270614258b2750d5e98f0dbce671ba41a524994e96ed3df657fce67545153ca32d2bf7efcb35371cae12c4264df9053e4eb5e6b28014ed20e
SSDEEP 24576:gzpjfQWnxImuy/53F9F2LZFTSnvZYfHfE0jr8HDYn8HyTdUZ8:g1zQUgVDjwHcn8STW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libcrypto-1_1.dll
Size 2.0MB
SHA256 c9501469ad2a2745509ab2d0db8b846f2bfb4ec019b98589d311a4bd7ac89889
MD5 01c4246df55a5fff93d086bb56110d2b
SHA1 e2939375c4dd7b478913328b88eaa3c91913cfdc
SHA512 39524d5b8fc7c9d0602bc6733776237522dcca5f51cc6ceebd5a5d2c4cbda904042cee2f611a9c9477cc7e08e8eadd8915bf41c7c78e097b5e50786143e98196
SSDEEP 49152:OvQ/qpyr0kvV+caeJQaNmAtGJv95T8Wrhc1CPwDv3uFfJvBQBGWj:OvQ/qpyr0kvVpbQQGfF851CPwDv3uFfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libcurl.dll
Size 442KB
SHA256 1d7037da4222de3d7ca0af6a54b2942d58589c264333ef814cb131d703b5c334
MD5 2d40f6c6a4f88c8c2685ee25b53ec00d
SHA1 faf96bac1e7665aa07029d8f94e1ac84014a863b
SHA512 4e6d0dc0dc3fb7e57c6d7843074ee7c89c777e9005893e089939eb765d9b6fb12f0e774dc1814f6a34e75d1775e19e62782465731fd5605182e7984d798ba779
SSDEEP 6144:QQP8Eg6CNxIZHm8Krm0Druftib83NzDR5W1D8/XFIFWTGLvwOir:Q632xIZHmJm3A49mCQr07r
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libeay32.dll
Size 1.2MB
SHA256 2eac0a690be435dd72b7a269ee761340099bf444edb4f447fa0030023cbf8e1e
MD5 ba46e6e1c5861617b4d97de00149b905
SHA1 4affc8aab49c7dc3ceeca81391c4f737d7672b32
SHA512 bf892b86477d63287f42385c0a944eee6354c7ae557b039516bf8932c7140ca8811b7ae7ac111805773495cf6854586e8a0e75e14dbb24eba56e4683029767b6
SSDEEP 24576:TPD+KpPpmuLM3F2f0LXBrkdfbnaJepHm3E7xL/pN1ecj6UtP9RqbNGhqdyY:DguLM3XiGSHt/jBj6UtP9RqkhqdyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssh2.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libssh2.dll
Size 192KB
SHA256 8c91023203f3d360c0629ffd20c950061566fb6c780c83eaa52fb26abb6be86f
MD5 52c43baddd43be63fbfb398722f3b01d
SHA1 be1b1064fdda4dde4b72ef523b8e02c050ccd820
SHA512 04cc3d8e31bd7444068468dd32ffcc9092881ca4aaea7c92292e5f1b541f877bdec964774562cb7a531c3386220d88b005660a2b5a82957e28350a381bea1b28
SSDEEP 3072:5dv7LPsQZTaBdJAnX0x8YJqZ/2NTBf4+oGlM0W7Ubof:53VaBdmX0x8YJqZ/2NTBQ+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\libssl-1_1.dll
Size 511KB
SHA256 b681fd3c3b3f2d59f6a14be31e761d5929e104be06aa77c883ada9675ca6e9fd
MD5 e8fd6da54f056363b284608c3f6a832e
SHA1 32e88b82fd398568517ab03b33e9765b59c4946d
SHA512 4f997deebf308de29a044e4ff2e8540235a41ea319268aa202e41a2be738b8d50f990ecc68f4a737a374f6d5f39ce8855edf0e2bb30ce274f75388e3ddd8c10b
SSDEEP 12288:PnsHqH+cOyFNn/JliB0B1pDX7k6CAlW711IWU2lvzh1:/sHzcfZG7QWU2lvzh1
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp110.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp110.dll
Size 522KB
SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
MD5 3e29914113ec4b968ba5eb1f6d194a0a
SHA1 557b67e372e85eb39989cb53cffd3ef1adabb9fe
SHA512 75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43
SSDEEP 12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr110.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\msvcr110.dll
Size 854KB
SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
SSDEEP 12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\LDPlayer\LDPlayer9\ldmutiplayer\ssleay32.dll
Size 283KB
SHA256 72553b45a5a7d2b4be026d59ceb3efb389c686636c6da926ffb0ca653494e750
MD5 0054560df6c69d2067689433172088ef
SHA1 a30042b77ebd7c704be0e986349030bcdb82857d
SHA512 418190401b83de32a8ce752f399b00c091afad5e3b21357a53c134cce3b4199e660572ee71e18b5c2f364d3b2509b5365d7b569d6d9da5c79ae78c572c1d0ba0
SSDEEP 6144:wLFThsrlPqhXPXpwiKQQg9L8YMcoIyHJPNlK9//ualAcQYLUIaGdY7Y1XiRdQMJ7:aFThsrlPqhXPXpwiHQg9L8xcoIyHJfKA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp120.dll

Path C:\LDPlayer\LDPlayer9\msvcp120.dll
Size 444KB
SHA256 891603d569fc6f1afed7c7d935b0a3c7363c35a0eb4a76c9e57ef083955bc2c9
MD5 50260b0f19aaa7e37c4082fecef8ff41
SHA1 ce672489b29baa7119881497ed5044b21ad8fe30
SHA512 6f99d39bfe9d4126417ff65571c78c279d75fc9547ee767a594620c0c6f45f4bb42fd0c5173d9bc91a68a0636205a637d5d1c7847bd5f8ce57e120d210b0c57d
SSDEEP 12288:aZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77m:a/8wVwHZFTwFOOos3Ooc8DHkC2e77m
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr120.dll

Path C:\LDPlayer\LDPlayer9\msvcr120.dll
Size 947KB
SHA256 2a2ff2c61977079205c503e0bcfb96bf7aa4d5c9a0d1b1b62d3a49a9aa988112
MD5 50097ec217ce0ebb9b4caa09cd2cd73a
SHA1 8cd3018c4170072464fbcd7cba563df1fc2b884c
SHA512 ac2d02e9bfc2be4c3cb1c2fff41a2dafcb7ce1123998bbf3eb5b4dc6410c308f506451de9564f7f28eb684d8119fb6afe459ab87237df7956f4256892bbab058
SSDEEP 12288:6BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJSH:SmFyjLF847eiWWcoGZVOIxh/WxIAIbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

phones.data

Path C:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131
MD5 cde2424d99db56dd0d1eaf34811738c1
SHA1 cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f
SHA512 d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2
SSDEEP 192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725
MD5 acf4321ac8c8ff4d0442c799d621f8d9
SHA1 b12f87e6afc48697f1ce8b587715361e89b79cae
SHA512 7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde
SSDEEP 192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956
MD5 3c47c25b8141d20b2b4d576000000a61
SHA1 04543f9cdd847ff66389c9fd1e12b444dae6383a
SHA512 c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a
SSDEEP 384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410
MD5 e05ce0232e64328c62c9da37698566bf
SHA1 50c25e6ecec2cd17ecf3117bb9a646ba107d2b84
SHA512 8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb
SSDEEP 192:MmxD3KXWuufhW+sivT16uDBks/nGfe4pBjSfhXa8WebtuVaVWQ42WyMsVqnaj87p:MVXW5hWyvT1Nq0GftpBjSZgkldri
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830
MD5 a26c7ffcf18b62904dab7786de638ea6
SHA1 b28489bc38ee2f522ee83dcf49faeb96f39a77e3
SHA512 768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f
SSDEEP 192:sohaYPvVX8rFTscWuufhWrlFO0ruDBks/nGfe4pBjSb68WebtuVaVWQ4mWst1qnq:JTPvVXiW5hWB80aq0GftpBjQZplBLcQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
MD5 6a55a7e284b51b086b63cc6f2061ce8b
SHA1 46a48a1ccf5262038b71ed4be09cf625009d078d
SHA512 6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363
SSDEEP 192:ByWuufhWrRivT16uDBks/nGfe4pBjSb9bXe8WebtuVaVWQ4mWWrRHqnajjpxf9cS:ByW5hW0vT1Nq0GftpBjSbRZnlHlBLcYl
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
MD5 6e38a6bed88e1c27155e4dc428188ef0
SHA1 8b47a1960ed157f7beeb80fa4a16a723279c4efa
SHA512 3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab
SSDEEP 192:HX6WuufhWr7FO0ruDBks/nGfe4pBjSbnUqs28WebtuVaVWQ4mWOYVqnaj87X/fA2:HX6W5hWX80aq0GftpBj2spZkldrps
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4
MD5 9304209688e2a18d0b26997bc78fda7a
SHA1 5d4332cf1c5123418c6419d0291486c3939e8785
SHA512 5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960
SSDEEP 192:KKWuufhWr2ivT16uDBks/nGfe4pBjSbYA/8WebtuVaVWQ4mW7TqnajPf33PLlYoM:9W5hWHvT1Nq0GftpBj4UZAljZYsqTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll
Size 18KB
SHA256 f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234
MD5 f42a84d78a5a15ff1a4dbac591e95783
SHA1 1cd5b5e68fd729bdd340463b53728634d342b0cd
SHA512 89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0
SSDEEP 192:3liWuufhW3XUxQmLuDBks/nGfe4pBjS7LX28We8WebtuVaVWQ4eWmQQPqnajy3Ss:3liW5hWOQ7q0GftpBjkEZfQQPlGinjqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970
MD5 9f286e57e5b1c1a347adf9eef059ad5d
SHA1 631aa1aa364234acc5ad20b27f926e9cb9ee4276
SHA512 6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197
SSDEEP 192:KWuufhWr3ivT16uDBks/nGfe4pBjSbKUs8WebtuVaVWQ4mWMoTqnajPf33PLlYoS:KW5hWmvT1Nq0GftpBjGzZv4ljZYsqHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141
MD5 beaae8294db31afa04fa60795c6e02ae
SHA1 8a32ebd843e461864747fe0aebf4bbf83c4ec093
SHA512 dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135
SSDEEP 384:rvuBL3BEW5hWh3rq0GftpBjzkZalBLc2V:aBL3Brii2sV
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
MD5 2ac1289e4dbab076b332869bef26d3ce
SHA1 60570ddd06b671e26c6a814b9c08cdfa0ef38aba
SHA512 e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a
SSDEEP 384:ptAuOMw3zdp3bwjGjue9/0jCRrndbAW5hWA80aq0GftpBjV+ZZrmlGinjQKKX:DAuOMwBprwjGjue9/0jCRrndbX4i3qdT
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd
MD5 a2661a468bb87ee9cc5dee968fd3805c
SHA1 9b17fbd552e34888f1453f9113ff4c42efaf6d6a
SHA512 b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3
SSDEEP 192:zQWuufhWrixf/0uDBks/nGfe4pBjSbl7Y88WebtuVaVWQ4mWyymqnajiG7AzTvfJ:zQW5hWS3rq0GftpBj9jZlymlO62vfGkb
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e
MD5 acbfc011d5842ba60c372ba3d222ab70
SHA1 16b8014060a04bb03215f6ce4c118bae48653bd5
SHA512 dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3
SSDEEP 192:1cIWuufhW3bFO0ruDBks/nGfe4pBjS7irpMk8WebtuVaVWQ4eW5eqnajy3Snk0b7:CIW5hWL80aq0GftpBjNUZkelGinjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae
MD5 19d14d348ac38737431a7ee2f82973e6
SHA1 11cd8f5dc5c08d133b9b006da5c84946f012cbb6
SHA512 b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc
SSDEEP 192:AlWuufhWrExQmLuDBks/nGfe4pBjSbYsqwZ+8WebtuVaVWQ4mWXqnajnp+MVQ/Tz:AlW5hWaQ7q0GftpBj5VghZoldBQ7Q8PX
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0
MD5 ea0e13feac13dc18c79eb682bef4676e
SHA1 b9db47624345c68cf07bd2677df537e0f975caf9
SHA512 540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7
SSDEEP 384:ik1JzNcKSIUW5hWP80aq0GftpBjMJZCZslGinjI:9cKSupiEgZ40
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
MD5 1af2a91dc0a4e48bab0ca123073adf30
SHA1 cf6625fd31b17d46dd31b16372840c74026d0ba2
SHA512 45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51
SSDEEP 384:vIDfIenW5hWsvT1Nq0GftpBjeOZLlGinjx:ve2N1vi/l9
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786
MD5 9b9d1949b75df171884f6f8caba7ff59
SHA1 411adf413f53c56488d5cf68e9b4b692889f3c4b
SHA512 dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c
SSDEEP 384:yW5hWgR80aq0GftpBjHLzZgfhlg+ZmJy:dmi1LzWflu
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 18KB
SHA256 eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f
MD5 c6e268c877a9be5b43877308b1231120
SHA1 949105c826dee6a32fe1288285e3e41cb7d04821
SHA512 776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331
SSDEEP 384:HGeVxW5hWEvT1Nq0GftpBjvOZZljZYsqzN:HGeVcF1viJOYnzN
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c
MD5 5122b8aa14a25c8567d9d0335036446f
SHA1 81961f2c8a331136f8156930779964a71e0badc4
SHA512 758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9
SSDEEP 384:1yMvIW5hWER4Zq0GftpBjpTuZV0lO62vfGU:1yMv/L47i7STVHGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b
MD5 e1b30d56617709cf7dff5f464d7566d9
SHA1 e29646b1c90550cb86ed42782c764d41f2c70651
SHA512 e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511
SSDEEP 384:pvdv3V0dfpkXc0vVa/W5hWiR4Zq0GftpBjkYZjsdljZYsqmb:ldv3VqpkXc0vVau547iCY6Onc
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
MD5 e4b64b2710725ec3332021bd8044d884
SHA1 2d7f8d87d0f395296ecdf277084d23cb9e0880e8
SHA512 ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2
SSDEEP 384:stZ3KW5hW4R4Zq0GftpBjsnTZWFlGinj6m:oX47iiTomm
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8
MD5 67fd470a60fe8fb3f9fbe32fa52871d0
SHA1 09aba019a0d0dae7415b6d9a39e1dc67d93f130b
SHA512 f8c3f1e3bee196487aec704f128240acb57fb392db918a97176793b07726f017177abbb5a6c68822fc59ce06f04d489a78284a865efdc2de518f34ecfb0cc1e6
SSDEEP 384:NzgLW5hWgNvT1Nq0GftpBjVIB6RiNZiVlg+ZmJ:NzgKB1viPbRiNUhu
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
MD5 f53ed8a0c18157b9e37500621dfab9ee
SHA1 b8a3131150cfd46052353309843c802d9f43df03
SHA512 2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a
SSDEEP 192:QNWuufhW+IivT16uDBks/nGfe4pBjSfASU8WebtuVaVWQ42WUqnajnp+MVQ/TQF/:4W5hWGvT1Nq0GftpBjhyZdldBQ7Ql
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b
MD5 2b9f551cddd662c618432a75c546b296
SHA1 1ddd65fcc8bb401c734ebc2014d057328f771744
SHA512 54df6e692ac630d969a697c9e6f379c4826ca71b7e8eaefdf502405b1333a6b483256aeba609a4a1c61e73f72d2958aaf3eb31538cc5e7a91101d7d09e3ed9dc
SSDEEP 192:GrWuufhWrvFO0ruDBks/nGfe4pBjSb0rjk8WebtuVaVWQ4mWD0qnajiG7AzTvfGC:GrW5hWz80aq0GftpBjjbZS0lO62vfGC
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89
MD5 7d943f85ff8d1515a02d202ae79453d3
SHA1 94def1f7368172ac50b665e74b89e8f7aae2857b
SHA512 e111dbef97c6c6cb3b5c2d183294620792c48a2cb16d9d91c12cede757a1c0c53d707f4294542bef47eae784893bf63fe0f0229bed4b2d0a961c8d1cc1cf43cb
SSDEEP 192:VyWuufhW+JFO0ruDBks/nGfe4pBjSfG488WebtuVaVWQ42WyWqnqnajjpxf9c9kY:VyW5hWU80aq0GftpBj6ZXlBLcmY
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
MD5 278857b86f667c47cbcce94f5ec73ca8
SHA1 a0f5b7e7c67f3c6b8f285d39d08b740e49445755
SHA512 ebc02d1a2e223eb0b30a8e62089735faed83add4161094493f62561a09c13a426815e7f06c20c44477691109a8c3040dc68527023bfee6d9984c42d6a05208c9
SSDEEP 384:vcJ2yyW5hWGQ7q0GftpBjFZ8UOwlGinjP:vQgiviDcj
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
MD5 6493b21fefae874655c62a56a156f3eb
SHA1 c65beb46f9f03d35867ff008026d3a56fa26fb65
SHA512 93cbe187f7fa86ac58191b5384a993135e3291873a76cc2cf81dd60c68ad7591386e4eb5ab53aaac2a6f48f7f778263b7fa0a4ea0863361910a9f1efee92b64b
SSDEEP 192:45oWuufhW3dxQmLuDBks/nGfe4pBjS7Ji8WebtuVaVWQ4eWbj8qnajy3Snk0T:4GW5hW/Q7q0GftpBjmZ08lGinjT
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
MD5 ae83311041ee793253ff10736317a09e
SHA1 c62d06cb6cbd9d997c42a6ad7f13c06f38725069
SHA512 0fabcb0370330460f8f525401f339535c08d768f075816989a16eff2256584cfa8fd6832df3ce3d9c2a5364b4ef58bfff53cc486e3b48d11b654f7174aa18458
SSDEEP 384:gTnWm5CoW5hWSvT1Nq0GftpBjMkZaA0l3uzJ:gTnWm5Cfz1vijj/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
MD5 12311308d7d65895b3920b3dd3e54b3b
SHA1 3faa74c6913f451d9c575761630b507af0c15ee3
SHA512 67fd047e760dbdadb06cc2c34b935fdabc629fa988484a9f5120cd59d6167d943b612df65626701022b5e73c5b1177a8d813e90c5990468f51a5a11932c008ed
SSDEEP 192:QwY17aFBR7WuufhWrtQR4+uDBks/nGfe4pBjSb0NW8WebtuVaVWQ4mWMUVqnaj8F:QpWW5hWyR4Zq0GftpBjhNJZYldr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
MD5 3dafcf25a2ac1becf40acbec8fc7134b
SHA1 0729fdc617403622c2edd77fdb7dd49b530e2037
SHA512 9dbb487489c8a6af8dbd6326fe4958f489552af268f2937495ada35bb8404cfaeaf54833d8bba2966e72cd0ba3284a5fd167baf4cd6d905870f5d1ed3e5ff6c0
SSDEEP 192:QPqWuufhWrHxQmLuDBks/nGfe4pBjSbZjk8WebtuVaVWQ4mWK8MVqnaj87X/fACD:rW5hWdQ7q0GftpBjWjbZZldr63
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-math-l1-1-0.dll
Size 27KB
SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
MD5 f32bd567d35d2e85504c39dede609e72
SHA1 b7a7145956466e45bbe6f7fe41e935a152c2c325
SHA512 55396f3e5821d3f3eb5988bd3362a0cddf036de4afa8cc1214813834b5a152fc3df787a8347a7aff3de6bf112e1d2a354790f593854a59f1f49393ddf967d085
SSDEEP 384:77FRU8HM4Oe59Ckb1hgmLydW5hWjQ7q0GftpBjASZLN8ldBQ7Qa:77TjMq59Bb1jyYPiyS8Q/
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc
MD5 56c02fabc2c64174009c905570c3a22d
SHA1 e52154112ad127ab01937453490091def4d21ad2
SHA512 9f22f70b5de4078fcbfdbb186d6cf220561200092eb7ceaaad9d44a5281f84abfb1729f4e447dab3753225d5fc6c44d94363e3729e5765dd2213213c327c4c1b
SSDEEP 384:YbmLPmIHJI6/CpG3t2G3t4odXLBdW5hWYR4Zq0GftpBj2q8ZWlGinjge:PPmIHJI6PY/47iok1
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-private-l1-1-0.dll
Size 69KB
SHA256 c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac
MD5 4b27cf5cdb20aebf113df752019ffca3
SHA1 b02c6e45f704dac118f81c324122c189e3e61e17
SHA512 cd4df2478d719e159e2252e6784d24e4260c13d8f47774ac33a8e10b1fa96d38236bf2c3ebc060a5801fc19392cbe5c636befa898721bf114956c2be6476bbd1
SSDEEP 1536:ccXDvBRh1De5c4bFe2JyhcvxXWpD7d3334BkZn+PAc5ed:cczDh1De5c4bFe2JyhcvxXWpD7d3334+
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8
MD5 fa677cfb18ba1370d8bb98681c48cfbd
SHA1 cbccd561bf53c59254fb04ab136996b81cc80d3a
SHA512 9312acd4955d4950d851910198d4ee622b75e11262e409c79391078d12d2d0db320723a1552048acc0e9deb30378e3cd27d4fabcf2077d429eedfb275cdb73e3
SSDEEP 384:BpOSA1W5hWk80aq0GftpBjy11Z+lTMs6WbL9J:vlkiM+TFJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
MD5 595a997bd415c8ae0ef1e3c3b73e6091
SHA1 10f34bc2f474a43bfaac26f66ec8081106c12253
SHA512 944f6bc405c69d6bf6dc97652e9f296658bd3de078dda50ac680e56818c00dfee909b100fc2fa9c6a891c55dbc66dd62ac52819950732c83198dbb8c04f3c9b8
SSDEEP 384:ETr7ZW5hWgvT1Nq0GftpBjqZaljZYsqn3:2r7Ep1viwLn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
MD5 415d765aa267382a79e56e428c80b1e1
SHA1 1bf13460b8aaac1538bf45186a1624825bb8c355
SHA512 7236ef7b2937718409ef4eeda20318b1697e7c1c868d0df263f4be8673365d48ff6ffa2317bfd1881b6cb3dd1300410ad4f715b8e01ed321c4011aac88490d21
SSDEEP 384:xHCFVh/W5hWOQ7q0GftpBjDdZNil78oStBdo6:xHCwgiT7Aa3db
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
MD5 5bd5a9001cb0555c5b2b14e0cbc8d922
SHA1 4562d23fba312fe95cbc777fd7c2e37ca1e76ad9
SHA512 a6271f28f069a00c2912f80552bd54bf0d8461886adff626b336d25943dd0ade19eb88c718602017a1986317af3eb5f94f8896e88b9367207e8b53225322cb84
SSDEEP 768:Yl5yguNvZ5VQgx3SbwA71IkFMLirA8Fma3dnL:Yl5yguNvZ5VQgx3SbwA71IvL2maNnL
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
MD5 f719ad4c04043f55a21e73805997b287
SHA1 0e88b1271b242f7933e78edcb05131612cea061e
SHA512 752b9b4385162126729c3f09b3b75d7121c8dec00cce11f7cf1ecaffed3e79addcbcfe8bdd4e20e15b8494bfe2d24c3f2d11583860b1e03be021196bc83fc3bf
SSDEEP 192:N3LD3WuufhWrzGxf/0uDBks/nGfe4pBjSbA097b8WebtuVaVWQ4mWmVeqnajiPNg:N3W5hWq3rq0GftpBjr0974ZVelg+ZmJ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
MD5 a405399d5b958a03e6054307a631553a
SHA1 dba43f0afd8c6e1f61cf0be7503c6f70b48b8240
SHA512 33c64766053058fa9fa4fe689f1ca5a345b8b70443995d71aa65b64c7bb38d4dc3a2b37ad06a4ce5ca1c927ed9ea4377443eaaecc69b0e758ff265e755194287
SSDEEP 384:IbNfmW5hWBTMq0GftpBjZtwZkilTMs6Wba:WfBYuieGQTe
MD5 SHA1 SHA512 SSDEEP

Submit Download

concrt140.dll

Path C:\LDPlayer\LDPlayer9\vbox64\concrt140.dll
Size 310KB
SHA256 01729ff33c2e3db1033fb86e899d62026dc1c03705269bb9636227f61934d9b3
MD5 67a3ad0fec3eb767e423e3d7a9134343
SHA1 42949506bc8451031425840df33f3acab5637b52
SHA512 f3b13d38f44acf37c5002f08b684cb2955b778c8a703c8fca6e07eecaac45e1bf4bb036dda055114152390322351ef936492abbf6532d1a48fcfd29304b4db1b
SSDEEP 6144:ZEI93zcNn3dMiBXHxHSSXfPnevwbbeVuX0cp90nWzgQQf3PzX:WIlwNqihUSPP2uzK
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\vbox64\crashreport.dll
Size 51KB
SHA256 704043e22b79e871898c9804b2bb2a1d95c7d7a59df6c535ef9da69dacafdd6a
MD5 ebcb67dc148b5b25ab6d306b20cc1df4
SHA1 10e5b3673201828e2f847637d6e8ee52287da724
SHA512 473c81c2a0f4b234ef13873d1cdc40c1bcef6424886b645088168387a55d617f12438ef8842c8bbfe181df33b8f980f342c0a92dde87e1cfc6e190a1c8b7e98d
SSDEEP 768:gNYs6LsazaYID9XICSszm36nVl8xzez40YiDLk5wkFQ8RYiXkFQM5ALR:wOQQaYIRzjVl8xqzf75k7Z5
MD5 SHA1 SHA512 SSDEEP

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 640B
SHA256 8355661fb390c40ceba7cac344ea275c75b52984975466789848a4eea93bb372
MD5 f9a5cbc019089113e61ba11892947aad
SHA1 99936ea3ac22af2f3c642edb39127c64c7749c2e
SHA512 fe8aa32fd15ffb69c35e98400eb3ab938b9bc0d706a65b3580f209f22557572f3774a9c74ab74765f31541d4922de3f72e48a21d91a58d6215071f7dc1a77878
MD5 SHA1 SHA512

Submit Download

sdcard.vmdk

Path C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk
Size 35.1MB
SHA256 df93a91e4fbc59c2ca6df44ee52ee1b9d58c1676d70f390290e19380c246e29c
MD5 1d568ef3454d99e033b081bf9b0a3ad7
SHA1 71b7dca7b00a539ff527a6e3b6513c2170c78ea3
SHA512 8674f30dc3131a3ea2b3869575a3ec16c49e46678f13f43d6a5f1c2ee2568831663df9b341eab77c23d35bb3d4fbf967cbe844058369327f3fe6f1155d521b8c
SSDEEP 768:ouFkkI3gnG30jnzln5pxn7en1njvfVnNnXnLA0Y3bb/qWE6I0eYyU:5IgGCzlt7e1T9NXLQX/qWE6I0eYyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdcard.vmdk

Path C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk
Size 35.1MB
SHA256 f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6
MD5 4d592fd525e977bf3d832cdb1482faa0
SHA1 131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef
SHA512 afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77
SSDEEP 768:oUakI3gnG30jnzln5pxn7en1njvfVnNnXnLA0Y3bb/qWE6I0eYyU:RIgGCzlt7e1T9NXLQX/qWE6I0eYyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Roboto-Regular.otf

Path C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

pathconfig.ini

Path C:\LDPlayer\ldmutiplayer\pathconfig.ini
Size 54B
SHA256 673dd49dd896049f7213620a0fa5618283957360345122af8ca3f83eb815e37a
MD5 78c0d9004aa344baaa47551c130abc59
SHA1 34d45151ca26a8f1dca6b39757dab5338a2b0991
SHA512 48d9094f6442466cdfa9dfe4b7e5c7225af99a268903d005ed20a4f825a2c02cce86be896b964f0a5411d32c460d705beb1a0d82dd66f6991e37ddfc2eda20ab
MD5 SHA1 SHA512

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 3e0b3dd314f86ec317787a16c0da19a906a2a3a0963fd81819bc34139721a161
MD5 24d2771987af806ebbea04dc3093a4be
SHA1 b6600d424bf36497c604476f6a64367b64fba6aa
SHA512 01e1342c4868736713c625c96213ef5f04be578cdf3f39a02b8a81258a063d617c08ef445d4c64e24a1d765f41d48bf318f261465428f5734458ebf99d6afd41
MD5 SHA1 SHA512

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\988B237EEF5919FAB97ED3A790613BA6
Size 471B
SHA256 b3338e225650bef80839b76f466cb58ba8ab30acd9f83dae3b0ae41eff219067
MD5 0449e665cc38d7e4830a00f89848990f
SHA1 73a75e3821e1cefa92a0e9ee1442f6dea11c60bb
SHA512 3db3232757ded1147f9fecd8586c770738fd63bd67e9b7a83ae92633902d647d3b8f998116d2fc3687a2d18fd43b5ca9f56b4690e4ee8b993d36f4ff95c51554
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 471B
SHA256 98d47db7507a4e7cbbe13a730b5bfc27561ce9c515108431e404b4859ca18d7b
MD5 6e14f0ec702f11f0875d5c661018cdb5
SHA1 d3d47d949db0c11a72645f0a081d619dcd6bb6bc
SHA512 bdb628753cbdab5a7de94bb6274bb162ea69cfb373f3b7e0b166a0f6aa1513c6a3fc6c21c551b9136e32ca7c86eb443c37f70b848ab869e9460ba4400ad5716e
MD5 SHA1 SHA512

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 ae9d6adda9e6c2253a19aeaf4199666d4c764779d8314073c874180e9652aff0
MD5 5aa9a5c7ccac3e950f20af83cf35eefd
SHA1 8143af6b241130f6a364c73f8c5dbf6efd8dc1d3
SHA512 d74418578a62fa704e6c38569e969ea1fa96508299439e67730434c38f3d1484f4ad94a27d54fdbf6e0c3f7007526dbae629bbb2f2b877eadaef7fe43fa2b0b6
MD5 SHA1 SHA512

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\988B237EEF5919FAB97ED3A790613BA6
Size 408B
SHA256 2bc128c2a96e34784b1b13748532d9cea344b538d22629e7add032a8fea3f518
MD5 28e9d864c3c09fffe09f99e3160a8782
SHA1 ef3dfa073c495dc565260e59eb5cd545befdc485
SHA512 10f7ccbc74be7a770c6e4d230f61f6b13b40d4bbfb5589af631803af90e13cd125f502610803638a29d056d2190aad5563bb6716a52f51ef7ed11a9fce30f4e9
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 416B
SHA256 2e01c415d8c0f5194d75c66e72c9083b28b57e99099096fd293bac3afa303c90
MD5 3b13ee59f20da65d6c13deedf4f46a25
SHA1 535ed8a18bd79e48e98f8048af0126968825e613
SHA512 c6513e74e60c7676a933cf3638540306e09afc45e27215fb2ac753825c7237ab7c32c2c39ab971a17c0b5e012f039b75ed49bd78ba7fe7b34c3766163c90f0bd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69a991399b71582e075c6ba2a9714fea74f3dda60730c567446122084ab79605
MD5 3517158d2c79b2407b9ce1b218e54a20
SHA1 ff3b05f6e75bc4891c8d4e45149e034ad7e15551
SHA512 df646901ccca0f5ea9a48f1fed6e810db39ae857d768c4aca785595783c14a016ec6a5d0edf6b93b44e22472ff170bc976a50ce373773d53d5bd9c900836a9cb
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c5009aee6441ccfe7d1ef91599586c4f42f1059a2c107401c5970cf5a023ca61
MD5 43c234508292f5762509f168e92d8782
SHA1 8302d85266b0f5774b849d0227781cf9145dc1df
SHA512 5a87dad755f5bd4bc8f6a2a940f68fee5dc0e6b68a4a8f9b4977d58190763c9f091531cca96b8aab926f6fd847e22e1c73b95b8cbd3977db82cadda5e2b5d70a
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 21e2bca63defa490cdddff3bb30468773b01fc3ac801c5c2a9971d248fb6a3cf
MD5 ab8612f649fcfa1ddfa2e69f3b73700f
SHA1 16fdffde4658cb577aa4bf5bae887020ff012c82
SHA512 5fefda304a2d4400fe03f0b5e147501467ab3149b1bf0c88a36c6e36615c6a547ab0f61b5133eae10d546f80c52f6dd59f07e4220f7df795a9785b47a6a92b4e
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c89be2e31440fce57abdfeb2e57157f450536385b84a74d21c47a665da5aab44
MD5 385a1b8eaec753acff1f52e8f5f29a65
SHA1 c753e7c93e6d86206302b93fe05b9b33ada6880b
SHA512 1bdf181bc5315fd7fca228f12f658753aac26870279513ad722ee9d68f7c5b3bb365a44c873fbdc6268e85b0ded5bd64b0612525931e7e7acd985a25bb5200a4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 19224ca09e059841106215bd8ac83826b9e5fb6e2d840ad27af43e1e8b18e032
MD5 76ad994a385a9221e298b2a4285a685d
SHA1 79cf8d0ea59350efc9a9293b634e6a96b244957e
SHA512 515b376ef9b794ab0438fcee64d4c0487c9dc492bb8b34a40448d2b37d8ee6b300de902977f19a3707bd0b7670e1ead7771c7cae22eb32ec0e45969ba154641f
SSDEEP 48:JVkwcBh91oxvY7e2aKbCYAvTb0ScX4mtPbt3kUCwGIt4YN65QmNhubwrVk/wV+QU:PUz1H7pxCYs3w4m0Ab2GmweMDwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 27f3df6263e73617d161764a5b8041ab75e4f41c1d91b6cc8a3055a9cf1791b9
MD5 f67f84b2831fe57fb9f1cda330f14629
SHA1 7172eb2afc415ca64ff28f4f73fb7e62e5b9e7a8
SHA512 35d2d0f5eb1e9fbef3dd6d112c1662e1f158a4815c18f8d8008de9e35577547e0ffee4a804677e62fae4eba00c480eeb0551ecf8c7a93b3e97d82ec4a7a8b846
SSDEEP 96:cqxFAjWg3y17Viz/l2RjpCYEl+mm1kbZmRGWH9l:cq3we7Vad2RNEH1WH9l
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe5a83e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a83e7.TMP
Size 3KB
SHA256 7bdd4e9fafe4627154165f39afe796e467c22c1ea40065a700087a6b3f06a89d
MD5 9cc0064764e1d52621c33617323bb568
SHA1 e29e78d1fe84deda83ea70b05a93c0230caa37be
SHA512 0fef14f2dbb2ae430db5a0a12c0c4b17b8d6f12b5022ec31c787ce98af0923e1a313bbdff32cb2f6c9802e7254e32afa7a2a95c50cf73546ab4b7848c1140c07
MD5 SHA1 SHA512

Submit Download

6821dfaf-d602-4ba4-bb8e-1f7df4fd9e88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6821dfaf-d602-4ba4-bb8e-1f7df4fd9e88.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 88f62b131c1bbeab041579ce8a2b15efe800e9d7c37374676c43e3802da6cf5d
MD5 c63b9587d4deccb41974da4cff4a49c1
SHA1 f455fcaf436165490e1d12cc879bfdc68c5bf6a2
SHA512 8cd44c2138284a73fd4f098f1f6e465284826d6b34ab9481342be0c55257a6fb194d2847a7b72dd751714bfe964bf40e61404bdd2e55fc66594257736df41843
SSDEEP 96:DdzufUb0uj6xr0BZqaYO8vx95kWh4YfFrBLxYh/hohjxkofl:Ddzucb0uj6xEBt8Z95kW6Yt9LxYhmjR9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 999085575ffffdb6b86abcb35ce4071926aaeea1bc21bdb27690ffc54a0d6829
MD5 5e2d30d42c6ea43ee2eaf3cb41bcf578
SHA1 9599a9dc3a867e41bc875ce023889dc82e7fe0ee
SHA512 f5123cd4814d5354a19cc163ca910372e58fba52b1b8f442201af0c41d3e55fb753158555e3368dab06af6b8f0e0b9463da0aca085687559e9fcfb87f8862506
SSDEEP 96:DIufUb0uj6xr0BIrB5yfF5mLZqaYO8vf2qkznhDhwhIhfel:DIucb0uj6xEI95yt5mLBt8X2qKnRiCy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 6cfe162959e219a43af3dd9c77ff256913d746c32d5a9746fac3bea9b8b0d896
MD5 0866b965fe2a61c38f523b4ee227179c
SHA1 c8d4fcb79d1c71482dd68a4077d242bf07d9b0e1
SHA512 0927cfa0ce35b765efa8d96a80caf466a905fdc681a72623841ed78547c5c1fc577a16ad9b8cc8ae070e016e36d9b37a13a6c8a82afb9d66ef4f4e74082fa767
SSDEEP 96:DIufUb0uj6xr0BZqaYO8vTkz95kWh4YfFrBLHwhfMhhiAhLl:DIucb0uj6xEBt87K95kW6Yt9LHwGhAAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 5255a15efbe2aa80f0c1c068ec3a300ed045d58d22b006c5c33b40d4f33c0613
MD5 25ec8987e481f715ffd41e80789e4bec
SHA1 43c3337dadead16fb9912436acec069c22e191f6
SHA512 7ab398fe589ab45844acb0c7ceda52c97f18c67d5c0c089c76e824bcce43535e1afb84c229417cdd491a77b088031bc91cb55b39b47932a20824789fb0575409
SSDEEP 96:DIufUb0uj6xr0BZqaYO8vx95kWh4YfFrBLHYh/hohjxk8IcU:DIucb0uj6xEBt8Z95kW6Yt9LHYhmjxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 411KB
SHA256 fe33d588b493b900c3a4fdd741558a4c8a1f4cdb59920439ad1213c12f135b62
MD5 1d93b13963ada1998a0a0c45b0a70641
SHA1 658d7b48fbf00514850c129b82d7274b2449b725
SHA512 543e453063f399a4eb95e5984ed692f5188d1e1699fbe75ae30b13d5b3530ee4a6508c9c2539695be40022a9d2f80a0e50bd11c66eb144e0eb24cb10037b24fe
SSDEEP 12288:My1lqz0wnRVhHwXR5/nDlbQnsBWrZVxgAUS:My1lqoELhQB5/VBWVVSA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 411KB
SHA256 1559ad22dacdd8ccae8f7eedf900d5dca50463c25419b7e7775ac0a3110faea6
MD5 058eb27050ed772ee65c74342a3c50fe
SHA1 0d68debb0461cb4e4cdf5f23c2872e7207387c90
SHA512 f4a1f6cd11d78c6a903592a43e6bf29af4e599980ccd43729f1e3f490306bbbee307eb2afaa87a9bf6b98547e129928e063283e00eb53fdfa2b535e8e796f3a3
SSDEEP 12288:Mo1lqz0wnRVhHwXR5/nDlbQnsBWrZVxgAUw:Mo1lqoELhQB5/VBWVVSA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 411KB
SHA256 e3f60f2ecd728f16aa9ae53cd9499fee8966bf3d523331a3e076644aba2c8583
MD5 7787052f158e19b1e43e0586ddda8717
SHA1 f4dc31a3bdfb2a5eddf429b5d226a01bf070967a
SHA512 fc4cea29371a324ad3d449c9240446e31f2a7ec29a69bc475bd6abf1b6732bc410fb3e01ac2c2e03fd8b84d057ee894080caa13e6fce3f4e0da93e203ad379b1
SSDEEP 12288:MH1lqz0wnRVhHwXR5/nDlbQnsBWrZVxgAUu:MH1lqoELhQB5/VBWVVSAt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 e89db2587220359482d3472f9a31d85dbd15f2ad95d283c4d576c441fd06390c
MD5 81f40b16dd357502b9568b5e132c99d5
SHA1 916ad3b5a720650debc7c4dae871f8e0354818e5
SHA512 9a0e9e6f879041dab95532af660ccb50ae1b138fbc1cfc1c23fca71e0d83fd61adafebf68f6d1b44ff7e672cc37cd326f9001bb2e49547cc91a1841db75f9ad0
SSDEEP 768:59iHO8lW2Md7pLuLljhWRWFvQkM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV32mrnLl+:59iHO8lW2MLEljhWRWFvQkMu1jaK2mrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4e77dd67-ba9e-496e-9d96-d4cf3ae12c75\index-dir\the-real-index
Size 2KB
SHA256 b2e083cdabfd5b1ec233fa0daf707958a7d7ed13688de34d2b0e02618c63e02c
MD5 cedfa7af47cecdb836bbc82b4060f9ff
SHA1 1aec02fc1061ec6dbdb610daeddd0aea4bfe282a
SHA512 74a57d145c332be2f2193d120dbde21b82a5cdc19256e2980fd4196e09bdfa24ee418ff48a95629cde21d4cb34af5948778d17a21133cb2a87441aa5645e60f0
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5eb6cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4e77dd67-ba9e-496e-9d96-d4cf3ae12c75\index-dir\the-real-index~RFe5eb6cb.TMP
Size 2KB
SHA256 34c96473112dc600b39127f119a9a02b1571249f2a20926b8be58b39c62cd135
MD5 9afac6ffe2b5d9894d9180411a64c5e0
SHA1 f330e209a96cd65377bb6fefba37b2a4947f2a8d
SHA512 c501b5c2f557e66d09feed788e80a6f414af31be5ade5a22e7940096a3c3ac6b75323b180a318344f5326ca590937adb399ab2cb0525929cad2aab5e762a8ddb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 253B
SHA256 f7ca75f06ebf6378b1f8d3192ccd5a08cb6ef173ba0d629a2fd854f68677654d
MD5 0f618ef3e9e693c6c01bf05073cae00d
SHA1 1363924512db867b89f44f8b0bf6772aef702650
SHA512 563f49e2f3c8907163aca0bf4ca1cebdc6d8442d7e90d0aca4f2e65f7d52571252bfbac95e5ea2b42b487cc09bf101a409631488beffc1bab7d2e35d9a7dbfa3
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 1db09bb92ca31b7ab678199c7b0ec0f47900383eacc3f2bb5b28d6f620e0d5d6
MD5 1e6681cd0b34f19d7dc795745f7d8332
SHA1 0a24cb28998eb93e4a3f848502183b9cef44b73e
SHA512 402b1273b952c0bc6fc7754effbe5fe712e80dcd28c3cc4ca9ee3dde5a6f4297ff702b0570e6bb1333c929aece24cf598fe6d8e3f40c30542a0533c4b767cc18
SSDEEP 96:fB4dRXrngLDmdJgKRrfJW/Kht6rKrAKhmQKcIKJKjKjGKp8H4jH9lluXVG3nuK10:ixfb8H4jH9ll6VG3nHJ5nepOc1Kk6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 f6c97410b1d6693e6c8f253c215ecaee81ca707122acab2f86f3187e6e7cfd75
MD5 dd543187452efeeac6f9aa0d921ed457
SHA1 67b318822424e2604baf7fcda80ed5c62409811a
SHA512 2623ec5797d4f79f80b702c04b441016c7dde3f721cdab89f392100637738e419ffdfa550431cb4c8e304d506b1b9df3412f9463018a6b5b0ca58200c50ed8d4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 3b830d74d3a34aa47f3e0cd93082231b0ef9a04a3a86f166480188b6fe1e45cb
MD5 317ecc58779b0991f5495fa1038b565e
SHA1 8fa7a7e7b805ae200cd75bd765a5c232d7021e16
SHA512 52bc189fbfac400b634274b069dd229b814339be29115346d69bdcefc3283f64cef85a653ee0eeca954012bb92f60dbb09015f494713d43eb89dcb93a9407b47
SSDEEP 768:FFoBLv7I5wCPFdV6Ziy/CgERo8fByx0zHs3HIKeGFt8ohWg8Gz/xj4ocgh:0JUV6ZX7WI3egt82WexjWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 81cbb385fe866bb42c887ea23ff00fad3c562d09efb3484df8505e1d60379cc5
MD5 1d1a09c2e09a8defe865a837917c89d9
SHA1 d68583577870879c943d9d102dafed45133250cb
SHA512 09317eb5b61e83808d76b8442f3643a231ad47fca004771a7ba1b74726390ec6d765ccb45a949245e4a6173a1576c82e6d732e4ffda93a9bb6040dec56b9078e
SSDEEP 768:XCF5BLv7I5wCPFdV6Zi63UCgXMK8fByx0zHIF3vjuREGlocBj8:XSJUV6ZL3WhWGfjqEGvBj8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 e87a689e244fa98141b8a244bff6025613dba6e23dfa296263bb4f42de80730c
MD5 cfa1eb46fe8df46d77fa336a53754a90
SHA1 d4f52e03c58c75345d2280d6a1eb6182f486802d
SHA512 155cd0611d6ba6813ff565b11668473f8965ea491306d6704e4fa38663a0a796b57180adc3c4ec74566f0dbd5a8574f42bfcd1f68faca30f211244b2b34388c9
SSDEEP 768:FFaBLv7I5wCPFdV6ZiyX4CgmRoZfByM0zHs3HIKeGFt8ohWg8Gz/xj4ocgh:uJUV6ZXXLTI3egt82WexjWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f71dcbcf22936f12e743f48333db1b003af64d6427824568b13037e72a73cc2c
MD5 870b07dbab18e3fa60dbec61b07673c0
SHA1 15e20d38bb59d11fb5916b9b124e344950f4cf3e
SHA512 d94f6c8e36c50de3e09d71c2386c9b3bf369f9fe8c84cc1a4d262d6ec6cd5d901249493fb6062e93a84ec2e6c527631057f76099eaa224c2f0d2570a717a623b
SSDEEP 768:rCF5BLv7I5wCPFdV6ZiY3/CgsG8fByx0zHs3HIK2Ft8ohWg8Gz/xj4ocgh:rSJUV6ZV3bWI3Qt82WexjWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f0fa8b5107de62ecfe0aac728e81387ccf25f7d3ce38c36fabd12260d50d3ea7
MD5 499566e5f15198f158a2b13e4553837f
SHA1 08620b48de331f6855a19fb5988647acead3b470
SHA512 a0ebbef9acea79e3fba4f885bcd32d2d6fcf0caebe6483ad9df5e45c23d3b64cefe21558fd3569f868088d6a8f1d6e3e802accbc9955c77248e523d5fdf6d072
SSDEEP 768:rCFoBLv7I5wCPFdV6Zi8/CgzRo8fByx0zHs3HIK2Ft8ohWg8Gz/xj4ocgh:rBJUV6ZPAWI3Qt82WexjWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\28.0.0.1\crs.pb
Size 251KB
SHA256 576d77d3085ff9156298e60dee868364cabab7911edf6f9a4d3ad5f351d5059f
MD5 3ef7a7be0ecfef355a5d5d6e77ebddfd
SHA1 5c6e47340a710019b97b1fd58624f714420b79f1
SHA512 812f5a4e1f572b7a012add71bc210281fd362f48ba5a863b2e5a7d7b6405dd08632dc39ce650a0d032f926d1e41acd8f1c84d5b60552ad9ac98ad6d2abb7f265
SSDEEP 6144:q6ik4li77VpRldVW+J2i/P66k8LyST+uUX:q6XnVpRN2GZQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\28.0.0.1\ct_config.pb
Size 12KB
SHA256 b42799f862739fed511f2527d4796690e23014ecdc02489074df4c44c60f272d
MD5 b83d9c00b73ffd5b6945370fee4bdb26
SHA1 dc5e7ab71b439abe18cde2c4309ef4452220d0de
SHA512 fff0baa29fcb0253be4f916dd6fde7efdf6b20c49c851e4ff6a027b055a7a48a8dbb74827d55b525c3b1e7e53e27f84e2563f8cb5b7092911d651f4cdbb967ba
SSDEEP 384:UtJEmWpvtJvzm9DQyvgd2VtsiEXMhszncjKik6/1zNA8ATkLDJCj:UvLdyMhszeKizAJTkLDkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\28.0.0.1\kp_pinslist.pb
Size 11KB
SHA256 1b9ee7a3aec303937fd884335b23591b55e0d5901d1ee25aa25800d1c202a24b
MD5 269f13e71015d2f9da1fc0e0e22b27c7
SHA1 67b35f4044517ec8b169d27d354a61e2f095895a
SHA512 039d3f870a4475ded4f972891059a4ebc467588f349d0310e47c9c975c793fbfe4179dc64f5c2616914aa97bcd5e83d6333f5de113f5c56c2fc3f2b7bb012dec
SSDEEP 192:xTZvK5yka1IDCrBngQ5jlMUfFwnIl3+Lm:xTpK5yEDCBngQ5jlMUfFwnIlOLm
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.10.20.1\typosquatting_list.pb
Size 1.4MB
SHA256 841219ed4ef0e1dbd795b1bc22083d1dea5450d7e112c4747d4d385f9cd6af45
MD5 1583211ebf2bada800eb5d43841c8682
SHA1 07479c1e5e2e9767a248dd6cb0bc5a62650c98ed
SHA512 84f46e216c0a49cec424f0f41b50164e1bf18191bc3e0e91a6ac72e7ae9b13f28560a0f0a09ace97eeb1e011bcd9f29839a3d4b1617d94ff62006686f0d62771
SSDEEP 6144:tzLwwTLJFozOgLRIWDGXjR0bon9Ixu82+n3UjlDwa8F+ADqtwl8CL/LsjeLXgJGz:RLw+JFoVR9GA3u82otXnCGI+Kik2OO
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_mijfswst.hjr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mijfswst.hjr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e12b340a9a79bc946f9009bce0c5500393821e3b496b49b502d360471e0e759e
MD5 33d27fa1d74978c6ac274015a063cb57
SHA1 2303f3afe6496ac08deb3caadecd45c231a26312
SHA512 bc64d3a4fd2ccbcd77c8ac99f7b180b65687e7b9f8d2d0f4edb6c7df503bddfdd66ea8ed13bfeac5bcec9035040913109e623dd80c6e37934d12b7b4e08606a2
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5b1624.TMP

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\Code Cache\js\index-dir\the-real-index~RFe5b1624.TMP
Size 48B
SHA256 6a7f45f507c8ae0d49e85a27f0a5feb20deae0427a542e98552ce99c590e9bd6
MD5 1cd380eb40423b9056435afe6110bf11
SHA1 3d6373c84cfa3d305150b2986e8b687a61ebbe53
SHA512 8c02a7ab90fff5ade9cec0a504b8e156e1feb9673b45f81f67279b8a49888f17dcc4e6ce69dffedbae392dce8601afbcbcd0608dd1dcda85c242d2dff5b31fdb
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\Network Persistent State
Size 2KB
SHA256 6ff5b6d931eb5f2c3d83e3145fdfceb4e5b06da91850c00762d0414341e047e1
MD5 d1b6be5bcb898ab528b32d8d298507d7
SHA1 4bfc2e7dd05ae1b29439ad99af77532185f1c7f0
SHA512 43537340303fb444bb0cd5e8d46c85b7d291d3b77a4e5769beea8c6ddbc3e970a50a73149ee94504d7dca3e13da6235765ad6cd4bed16db12041a89327687dd6
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe5bd87a.TMP

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\Network Persistent State~RFe5bd87a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\TransportSecurity
Size 1KB
SHA256 7cf7e3fbf2391dc1b7f4a19486ccb6035aa082434535e37a68df5aebe8c1e74f
MD5 414920ec680c21f88e5983f6f69d1fff
SHA1 93e3be73f240ace9583c050dddee8454c99ede54
SHA512 7f6b9b19042c929bfcb24d93ca502340896649169f082b6efa61a2ae37f1e07e54e52bcc313b9b1e5cf6b94feba3a63b0c6a530050ee05f48ca8fbb52e92a7cd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\TransportSecurity
Size 1KB
SHA256 d6b87b1771d1be7264d17b1c9e61dcf8c71a0d3151fdc466e35fbed802f4c66e
MD5 ab85c3fb5abbd99fc34b50a4e5505e04
SHA1 28ec8aba325fa1c96bdbcbe05e78893f8981bbb3
SHA512 4c92e2823b971f9e9805731bca32e3f435ac0afad980f25ffbdc30a46fd0f6a683a5b7cdf475e262525867e379aee061173907495060f8ac08eed0c829e0a2aa
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5b6b0b.TMP

Path C:\Users\Admin\AppData\Roaming\Easyfun\Cache\TransportSecurity~RFe5b6b0b.TMP
Size 1KB
SHA256 c1dbd20ec660168d0f499a567c03ce5ae8b2cfdfae953510dbc7bb628339cde7
MD5 1ce516f08cf06639ee6b761888df0625
SHA1 a381bbfb94b3f633548823a13107cd0047b5a83f
SHA512 d3d1809fb71780fac065ab63e548041b25bac47169dee8a2e9aaae074e07d4a5c118642895eee9ec050b6f14223a0d038a9b59f69d4d45ac1facff606a68ec4a
MD5 SHA1 SHA512

Submit Download

ldopengl32x.dll

Path C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll
Size 130KB
SHA256 7868a3d11cb7a8ec3101f7675abee28dca1207d0069039609345164ed1065ff0
MD5 abf2f73feefd03351890926d60f51a16
SHA1 e86a58902be40ae2ad4c53a80e825398018d2f65
SHA512 9c72375ddd1db82a4fc64f2871253fb0d82819c22162d182445144ab700abbc4eba11c98a596087ee3de4419612f3b050fac69caaae8c60f87e9a0173e2709c5
SSDEEP 3072:scf2yOpzCSA1h0KYKL6tzFgVTx0Z/S/Su+LI1xlfo:t2of7HSRgB+Za/SdLILi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Easyfun_en_50000_ld.exe.crdownload

Path C:\Users\Admin\Downloads\Easyfun_en_50000_ld.exe.crdownload
Size 11.5MB
SHA256 07b2cdbbde122604bf21e8fad13628c28ac207ea1009e58286e2e72ea573fe3b
MD5 69d24b0a24365ecff5dd09ca1213534c
SHA1 e170b17cdc932e7d2861f2afa71c3e615d03bbde
SHA512 7fe80089d9d1a44e6a6a72332c5a9e14b649622177a1188a6a0a9f46d7d2574265e4cc0587b8dd198932f61c9990cccc9692cf78f71477b5edc417cbff9e8a19
SSDEEP 196608:z2dcrckYykWXj2x6rrZ31gabsPHuQpTaNWdzq0+LjywhIzuwEIkV3lIuQ3gj:idcRYyFXj2w5311sHznZc+TEI4gw
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_223382311\manifest.json
Size 1003B
SHA256 005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0
MD5 578c9dbc62724b9d481ec9484a347b37
SHA1 a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d
SHA512 2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_229453050\manifest.json
Size 119B
SHA256 934c260823e8c847c01e1538d8fd2d9c1a7847ba8841bb1ab06446b90ca63d15
MD5 39212f2a4bec3c215f4036bdb57fe085
SHA1 d8b7eb2d631cefa47b2bdf5cd3f695540bcdc94c
SHA512 3c6025e38899f7de668b94fcd15751909e9eaa6647c0894353f32ac9d98ccb5ba6c0b8adf89487333836d707502e62c9bad2821e74aa9f3ff8cbaca47b181a7b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_402695993\data.txt
Size 140KB
SHA256 62f8e0aa77767ecc42974c5fa6197b47f5569aaca565706c78cac43e262c72e2
MD5 8338d202a6036494a33023b59bb6f777
SHA1 1574427dda4da0f77407d1f02e862732f96b348a
SHA512 1edbebb415c7df39aa946292189b22fc8ad10347475940c515d98dd4a1cdbc8ca03c1f0a68007b6b6191708b052870380a881dbecdf06603a87bbca690c5e5f8
SSDEEP 3072:COmkTNO7NHrMziBxfPURO+/bAipYbzFCSJL+yNxadxI3B5/hzkdBpnUb/:C7kMRIziBxfPe/sipYbYByN8dxI3BwdC
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_402695993\manifest.json
Size 53B
SHA256 a03f193057ac7bfca612699112b17bbb18f037653fe16052ea1f07762f09f2e4
MD5 4cd0451d949229133bf0052e5bdd04d4
SHA1 dcc4fd57ab59a3757f7cf522d68e16520965bffe
SHA512 a91262ce774895f411ec127ef4d298bae11abc69bc0c119cb3ea4da149d9c2b664130a1cc90bf8ef6e96d3fc0e144dbd044aed1a47c30af855dab6bb4ba13b0b
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_418271967\manifest.json
Size 102B
SHA256 8ee8a2fb7167ad2dcf2dd6f56074509dedd711b1825dcba2629af48c89eeebbe
MD5 50558b365ad40a8213fb79e84d42ffa3
SHA1 497d5ad94af7cecd6457fbd5723b6635ccd67c6b
SHA512 165a117c8f8247263c3328def089e5bc159895e1d4375bd3df93df8f9208c571dc7e3fb98389fa36952c6f3d8f3add4fe5c97b22bddc01ef7c4ac37477cc608a
MD5 SHA1 SHA512

Submit Download

Easyfun.exe

Path F:\Easyfun\Easyfun.exe
Size 3.9MB
SHA256 77f23f6cbc7e78274eb10c250755cd70a8634a2a15c4fe3267acc065c34c106b
MD5 2bc7f4b7e52a4847bc9c71c6ed4aa3d3
SHA1 e4ce142583fe497dad73a05501e86afccb860724
SHA512 f17017676322c66f1607c6155f735b793fbe284d5919adc498fca8429feba1f1ec256b608f320ccadc024fc8da740634cbf029da22d123a0937a448a1e9f5494
SSDEEP 49152:oU8yfta8FYZUm6Dyt9lhHXqAHcwfZ0dIPtPb5II5NSfBHIIo9a/slDWgBmT7T5ds:oOfa9LHXXHc4PcaNuBHIymD7BmTBdEGw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-815-0x0000000000B80000-0x0000000000F6F000-memory.dmp

Download

memory/1344-824-0x0000000000920000-0x0000000000D0F000-memory.dmp

Download

memory/2284-647-0x00000000078B0000-0x00000000078BE000-memory.dmp

Download

memory/2284-620-0x0000000005570000-0x0000000005592000-memory.dmp

Download

memory/2284-618-0x0000000002B00000-0x0000000002B36000-memory.dmp

Download

memory/2284-619-0x0000000005800000-0x0000000005E2A000-memory.dmp

Download

memory/2284-622-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/2284-621-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/2284-641-0x0000000007540000-0x00000000075E4000-memory.dmp

Download

memory/2284-640-0x0000000006950000-0x000000000696E000-memory.dmp

Download

memory/2284-645-0x00000000078F0000-0x0000000007986000-memory.dmp

Download

memory/2284-633-0x000000006ED30000-0x000000006ED7C000-memory.dmp

Download

memory/2284-632-0x00000000068F0000-0x0000000006924000-memory.dmp

Download

memory/2284-644-0x00000000076E0000-0x00000000076EA000-memory.dmp

Download

memory/2284-642-0x0000000007CA0000-0x000000000831A000-memory.dmp

Download

memory/2284-631-0x0000000006350000-0x000000000639C000-memory.dmp

Download

memory/2284-646-0x0000000007870000-0x0000000007881000-memory.dmp

Download

memory/2284-648-0x0000000007990000-0x00000000079AA000-memory.dmp

Download

memory/2284-643-0x0000000007660000-0x000000000767A000-memory.dmp

Download

memory/2284-629-0x0000000005E30000-0x0000000006187000-memory.dmp

Download

memory/2284-630-0x0000000006310000-0x000000000632E000-memory.dmp

Download

memory/2736-1550-0x0000000005F60000-0x00000000062B7000-memory.dmp

Download

memory/2736-1551-0x0000000006520000-0x000000000656C000-memory.dmp

Download

memory/2736-1552-0x000000006A5F0000-0x000000006A63C000-memory.dmp

Download

memory/2736-1559-0x0000000007790000-0x0000000007834000-memory.dmp

Download

memory/2736-1560-0x0000000007A40000-0x0000000007A51000-memory.dmp

Download

memory/2920-836-0x0000000070A70000-0x0000000071016000-memory.dmp

Download

memory/2920-1928-0x00000000709F0000-0x0000000070A6E000-memory.dmp

Download

memory/2920-1932-0x00000000710A0000-0x0000000072A9B000-memory.dmp

Download

memory/2920-759-0x0000000001340000-0x0000000001356000-memory.dmp

Download

memory/2920-776-0x00000000363E0000-0x00000000363F0000-memory.dmp

Download

memory/2920-835-0x0000000070910000-0x0000000070969000-memory.dmp

Download

memory/2920-837-0x00000000710A0000-0x0000000072A9B000-memory.dmp

Download

memory/2920-834-0x0000000070970000-0x00000000709EA000-memory.dmp

Download

memory/2920-1931-0x0000000070A70000-0x0000000071016000-memory.dmp

Download

memory/2920-1930-0x0000000070910000-0x0000000070969000-memory.dmp

Download

memory/2920-1929-0x0000000070970000-0x00000000709EA000-memory.dmp

Download

memory/2920-833-0x00000000709F0000-0x0000000070A6E000-memory.dmp

Download

memory/2940-671-0x000000006ED30000-0x000000006ED7C000-memory.dmp

Download

memory/3380-1584-0x000000006A5F0000-0x000000006A63C000-memory.dmp

Download

memory/3380-1577-0x0000000006000000-0x0000000006357000-memory.dmp

Download

memory/3392-813-0x00000000015E0000-0x00000000019CF000-memory.dmp

Download

memory/4160-1568-0x00000000057E0000-0x0000000005B37000-memory.dmp

Download

memory/4160-1569-0x000000006A5F0000-0x000000006A63C000-memory.dmp

Download

memory/4240-814-0x0000000001440000-0x000000000182F000-memory.dmp

Download

memory/4412-2001-0x0000000070A60000-0x0000000070ADE000-memory.dmp

Download

memory/4412-2004-0x0000000071090000-0x0000000072A8B000-memory.dmp

Download

memory/4412-2000-0x0000000070AE0000-0x0000000071086000-memory.dmp

Download

memory/4412-2003-0x0000000070980000-0x00000000709D9000-memory.dmp

Download

memory/4412-2002-0x00000000709E0000-0x0000000070A5A000-memory.dmp

Download

memory/4412-1938-0x0000000001200000-0x0000000001216000-memory.dmp

Download

memory/4412-1952-0x00000000363E0000-0x00000000363F0000-memory.dmp

Download

memory/4676-812-0x0000000000D20000-0x000000000110F000-memory.dmp

Download

memory/5388-816-0x00000000012F0000-0x00000000016DF000-memory.dmp

Download

memory/5988-657-0x000000006ED30000-0x000000006ED7C000-memory.dmp

Download

memory/6072-2010-0x00000000010C0000-0x00000000010D6000-memory.dmp

Download

memory/6072-2024-0x00000000363E0000-0x00000000363F0000-memory.dmp

Download

memory/6072-2227-0x0000000070AB0000-0x0000000071056000-memory.dmp

Download

memory/6072-2228-0x0000000070A30000-0x0000000070AAE000-memory.dmp

Download

memory/6072-2230-0x0000000070950000-0x00000000709A9000-memory.dmp

Download

memory/6072-2229-0x00000000709B0000-0x0000000070A2A000-memory.dmp

Download

memory/6072-2231-0x0000000071060000-0x0000000072A5B000-memory.dmp

Download

memory/6076-1614-0x000000006A5F0000-0x000000006A63C000-memory.dmp

Download