guerrilla | 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
160s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/06/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
Size 3.4MB
Sample260613-jpyqvsew3y
SHA256 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b
MD5 c329a16ec3b4832e67ad84d6f6742d32
SHA1 0e91bebf54cb532293cc35cbec1ce41d35aaaed6
SHA512 5619569744565ab0c3ccd627370eaebfcc274d414bbff10296b9af737fa91d20585d529ef9e16426be90402abe9fdd402ab0fc922d5c3ad341f98d98b0e36d8e
SSDEEP 49152:tNsyYfhdpopyX2g3SCXKN5Yh4paWiNhK9Ioz6rfMWHytcT8bN8amDeDahSSwP0cI:t6yYfhdpopyXt5XyRUourfMcqbsB8Si
TLSH
T1F7F5BF12BA818176F5E30171D8BE5BBE4939AD31072494C3D3C4396E5A61AE23B3B74F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution exploit guerrilla infostealer persistence privilege_escalation rat spyware trojan

Malware Config

Signatures

Family: Guerrilla
Guerrilla is an Android malware used by the Lemon Group threat actor.
trojan infostealer rat guerrilla

Guerrilla payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002b5d1-319.dat	family_guerrilla

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27\FuncName = "WVTAsn1SpcFinancialCriteriaInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003\FuncName = "WVTAsn1SpcIndirectDataContentEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.30\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010\FuncName = "WVTAsn1IntentToSealAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPCreateIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubDumpStructure"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2003\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010\FuncName = "WVTAsn1IntentToSealAttributeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
3920	takeown.exe
4488	icacls.exe
472	takeown.exe
4756	icacls.exe
3588	takeown.exe
1700	icacls.exe
2408	takeown.exe
4244	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3920	takeown.exe
4488	icacls.exe
472	takeown.exe
4756	icacls.exe
3588	takeown.exe
1700	icacls.exe
2408	takeown.exe
4244	icacls.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
113	discord.com
51	discord.com
52	discord.com
65	discord.com
72	discord.com
89	discord.com
104	discord.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
File opened (read-only)	\??\F:	LDPlayer_0900051501.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2572	powercfg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\host_manager2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\swresample-6.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\UICommon.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\ossltest.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qwindows.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxStub.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-process-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libOpenglRender.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcp120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMMPreload.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxBalloonCtrl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\nvngx_dlssg.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libcurl.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libssl-1_1-x64.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-libraryloader-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-multibyte-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.reflex.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDD.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-synch-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\libcurl.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetLwfInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l2-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxRT-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-private-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxInstallHelper.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\comregister.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Widgets.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Gui.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDDU.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDragAndDropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-namedpipe-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.inf	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSupLib.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\shaderc_shared.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9VMMR0.r0	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdp6Install.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuth.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetFltNobj.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBTest.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\loadall.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxTestOGL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletionStress.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vbox-img.exe	dnrepairer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Executes dropped EXE 10 IoCs

pid	Process
2728	LDPlayer_0900051501.exe
2120	dnrepairer.exe
4660	Ld9BoxSVC.exe
2388	driverconfig.exe
1476	dnplayer.exe
3920	Ld9BoxSVC.exe
2528	vbox-img.exe
3412	vbox-img.exe
4464	vbox-img.exe
1736	Ld9BoxHeadless.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3276	sc.exe
1500	sc.exe
4048	sc.exe
996	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
2120	dnrepairer.exe
2120	dnrepairer.exe
2120	dnrepairer.exe
2120	dnrepairer.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
4660	Ld9BoxSVC.exe
2292	regsvr32.exe
2292	regsvr32.exe
2292	regsvr32.exe
2292	regsvr32.exe
2292	regsvr32.exe
2292	regsvr32.exe
2292	regsvr32.exe
2292	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
3684	regsvr32.exe
4732	regsvr32.exe
4732	regsvr32.exe
4732	regsvr32.exe
4732	regsvr32.exe
4732	regsvr32.exe
4732	regsvr32.exe
4732	regsvr32.exe
4732	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2388	driverconfig.exe
2388	driverconfig.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe
1476	dnplayer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer_0900051501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
444	msedge.exe
5396	msedge.exe
1792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3048	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBoxClient.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8690-11E9-B83D-5719E53CF1DE}\ = "IDisplay"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CD54-400C-B858-797BCB82570E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4521-44CC-DF95-186E4D057C83}\ = "IVBoxSVCRegistration"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-DA7C-44C8-A7AC-9F173490446A}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E8B8-4838-B10C-45BA193734C1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5409-414B-BD16-77DF7BA3451E}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3346-49D6-8F1C-41B0C4784FF2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FF5A-4795-B57A-ECD5FFFA18A4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8384-11E9-921D-8B984E28A686}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2E88-4436-83D7-50F3E64D0503}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E254-4E5B-A1F2-011CF991C38D}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CB63-47A1-84FB-02C4894B89A9}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CD54-400C-B858-797BCB82570E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9849-4F47-813E-24A75DC85615}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2354-4267-883F-2F417D216519}\NumMethods\ = "18"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-58D9-43AE-8B03-C1FD7088EF15}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C6EA-45B6-9D43-DC6F70CC9F02}\NumMethods\ = "16"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C9D6-4742-957C-A6FD52E8C4AE}\ = "IBandwidthControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-73a5-46cc-8227-93fe57d006a6}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0C65-11EA-AD23-0FF257C71A7F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6038-422C-B45E-6D4A0503D9F1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3188-4C8C-8756-1395E8CB691C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-800A-40F8-87A6-170D02249A55}\NumMethods\ = "21"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E5DB-4D2C-BAAA-C71053A6236D}\TypeLib	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E5DB-4D2C-BAAA-C71053A6236D}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6B76-4805-8FAB-00A9DCF4732B}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7619-41AA-AECE-B21AC5C1A7E6}\ = "IAppliance"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C8E9-466B-9660-45CB3E9979E4}\NumMethods\ = "26"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CB63-47A1-84FB-02C4894B89A9}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CF37-453B-9289-3B0F521CAF27}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0C65-11EA-AD23-0FF257C71A7F}\ = "ICloudNetworkGatewayInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8CE7-469F-A4C2-6476F581FF72}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0C60-11EA-A0EA-07EB0D1C4EAD}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1BCF-4218-9807-04E036CC70F1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B4A4-44CE-85A8-127AC5EB59DC}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CF37-453B-9289-3B0F521CAF27}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0721-4CDE-867C-1A82ABAF914C}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1A29-4A19-92CF-02285773F3B5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486F-40DB-9150-DEEE3FD24189}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\NumMethods\ = "58"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-A1A9-4AC2-8E80-C049AF69DAC8}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5A1D-43F1-6F27-6A0DB298A9A8}\ = "IDHCPGroupCondition"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7708-444B-9EEF-C116CE423D39}\NumMethods\ = "20"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-35F3-4F4D-B5BB-ED0ECEFD8538}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E621-4F70-A77E-15F0E3C714D5}\NumMethods\ = "11"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\ = "VirtualBox Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4289-EF4E-8E6A-E5B07816B631}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D545-44AA-8013-181B8C288554}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20191216-1750-46F0-936E-BD127D5BC264}\1.3\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-762E-4120-871C-A2014234A607}\ = "ICloudProviderManager"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4022-DC80-5535-6FB116815604}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E1B7-4339-A549-F0878115596E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8384-11E9-921D-8B984E28A686}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7FF8-4A84-BD34-0C651E118BB5}\ = "IUSBController"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-00A7-4104-0009-49BC00B2DA80}\TypeLib	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-44E0-CA69-E9E0-D4907CECCBE5}\ = "IGuestFsObjInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9070-4F9C-B0D5-53054496DBE0}\ = "IMousePointerShape"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4974-A19C-4DC6-CC98C2269626}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B7F1-4A5A-A4EF-A11DD9C2A458}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7556-4CBC-8C04-043096B02D82}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AE84-4B8E-B0F3-5C20C35CAAC9}\NumMethods\ = "15"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F4C4-4020-A185-0D2881BCFA8B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0C60-11EA-A0EA-07EB0D1C4EAD}\ProxyStubClsid32	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
2120	dnrepairer.exe
2120	dnrepairer.exe
2728	LDPlayer_0900051501.exe
2728	LDPlayer_0900051501.exe
4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeTakeOwnershipPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe
Token: SeDebugPrivilege	2728	LDPlayer_0900051501.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1476	dnplayer.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1476	dnplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2728	4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe	84
PID 2728 wrote to memory of 2120	2728	LDPlayer_0900051501.exe	85
PID 2120 wrote to memory of 3868	2120	dnrepairer.exe	86
PID 3868 wrote to memory of 2432	3868	net.exe	88
PID 2120 wrote to memory of 3276	2120	dnrepairer.exe	89
PID 2120 wrote to memory of 488	2120	dnrepairer.exe	90
PID 2120 wrote to memory of 4508	2120	dnrepairer.exe	91
PID 2120 wrote to memory of 1500	2120	dnrepairer.exe	115
PID 2120 wrote to memory of 1080	2120	dnrepairer.exe	93
PID 2120 wrote to memory of 2428	2120	dnrepairer.exe	94
PID 2120 wrote to memory of 2520	2120	dnrepairer.exe	95
PID 2120 wrote to memory of 3920	2120	dnrepairer.exe	96
PID 2120 wrote to memory of 4488	2120	dnrepairer.exe	98
PID 2120 wrote to memory of 472	2120	dnrepairer.exe	100
PID 2120 wrote to memory of 4756	2120	dnrepairer.exe	102
PID 2120 wrote to memory of 3588	2120	dnrepairer.exe	104
PID 2120 wrote to memory of 1700	2120	dnrepairer.exe	120
PID 2120 wrote to memory of 4660	2120	dnrepairer.exe	108
PID 2120 wrote to memory of 2292	2120	dnrepairer.exe	109
PID 2120 wrote to memory of 3684	2120	dnrepairer.exe	110
PID 2120 wrote to memory of 4732	2120	dnrepairer.exe	111
PID 2120 wrote to memory of 2232	2120	dnrepairer.exe	112
PID 2120 wrote to memory of 3276	2120	dnrepairer.exe	113
PID 2120 wrote to memory of 1500	2120	dnrepairer.exe	115
PID 2728 wrote to memory of 2388	2728	LDPlayer_0900051501.exe	117
PID 2728 wrote to memory of 2572	2728	LDPlayer_0900051501.exe	118
PID 2728 wrote to memory of 2408	2728	LDPlayer_0900051501.exe	119
PID 2728 wrote to memory of 4244	2728	LDPlayer_0900051501.exe	123
PID 4396 wrote to memory of 4544	4396	LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe	127
PID 4544 wrote to memory of 4752	4544	msedge.exe	130
PID 1476 wrote to memory of 4048	1476	dnplayer.exe	131
PID 1476 wrote to memory of 996	1476	dnplayer.exe	133
PID 1476 wrote to memory of 4052	1476	dnplayer.exe	136
PID 4052 wrote to memory of 3048	4052	cmd.exe	139
PID 4544 wrote to memory of 4300	4544	msedge.exe	141
PID 4544 wrote to memory of 444	4544	msedge.exe	140
PID 4544 wrote to memory of 4300	4544	msedge.exe	141
PID 4544 wrote to memory of 4300	4544	msedge.exe	141
PID 4544 wrote to memory of 3912	4544	msedge.exe	143
PID 4544 wrote to memory of 3912	4544	msedge.exe	143
PID 4544 wrote to memory of 3564	4544	msedge.exe	145
PID 4544 wrote to memory of 3564	4544	msedge.exe	145
PID 4544 wrote to memory of 3564	4544	msedge.exe	145
PID 4544 wrote to memory of 804	4544	msedge.exe	146
PID 4544 wrote to memory of 804	4544	msedge.exe	146
PID 4544 wrote to memory of 804	4544	msedge.exe	146
PID 4544 wrote to memory of 1036	4544	msedge.exe	147
PID 4544 wrote to memory of 1036	4544	msedge.exe	147
PID 4544 wrote to memory of 1036	4544	msedge.exe	147
PID 4544 wrote to memory of 4420	4544	msedge.exe	148
PID 4544 wrote to memory of 4420	4544	msedge.exe	148
PID 4544 wrote to memory of 4420	4544	msedge.exe	148
PID 4544 wrote to memory of 4828	4544	msedge.exe	149
PID 4544 wrote to memory of 4828	4544	msedge.exe	149
PID 4544 wrote to memory of 4828	4544	msedge.exe	149
PID 4544 wrote to memory of 1100	4544	msedge.exe	150
PID 4544 wrote to memory of 1100	4544	msedge.exe	150
PID 4544 wrote to memory of 1100	4544	msedge.exe	150
PID 1476 wrote to memory of 2528	1476	dnplayer.exe	153
PID 1476 wrote to memory of 3412	1476	dnplayer.exe	155
PID 1476 wrote to memory of 4464	1476	dnplayer.exe	176
PID 4544 wrote to memory of 1800	4544	msedge.exe	159
PID 4544 wrote to memory of 1800	4544	msedge.exe	159
PID 4544 wrote to memory of 3956	4544	msedge.exe	160

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.TrassGames.G2Companion_3040_ld.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396
- C:\LDPlayer\LDPlayer9\LDPlayer_0900051501.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer_0900051501.exe" -silence -downloader -openid=3040 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" cmd=install|listener=590108
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:3276
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:488
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4508
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1500
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2428
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3920
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4488
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:472
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4756
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\Users\Admin\.Ld9VirtualBox" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3588
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\Users\Admin\.Ld9VirtualBox" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1700
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4660
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:2292
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3684
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4732
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2232
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3276
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1500
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1700
- - C:\Windows\SysWOW64\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /powerthrottling disable /path "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"
    3⤵
    - Power Settings
    PID:2572
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2408
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/g8Fhag9NxT
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ffc4a0cc188,0x7ffc4a0cc194,0x7ffc4a0cc1a0
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,954530935874868843,12754684953792053171,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,12973150506148692480,15814489485188117567,262144 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,10087118004015985531,14209733647010686040,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,4957635866025178550,10436552526227702406,2097152 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,16277254759080747171,5960276930630152128,2097152 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4512,i,12304235598956170169,2425599977868279270,2097152 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4636,i,2654672034122170412,4374233186719559791,2097152 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:9
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4784,i,4812634236803082312,1641422592199337252,2097152 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4796,i,16526071731091708601,4873363144209192196,2097152 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,11284356922169310365,287099870251321943,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4584,i,1579539201174573164,17470425532247928515,2097152 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,4320127796324633810,4111971799811452838,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,3436759391882208470,4393277819422172401,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,1133356149554161482,5426852878548562517,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,7312226177415317886,14921007772215519373,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:196
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,7312226177415317886,14921007772215519373,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,3754204035505938934,12102024920567019727,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,8925628017468706718,7598108104985900020,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:12
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7292,i,9646438758272695216,12115659675093683585,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:14
    3⤵
    PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1148
      4⤵
      PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,3901238125883363634,1427677412941750178,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,15396584092991032636,6708661332756150838,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,10847627527885699112,8142356457295830999,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7304,i,4268347758179707077,6025538158827460875,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,18420133148045456808,17587931330150621402,524288 --field-trial-handle=1996,i,9473303083760617654,3036782750727998978,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
    3⤵
    PID:5916
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\dnplayer.exe" downloadpackage=com.TrassGames.G2Companion|package=com.TrassGames.G2Companion
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4048
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:3048
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    - Executes dropped EXE
    PID:2528
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:3412
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ldplayer.net/blog/how-to-enable-vt.html
    3⤵
    PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffc4a0cc188,0x7ffc4a0cc194,0x7ffc4a0cc1a0
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8717403763436971921,3582767393868166415,524288 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
      4⤵
      System Time Discovery
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,17173824475690664930,7129183858935143376,262144 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,15706700334875568678,14167138722732705433,524288 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2075736774492856453,8718174906008808627,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15387840874088338779,2768326431251174194,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,13099146068033379277,6467522735942005410,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3432,i,14415505087493659787,13517281350622262671,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5292,i,10410424489036611443,8496861072007271227,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3600,i,5722019827988288608,17350305926570972961,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5624,i,10844506452326325613,11763888343217275549,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
      4⤵
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5788,i,16670965854261109919,2352534596333009953,2097152 --field-trial-handle=2132,i,1278659920829772267,781524098422761119,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
      4⤵
      PID:500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:2876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc4a0cc188,0x7ffc4a0cc194,0x7ffc4a0cc1a0
        5⤵
        
        PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14772478012516011126,2629208557750482334,524288 --field-trial-handle=2120,i,11692041071941641869,6547158606881416252,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,13203265872346237560,3012554086405122181,262144 --field-trial-handle=2120,i,11692041071941641869,6547158606881416252,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
        5⤵
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,9248523379708900354,12961959351833628937,524288 --field-trial-handle=2120,i,11692041071941641869,6547158606881416252,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11762907008170402115,14208147368059591350,524288 --field-trial-handle=2120,i,11692041071941641869,6547158606881416252,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
        5⤵
        
        PID:3084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11762907008170402115,14208147368059591350,524288 --field-trial-handle=2120,i,11692041071941641869,6547158606881416252,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
        5⤵
        
        PID:4048

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3920
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:2704
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:1092
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:1916
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP120.dll

Path C:\LDPlayer\LDPlayer9\MSVCP120.dll
Size 449KB
SHA256 9cb478e41026982a4366d567377e3a9880e7ce8477a5ea1fd1ddd1fa96bc1084
MD5 cdfd3c9f6a972a1b3bbc0b0fabbbe39f
SHA1 d137f3a75eb9dcd7390992525dca637f9b678707
SHA512 e89a232471cddef647f990e76e0a04d0f74f81391c342e69395f3fb5de471b3f3064c335526e619d73c0b4961f2635321476c9d5451c11ead0c4ca1b7af65779
SSDEEP 12288:pZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77E:z/8wVwHZFTwFOOos3Ooc8DHkC2e77E
TLSH
T13EA45B237B864CF1D29E53B231C9532557FAFC2441B1F343ABEEE1692FA5282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\LDPlayer\LDPlayer9\MSVCR120.dll
Size 952KB
SHA256 76770d93afb655c882fade5c0909bfdd263cde0ba1762a881c69bb57dda2ccb7
MD5 b46ba3349d9b716a30e617ee8e966707
SHA1 f0a4724e9061c032b0b0cbaaec1f1d13f0de8384
SHA512 ebca95f5b431be8a0eb5b74735cadc5c175328067c091576eb01dadb53ec39fc65b22aa2cca85306320f2cae4747ff5478b232108bd4a60389cd5557f83eba4e
SSDEEP 12288:1BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJD:bmFyjLF847eiWWcoGZVOIxh/WxIAIbt
TLSH
T19425BF12B582C0B2C57202B1152DA73219BFB971443599B7BBD98F0E1EB45C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 50KB
SHA256 e269811316cba3527ca1f1ff54b1bf2ca0a435349d57ff350387ad464da87617
MD5 073553b6d3b92599db810e152541b7ea
SHA1 734beaf96d0b3ff0d6b9d016c085960b3e9b9f42
SHA512 1cf9132a973070e55507cd74570c195c1e3e66a68ab1f5c61dc47a89b5faba0ca49262ad250e99eb26e65cd02ffc6fff4204a7906ccd108518be3d2679a2de06
SSDEEP 768:5Q+agNztWyGOiprkvcocNcb0H/GEM8Jf3c4sbG7nQL44SYiDLk5XkvYijjK5AL:5PGyMprkvxXb0HOafsYQM4S7ekv7P
TLSH
T12D339E929540482ADD560870B9F86B3AADFDB1610BE1C2C7F388C26967507C13F791BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnmultiplayer.exe

Path C:\LDPlayer\LDPlayer9\dnmultiplayer.exe
Size 1.3MB
SHA256 f6002b4777f29eed5424d31eedec5bdb770103e6e895e0b8ab56581a26c6d248
MD5 b06897933c3378bb28af3011fa709efc
SHA1 5a626f653fe7c444f8b1c41d4e8b3f407d62f7b8
SHA512 00c75a7f356defb76c89a989adfa97a55e559dead4aea4d7fbbeb220fa6a72d0b5caa2528166dadf076cc6ee24c28d0eb69de6c6d0f07c90e57fc2861a42b2c2
SSDEEP 24576:rWRonmBYBc0KJQGZ7X0J7uhLxO0DRkR9tt:jToQGJX+uhItt
TLSH
T1B1557D20BA97C135E7B201B0BDBDAA5D502DBD680B2240CBE3D43A1E1971EC26E77757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnplayer.exe

Path C:\LDPlayer\LDPlayer9\dnplayer.exe
Size 4.3MB
SHA256 ada7c62521356f8697742b1fab05f01fdc4be02d2f3553fdbe958db770e4ba9b
MD5 c6d444005fdaf5d5e0c450d22e493f18
SHA1 e6e3f9b78e957ecd1ad28997a3de54ba2d2acf58
SHA512 25ae4760ae5337957a64f474b2e497dd92a5f0f892965a9545bdd640f6e02710fec4659ac5a72d55bee1cf023fd97ca796593fb84c999966939d3b37768eb151
SSDEEP 49152:BBOYYpdv756lxkHuSV5OQWPGVan5/v5QxqIybUmX8diSzJ2BqzBhdgLxEVpa1crP:/OYrkoPGYnsxqIaciSzJ2LGVpa1Q
TLSH
T1BA266C00BB45C236FAA602B1D97DAF5E0429AD701F2994CBF3C43F5D1971AC25E3366A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 41.9MB
SHA256 c1d07a8bd7eb5a73fef81a4426af41165f8ca01749936d17fb638115cf526ec3
MD5 4b960416043276dd12077201038e9d8b
SHA1 c9a1475d0063737e086de8fc2b6d35a39d853bfa
SHA512 091141b8bbf4abdae05655e2dc8d0cba69b12aa7e059141c053bcd8169f23fdc2d48330d3c72eba2037f6100b5abbc5306c524b27424296bf7e3c2fa807af5e8
SSDEEP 786432:jsykovi8bBeguoSwFOYDs89hN2LKG7WY2O0o8isQCPaiX916Vn9aKZKgALAmmpYe:lvNB5pSc889hQLZCY2O989HaGyh9fZTX
TLSH
T1EAA7333136B5D131F2A30AB1BCB9A94A1439BE34472551CB62D43D1E5E3DAC3AC32B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.6MB
SHA256 c810442319160637ad7dcfdf14e71bc1a34b75aa9b0c55a55e72dcd3c41acbfe
MD5 80c2aa5270eafb9d7fa71a3d61ce5fd4
SHA1 00629cfb49c7b7f87c980f20081e28d83a3e3d39
SHA512 a10fbd0ee81319823eca84cdb938d7f5199bff6f0f429577b53410d7a07081b2ff4931f1df5881bfef6716708d4545649d322ac1fa5da86b7e76c4afc1285f61
SSDEEP 98304:Y3EB+HjpGjbJvmUz+tN1yr9VOcFfkovuZ0alZQkl5h8H7WdzlpCbOcX1x:Y0B+Hjp2bJvfqo9VOWu+uqo07WdzlkXH
TLSH
T10D5633AD2B7D5330259D55AA53E5B520F100CFAE733A28330BA123D4DE0E2BCD9D659E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NanumGothicLight.otf

Path C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf
Size 314KB
SHA256 153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2
MD5 e2e37d20b47d7ee294b91572f69e323a
SHA1 afb760386f293285f679f9f93086037fc5e09dcc
SHA512 001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901
SSDEEP 6144:6kyWbmIwXcviKE2SmwxjVGZ/YKNSfuWBl/3DAJHu46ldvtQqu+EGi:6kXbmBZjjaHN2uQlPDAJHu46l16tGi
TLSH
T15264DF90912BE4C7E9F65032EEBB25548305C130D64AFFBD86BC4198F6D831F94DA4EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phones.data

Path C:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
TLSH
T163C1EE57BBEE4E571ADC7DCE3274C9973A0CC449C28D18F839082876DA8C9314375BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.vmdk

Path C:\LDPlayer\LDPlayer9\system.vmdk
Size 1784.4MB
SHA256 7968a72e0fa619bcfc14fb2c641b3dea1f1a8afb36212bdea651a6f8309a8874
MD5 8ffb2de72864d86c46b21f040173318f
SHA1 bc99d4aec2c903b7a80e9beade6d7ece53b81315
SHA512 64ee5f451736869be1c287dacd3725cb4e32482b303bf531c6afceb4d9384bd79280f29b389d048e3bc1123a5e2af68c9348e3ee21560732ec5956a61be3d840
SSDEEP 12582912:f7mhKAPeWHD9W3LhEpbPTzFFLlGJFcVBY2U+V:TmhKAPeW5W3LyzNKJF8
TLSH
T13E1ACF03FA515879C8BAD474424FD336EB347C4983339697AA487B247E73AE05F2A790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EGL.dll

Path C:\LDPlayer\LDPlayer9\vbox64\EGL.dll
Size 532KB
SHA256 80ebebaac33cb7df8dfdd1344b63a3e1fecb980214218eeaab8ab2f023c31b3b
MD5 92950647ab342ccf982b33816a31ebd1
SHA1 e9c7c2603c0ed37eb890893c6e64945866f333d9
SHA512 f9487db83c33319072baa2c3e5b3222d5f40c03832705ed607bcb856dd1a860e97cb1934cbc77940ee4a755001c0461fe80cc83c3b9d78d49a5bc3cfa84dc4e8
SSDEEP 6144:GPP1r54LFWPAVL4/M4aC+4NKJewLzSvtE0Iz42+a8sct9pFa5Y:GF14ZVL4z1NK1fTgeY
TLSH
T144C46B0276464372D419733BB9638D42E3B2F2650B3F82CB7A58831EDEE76D319B9650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131
MD5 cde2424d99db56dd0d1eaf34811738c1
SHA1 cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f
SHA512 d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2
SSDEEP 192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn
TLSH
T16A822892CEBC9583ED969D7017A8E9837D3DEBC71D10A15521AAF4D838C33D1EB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725
MD5 acf4321ac8c8ff4d0442c799d621f8d9
SHA1 b12f87e6afc48697f1ce8b587715361e89b79cae
SHA512 7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde
SSDEEP 192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+
TLSH
T102823A929BBCD083ED979D3063A8E9837D3CDBC75D10416A05AAF5E82C833D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956
MD5 3c47c25b8141d20b2b4d576000000a61
SHA1 04543f9cdd847ff66389c9fd1e12b444dae6383a
SHA512 c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a
SSDEEP 384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI
TLSH
T12F8218918ABCD583FE979E3062A8EE837C3DA7C71D10556605A9F4E82CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410
MD5 e05ce0232e64328c62c9da37698566bf
SHA1 50c25e6ecec2cd17ecf3117bb9a646ba107d2b84
SHA512 8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb
SSDEEP 192:MmxD3KXWuufhW+sivT16uDBks/nGfe4pBjSfhXa8WebtuVaVWQ42WyMsVqnaj87p:MVXW5hWyvT1Nq0GftpBjSZgkldri
TLSH
T1008218929ABCC083ED97AD7023E4EE837D3CABC35D10556909A9F5D828D33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830
MD5 a26c7ffcf18b62904dab7786de638ea6
SHA1 b28489bc38ee2f522ee83dcf49faeb96f39a77e3
SHA512 768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f
SSDEEP 192:sohaYPvVX8rFTscWuufhWrlFO0ruDBks/nGfe4pBjSb68WebtuVaVWQ4mWst1qnq:JTPvVXiW5hWB80aq0GftpBjQZplBLcQ
TLSH
T10EA20983D9B8E297ED8F9E3112A5D9836C3893C60820459616E9F39D3CD33C6E79895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
MD5 6a55a7e284b51b086b63cc6f2061ce8b
SHA1 46a48a1ccf5262038b71ed4be09cf625009d078d
SHA512 6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363
SSDEEP 192:ByWuufhWrRivT16uDBks/nGfe4pBjSb9bXe8WebtuVaVWQ4mWWrRHqnajjpxf9cS:ByW5hW0vT1Nq0GftpBjSbRZnlHlBLcYl
TLSH
T1998219928ABCD483ED979D7063A8E9837C3CDBC35920416905A9F4E82C833D1EF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
MD5 6e38a6bed88e1c27155e4dc428188ef0
SHA1 8b47a1960ed157f7beeb80fa4a16a723279c4efa
SHA512 3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab
SSDEEP 192:HX6WuufhWr7FO0ruDBks/nGfe4pBjSbnUqs28WebtuVaVWQ4mWOYVqnaj87X/fA2:HX6W5hWX80aq0GftpBj2spZkldrps
TLSH
T1508219D19ABCC583ED8BAE7012E8EA837D3CABC75D10415616A9F1D82C833C1EB1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4
MD5 9304209688e2a18d0b26997bc78fda7a
SHA1 5d4332cf1c5123418c6419d0291486c3939e8785
SHA512 5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960
SSDEEP 192:KKWuufhWr2ivT16uDBks/nGfe4pBjSbYA/8WebtuVaVWQ4mW7TqnajPf33PLlYoM:9W5hWHvT1Nq0GftpBj4UZAljZYsqTr
TLSH
T1AF8219D2CA7C8583F9979D3013A9EA837D3CDBC75C10916A05A9F4D828933D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll
Size 18KB
SHA256 f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234
MD5 f42a84d78a5a15ff1a4dbac591e95783
SHA1 1cd5b5e68fd729bdd340463b53728634d342b0cd
SHA512 89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0
SSDEEP 192:3liWuufhW3XUxQmLuDBks/nGfe4pBjS7LX28We8WebtuVaVWQ4eWmQQPqnajy3Ss:3liW5hWOQ7q0GftpBjkEZfQQPlGinjqZ
TLSH
T11B822985CABCD583ED979D7023A4EA837C3DE7C61D10555605AAF1E938C33D1EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970
MD5 9f286e57e5b1c1a347adf9eef059ad5d
SHA1 631aa1aa364234acc5ad20b27f926e9cb9ee4276
SHA512 6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197
SSDEEP 192:KWuufhWr3ivT16uDBks/nGfe4pBjSbKUs8WebtuVaVWQ4mWMoTqnajPf33PLlYoS:KW5hWmvT1Nq0GftpBjGzZv4ljZYsqHh
TLSH
T1E38209928EBC9583F9979D7013A8EA837C3CEBC75910515A05AAF4DC28C73C5EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141
MD5 beaae8294db31afa04fa60795c6e02ae
SHA1 8a32ebd843e461864747fe0aebf4bbf83c4ec093
SHA512 dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135
SSDEEP 384:rvuBL3BEW5hWh3rq0GftpBjzkZalBLc2V:aBL3Brii2sV
TLSH
T1BF8218C2CBBCE583E99B9D7052A8D9833C3997C75920946A01EDF5D928D33D1FB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
MD5 2ac1289e4dbab076b332869bef26d3ce
SHA1 60570ddd06b671e26c6a814b9c08cdfa0ef38aba
SHA512 e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a
SSDEEP 384:ptAuOMw3zdp3bwjGjue9/0jCRrndbAW5hWA80aq0GftpBjV+ZZrmlGinjQKKX:DAuOMwBprwjGjue9/0jCRrndbX4i3qdT
TLSH
T154922B92CAB8D283FC8EDD703266E9837C39D7C60D11955106E6FAA834D33D5E754A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd
MD5 a2661a468bb87ee9cc5dee968fd3805c
SHA1 9b17fbd552e34888f1453f9113ff4c42efaf6d6a
SHA512 b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3
SSDEEP 192:zQWuufhWrixf/0uDBks/nGfe4pBjSbl7Y88WebtuVaVWQ4mWyymqnajiG7AzTvfJ:zQW5hWS3rq0GftpBj9jZlymlO62vfGkb
TLSH
T18C822A8186BCD583E8D35D3063A8DA83BC3D9BC74D60955A11A9F1D928C33D5EB2492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e
MD5 acbfc011d5842ba60c372ba3d222ab70
SHA1 16b8014060a04bb03215f6ce4c118bae48653bd5
SHA512 dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3
SSDEEP 192:1cIWuufhW3bFO0ruDBks/nGfe4pBjS7irpMk8WebtuVaVWQ4eW5eqnajy3Snk0b7:CIW5hWL80aq0GftpBjNUZkelGinjn
TLSH
T173821791CA7CC583ED8B9D7013A8E9837D3DD7C71D10945515AAF8E928C33D0EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae
MD5 19d14d348ac38737431a7ee2f82973e6
SHA1 11cd8f5dc5c08d133b9b006da5c84946f012cbb6
SHA512 b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc
SSDEEP 192:AlWuufhWrExQmLuDBks/nGfe4pBjSbYsqwZ+8WebtuVaVWQ4mWXqnajnp+MVQ/Tz:AlW5hWaQ7q0GftpBj5VghZoldBQ7Q8PX
TLSH
T1B79229C19ABCE143FADB6D7012E8E9937C3997D71C1040A55169F6E828C33D1EB48A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0
MD5 ea0e13feac13dc18c79eb682bef4676e
SHA1 b9db47624345c68cf07bd2677df537e0f975caf9
SHA512 540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7
SSDEEP 384:ik1JzNcKSIUW5hWP80aq0GftpBjMJZCZslGinjI:9cKSupiEgZ40
TLSH
T1569219D1CABCD2C3E88A9D306394EE837D3AD7C61D25456105A9F6E93DD73C2D62882C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
MD5 1af2a91dc0a4e48bab0ca123073adf30
SHA1 cf6625fd31b17d46dd31b16372840c74026d0ba2
SHA512 45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51
SSDEEP 384:vIDfIenW5hWsvT1Nq0GftpBjeOZLlGinjx:ve2N1vi/l9
TLSH
T11F822A81CABC8583E9D79E7063A4EE833D3DDBC71D20906508A9F5E828C73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786
MD5 9b9d1949b75df171884f6f8caba7ff59
SHA1 411adf413f53c56488d5cf68e9b4b692889f3c4b
SHA512 dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c
SSDEEP 384:yW5hWgR80aq0GftpBjHLzZgfhlg+ZmJy:dmi1LzWflu
TLSH
T18C820991CA7C8483E997AE3063E9EE83BD3DABC71D10556601A9F1D92CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 18KB
SHA256 eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f
MD5 c6e268c877a9be5b43877308b1231120
SHA1 949105c826dee6a32fe1288285e3e41cb7d04821
SHA512 776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331
SSDEEP 384:HGeVxW5hWEvT1Nq0GftpBjvOZZljZYsqzN:HGeVcF1viJOYnzN
TLSH
T1008219D68ABC9483F9979D7013A9EA877C3CDBC75C60916604A9F5D928C33C0EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c
MD5 5122b8aa14a25c8567d9d0335036446f
SHA1 81961f2c8a331136f8156930779964a71e0badc4
SHA512 758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9
SSDEEP 384:1yMvIW5hWER4Zq0GftpBjpTuZV0lO62vfGU:1yMv/L47i7STVHGU
TLSH
T1398218928ABCD183ED975D7023A8EE837C3CABC71D10526951A9F0D82C833D5EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b
MD5 e1b30d56617709cf7dff5f464d7566d9
SHA1 e29646b1c90550cb86ed42782c764d41f2c70651
SHA512 e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511
SSDEEP 384:pvdv3V0dfpkXc0vVa/W5hWiR4Zq0GftpBjkYZjsdljZYsqmb:ldv3VqpkXc0vVau547iCY6Onc
TLSH
T180922982DAB8E583F89BDD7052A9D5837C3897C34820856611E9F5ED3CD33D0EB1892D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
MD5 e4b64b2710725ec3332021bd8044d884
SHA1 2d7f8d87d0f395296ecdf277084d23cb9e0880e8
SHA512 ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2
SSDEEP 384:stZ3KW5hW4R4Zq0GftpBjsnTZWFlGinj6m:oX47iiTomm
TLSH
T1B2822896CBBC9583E9979C7063E4EA837C389BC61D20556115AAF1E92CD33D2EB04D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8
MD5 67fd470a60fe8fb3f9fbe32fa52871d0
SHA1 09aba019a0d0dae7415b6d9a39e1dc67d93f130b
SHA512 f8c3f1e3bee196487aec704f128240acb57fb392db918a97176793b07726f017177abbb5a6c68822fc59ce06f04d489a78284a865efdc2de518f34ecfb0cc1e6
SSDEEP 384:NzgLW5hWgNvT1Nq0GftpBjVIB6RiNZiVlg+ZmJ:NzgKB1viPbRiNUhu
TLSH
T162922A928ABCD143E9979E7063E9DA837C3C9BC71C10816901A9F2D96DD33C5EB2493D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
MD5 f53ed8a0c18157b9e37500621dfab9ee
SHA1 b8a3131150cfd46052353309843c802d9f43df03
SHA512 2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a
SSDEEP 192:QNWuufhW+IivT16uDBks/nGfe4pBjSfASU8WebtuVaVWQ42WUqnajnp+MVQ/TQF/:4W5hWGvT1Nq0GftpBjhyZdldBQ7Ql
TLSH
T17E821992CBBC9083FD9AAE3013E4D9837D38ABD70C20556615AAF5D92CC73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b
MD5 2b9f551cddd662c618432a75c546b296
SHA1 1ddd65fcc8bb401c734ebc2014d057328f771744
SHA512 54df6e692ac630d969a697c9e6f379c4826ca71b7e8eaefdf502405b1333a6b483256aeba609a4a1c61e73f72d2958aaf3eb31538cc5e7a91101d7d09e3ed9dc
SSDEEP 192:GrWuufhWrvFO0ruDBks/nGfe4pBjSb0rjk8WebtuVaVWQ4mWD0qnajiG7AzTvfGC:GrW5hWz80aq0GftpBjjbZS0lO62vfGC
TLSH
T1198228D2CABC8583ED975D3053A8EE837C3CABC71D10956515AAF5D828C33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89
MD5 7d943f85ff8d1515a02d202ae79453d3
SHA1 94def1f7368172ac50b665e74b89e8f7aae2857b
SHA512 e111dbef97c6c6cb3b5c2d183294620792c48a2cb16d9d91c12cede757a1c0c53d707f4294542bef47eae784893bf63fe0f0229bed4b2d0a961c8d1cc1cf43cb
SSDEEP 192:VyWuufhW+JFO0ruDBks/nGfe4pBjSfG488WebtuVaVWQ42WyWqnqnajjpxf9c9kY:VyW5hWU80aq0GftpBj6ZXlBLcmY
TLSH
T1D5923B9386BC9943E9878E3063F4EAC37D3D97C72910616554AAF1A828C33E5FF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
MD5 278857b86f667c47cbcce94f5ec73ca8
SHA1 a0f5b7e7c67f3c6b8f285d39d08b740e49445755
SHA512 ebc02d1a2e223eb0b30a8e62089735faed83add4161094493f62561a09c13a426815e7f06c20c44477691109a8c3040dc68527023bfee6d9984c42d6a05208c9
SSDEEP 384:vcJ2yyW5hWGQ7q0GftpBjFZ8UOwlGinjP:vQgiviDcj
TLSH
T12EA2F843AAF86F62E99B1B7121F9DBC32D384B82195052B5811BE1DC34837D1FE66C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
MD5 6493b21fefae874655c62a56a156f3eb
SHA1 c65beb46f9f03d35867ff008026d3a56fa26fb65
SHA512 93cbe187f7fa86ac58191b5384a993135e3291873a76cc2cf81dd60c68ad7591386e4eb5ab53aaac2a6f48f7f778263b7fa0a4ea0863361910a9f1efee92b64b
SSDEEP 192:45oWuufhW3dxQmLuDBks/nGfe4pBjS7Ji8WebtuVaVWQ4eWbj8qnajy3Snk0T:4GW5hW/Q7q0GftpBjmZ08lGinjT
TLSH
T113823A81CABC9583ED97AE7053B8EAC37C3DABD71D10516605AAF5D828C33D0EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
MD5 ae83311041ee793253ff10736317a09e
SHA1 c62d06cb6cbd9d997c42a6ad7f13c06f38725069
SHA512 0fabcb0370330460f8f525401f339535c08d768f075816989a16eff2256584cfa8fd6832df3ce3d9c2a5364b4ef58bfff53cc486e3b48d11b654f7174aa18458
SSDEEP 384:gTnWm5CoW5hWSvT1Nq0GftpBjMkZaA0l3uzJ:gTnWm5Cfz1vijj/l
TLSH
T1559218838BF8A953ED971F3112F8EBC33E3D9BC219114266906AE59839C33C0BF11959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
MD5 12311308d7d65895b3920b3dd3e54b3b
SHA1 3faa74c6913f451d9c575761630b507af0c15ee3
SHA512 67fd047e760dbdadb06cc2c34b935fdabc629fa988484a9f5120cd59d6167d943b612df65626701022b5e73c5b1177a8d813e90c5990468f51a5a11932c008ed
SSDEEP 192:QwY17aFBR7WuufhWrtQR4+uDBks/nGfe4pBjSb0NW8WebtuVaVWQ4mWMUVqnaj8F:QpWW5hWyR4Zq0GftpBjhNJZYldr8
TLSH
T1EB822AC28ABC8583ED97AE7022E4EBC73D3D97C36D10556641AAF1D828833D1FB1491D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
MD5 3dafcf25a2ac1becf40acbec8fc7134b
SHA1 0729fdc617403622c2edd77fdb7dd49b530e2037
SHA512 9dbb487489c8a6af8dbd6326fe4958f489552af268f2937495ada35bb8404cfaeaf54833d8bba2966e72cd0ba3284a5fd167baf4cd6d905870f5d1ed3e5ff6c0
SSDEEP 192:QPqWuufhWrHxQmLuDBks/nGfe4pBjSbZjk8WebtuVaVWQ4mWK8MVqnaj87X/fACD:rW5hWdQ7q0GftpBjWjbZZldr63
TLSH
T14E823A828ABC9583EDC7AE7013E8EA877C3D9BC31D10556511AAF5D828833D8EF1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-math-l1-1-0.dll
Size 27KB
SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
MD5 f32bd567d35d2e85504c39dede609e72
SHA1 b7a7145956466e45bbe6f7fe41e935a152c2c325
SHA512 55396f3e5821d3f3eb5988bd3362a0cddf036de4afa8cc1214813834b5a152fc3df787a8347a7aff3de6bf112e1d2a354790f593854a59f1f49393ddf967d085
SSDEEP 384:77FRU8HM4Oe59Ckb1hgmLydW5hWjQ7q0GftpBjASZLN8ldBQ7Qa:77TjMq59Bb1jyYPiyS8Q/
TLSH
T15CC2F64789ECFF93D58B4BB312F0CBCA6D385AE25491B5B5C85BA0C834923D0BE47949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc
MD5 56c02fabc2c64174009c905570c3a22d
SHA1 e52154112ad127ab01937453490091def4d21ad2
SHA512 9f22f70b5de4078fcbfdbb186d6cf220561200092eb7ceaaad9d44a5281f84abfb1729f4e447dab3753225d5fc6c44d94363e3729e5765dd2213213c327c4c1b
SSDEEP 384:YbmLPmIHJI6/CpG3t2G3t4odXLBdW5hWYR4Zq0GftpBj2q8ZWlGinjge:PPmIHJI6PY/47iok1
TLSH
T120C2835B8EB86E12D58BDBF3B5F2C7C63A354F8104C07375A56B95883842BE9BD06D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-private-l1-1-0.dll
Size 69KB
SHA256 c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac
MD5 4b27cf5cdb20aebf113df752019ffca3
SHA1 b02c6e45f704dac118f81c324122c189e3e61e17
SHA512 cd4df2478d719e159e2252e6784d24e4260c13d8f47774ac33a8e10b1fa96d38236bf2c3ebc060a5801fc19392cbe5c636befa898721bf114956c2be6476bbd1
SSDEEP 1536:ccXDvBRh1De5c4bFe2JyhcvxXWpD7d3334BkZn+PAc5ed:cczDh1De5c4bFe2JyhcvxXWpD7d3334+
TLSH
T16E6329DB49EA3F61E58FF7B367FB17C91B253A4408806174E9C7956B34853A9BC43A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8
MD5 fa677cfb18ba1370d8bb98681c48cfbd
SHA1 cbccd561bf53c59254fb04ab136996b81cc80d3a
SHA512 9312acd4955d4950d851910198d4ee622b75e11262e409c79391078d12d2d0db320723a1552048acc0e9deb30378e3cd27d4fabcf2077d429eedfb275cdb73e3
SSDEEP 384:BpOSA1W5hWk80aq0GftpBjy11Z+lTMs6WbL9J:vlkiM+TFJ
TLSH
T1CE922AC7CBBC8993E9935E3012F8DEC37E3A97C758109165946AF0DD28833D5AB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
MD5 595a997bd415c8ae0ef1e3c3b73e6091
SHA1 10f34bc2f474a43bfaac26f66ec8081106c12253
SHA512 944f6bc405c69d6bf6dc97652e9f296658bd3de078dda50ac680e56818c00dfee909b100fc2fa9c6a891c55dbc66dd62ac52819950732c83198dbb8c04f3c9b8
SSDEEP 384:ETr7ZW5hWgvT1Nq0GftpBjqZaljZYsqn3:2r7Ep1viwLn3
TLSH
T190A2F7838AFC6E53E9875F3212F8DBC32E3597821910516A88A7F4D838C37D5FE26519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
MD5 415d765aa267382a79e56e428c80b1e1
SHA1 1bf13460b8aaac1538bf45186a1624825bb8c355
SHA512 7236ef7b2937718409ef4eeda20318b1697e7c1c868d0df263f4be8673365d48ff6ffa2317bfd1881b6cb3dd1300410ad4f715b8e01ed321c4011aac88490d21
SSDEEP 384:xHCFVh/W5hWOQ7q0GftpBjDdZNil78oStBdo6:xHCwgiT7Aa3db
TLSH
T179B2088385FC6E42E6874B732AF9EBDB6A3587C3281071B98417E4D835C63D8BE13419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
MD5 5bd5a9001cb0555c5b2b14e0cbc8d922
SHA1 4562d23fba312fe95cbc777fd7c2e37ca1e76ad9
SHA512 a6271f28f069a00c2912f80552bd54bf0d8461886adff626b336d25943dd0ade19eb88c718602017a1986317af3eb5f94f8896e88b9367207e8b53225322cb84
SSDEEP 768:Yl5yguNvZ5VQgx3SbwA71IkFMLirA8Fma3dnL:Yl5yguNvZ5VQgx3SbwA71IvL2maNnL
TLSH
T147B2D8438AF87F42D98B5BB265F9CBC36A388F8615101275C467E4CC38827D2FE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
MD5 f719ad4c04043f55a21e73805997b287
SHA1 0e88b1271b242f7933e78edcb05131612cea061e
SHA512 752b9b4385162126729c3f09b3b75d7121c8dec00cce11f7cf1ecaffed3e79addcbcfe8bdd4e20e15b8494bfe2d24c3f2d11583860b1e03be021196bc83fc3bf
SSDEEP 192:N3LD3WuufhWrzGxf/0uDBks/nGfe4pBjSbA097b8WebtuVaVWQ4mWmVeqnajiPNg:N3W5hWq3rq0GftpBjr0974ZVelg+ZmJ4
TLSH
T1949207838AF8AA43E9D75F3112F9DBC73F3997C21D5061664166E4983A833E4BE2581C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
MD5 a405399d5b958a03e6054307a631553a
SHA1 dba43f0afd8c6e1f61cf0be7503c6f70b48b8240
SHA512 33c64766053058fa9fa4fe689f1ca5a345b8b70443995d71aa65b64c7bb38d4dc3a2b37ad06a4ce5ca1c927ed9ea4377443eaaecc69b0e758ff265e755194287
SSDEEP 384:IbNfmW5hWBTMq0GftpBjZtwZkilTMs6Wba:WfBYuieGQTe
TLSH
T1B1822A928ABCD583E9975E7063E8DAC37D3DABC319209165516AF1D828833D0FF1192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\LDPlayer\LDPlayer9\vbox64\concrt140.dll
Size 310KB
SHA256 01729ff33c2e3db1033fb86e899d62026dc1c03705269bb9636227f61934d9b3
MD5 67a3ad0fec3eb767e423e3d7a9134343
SHA1 42949506bc8451031425840df33f3acab5637b52
SHA512 f3b13d38f44acf37c5002f08b684cb2955b778c8a703c8fca6e07eecaac45e1bf4bb036dda055114152390322351ef936492abbf6532d1a48fcfd29304b4db1b
SSDEEP 6144:ZEI93zcNn3dMiBXHxHSSXfPnevwbbeVuX0cp90nWzgQQf3PzX:WIlwNqihUSPP2uzK
TLSH
T13364189A36140CE6F967D1398A53C90BE7F2BC416362D3CB0264879E5F537D0E93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\vbox64\crashreport.dll
Size 51KB
SHA256 6f35dc1553fdc0070464004e9ed1f5eb17ac5979405b1f30a9bd8240ca5019b5
MD5 488dd1dac662038f7152801dc01b21bb
SHA1 5e3bdce9cae493d993f94c9f47ef58581c26b29f
SHA512 881dc7b48d21e3b0fd1bd7f1916d73ac9e6a59edf228fc16a4d4de61ef2db8abb8c32c62324f4a429eec111c75ddf5ffcf7e69b5a8e502532a4f5c4655a039b3
SSDEEP 768:rNYs6LsazaYID9XICSszm36nVl8xzez40YiDLk5wkFQG9YiXkFQT5ALJQ:pOQQaYIRzjVl8xqzf75+7ZD
TLSH
T174339EAB47D414A5CA17D670B8E2AA17FAB3B2950B51C2CB2330C25B0F72BD13F79255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 641B
SHA256 7caa72e52aad1f502150b776ab62cf1186223dd905f2d6a9119d3893e089f7d7
MD5 dc9193dff4e00fef971af4f0603fd3ca
SHA1 4e6d5c19b1598ce5ca2ccffce9ff5d0520c8ab2a
SHA512 af85e62ce9f83fecb149884257f5d3844491453231a126b7886f48c50f1e25f833d663cb693fc716306beae6dc239efd31566ecdfb086c6ab3725bcb054599d5
TLSH
T1F0F0FF22EF059C2F04E869066C149701FC20960F06657667B33E2D194B69CADB3C6832
MD5 SHA1 SHA512 TLSH

Submit Download

sdcard.vmdk

Path C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk
Size 35.1MB
SHA256 f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6
MD5 4d592fd525e977bf3d832cdb1482faa0
SHA1 131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef
SHA512 afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77
SSDEEP 768:oUakI3gnG30jnzln5pxn7en1njvfVnNnXnLA0Y3bb/qWE6I0eYyU:RIgGCzlt7e1T9NXLQX/qWE6I0eYyU
TLSH
T18D87B51358C9A522EE2D3732E99B38028EC60C9506F12B4749F53EEC0BBF5E5B56D349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roboto-Regular.otf

Path C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
TLSH
T188A35C4A7753AB49C5126A78C695C3A83B79BD69BB03A21FB1BEFF3211030605DD81DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 44813964756e0bf998e1b3c7132278e0880cfc8237bbc3864801d7b891ae612a
MD5 b7b7ca49504f321ab2a857ad7c5545fd
SHA1 337db99268034a600862e2dbb969223437484c8d
SHA512 34678b95c80de709592d73bd0d37842f4d705375bbd09a3c32fbea2c2419b60473ec30c6768c378eabe5d89673fd1fecf4b63653215368f4e5cf06ba8660dfc4
TLSH
T1DDF0D40544F264343E155C8C9CE58D793208D0342C7791F57E6468D6A411BBAF555150
MD5 SHA1 SHA512 TLSH

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\988B237EEF5919FAB97ED3A790613BA6
Size 471B
SHA256 f3423304c9edfbb6d014ff2cc46e80723a727a390305a9dcf136dd0fcabe738d
MD5 e8ff8a3e75f6cdac8a993e94ca52faeb
SHA1 24bbfa3786a078b0c8e0775147991e5e8e782b3e
SHA512 04c79eec617b36ed12d4da8ea7f545cc2c52857e0c805b0fc38e19380700073ec23932874de62d0d21c9aad54aadd7909b6b7f90a810e361747ee7d90435d5cc
TLSH
T11AF0D403A24874502B1D6E2415DD7577FCA079647C9D8615DB6CB395580F7D80301A74
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 471B
SHA256 406b33091ae1a8eb0e78cfcd2fb9574e765d4ad771df1d9278503c678a90e63f
MD5 675699b6ccc29d499a7dc09430ee882c
SHA1 7a39c96fea27ec87d70f5cd60bca4bfa7562731c
SHA512 47059d29057f604feaa8d70e62388aa062e5cb967767695183a55349948dde1c6f2ae486773e711238f7aa8106258182a6513fc4f14984283dac4f19d07eca96
TLSH
T14BF05461C1FAF9029A5048EE89904776E0109C3A0C114147D23808D488A47FA8B1F437
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 b4da3ed1cc19ecbc7e16b6b3c38e00e78f165ce8e0104d23d169a7c5ef0e9c3a
MD5 53ba166e40661dd745d6dbf27134a434
SHA1 23214ddebf04b71577f340669dcf8ade106f7051
SHA512 29103887d054c69e9c1a498bc5c53f88a38356284b4eef5a89dd8dfb3345a3421f8dc97c8ad1920823a4a35c0ce13951cd077dd43f2ee943696d4503528b3d82
TLSH
T121E06F2405FB02BCF0B0EEB80BC69562486BE1002CB882AA1AD0022AAB0B501DC73C30
MD5 SHA1 SHA512 TLSH

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\988B237EEF5919FAB97ED3A790613BA6
Size 408B
SHA256 9bd177e8a4f62536d99862551a44bc64f2a515855af79b9cfd15185c5f149c3d
MD5 fb1799a2016c8d2b97919c685042c834
SHA1 43c8ca193462eb639a419a79a8ae26180ae36d47
SHA512 79962c1c7155a18f7b51264b75230906040a900e2d9f4b5c3824808f5a8845ae04a060fd3e2523218af81371c2fca36f2ca26f49a0b34d8d51678949107a3de0
TLSH
T125E0263C51FA835DF275EE79C2C971A98C99F3264D048B7638D10207B712D429E62D74
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 416B
SHA256 555f418dc606645bb1468c584056bf044cc07166bb220a965b07535aff411581
MD5 891966981c1fc575fceddfc5bceb4dea
SHA1 e46c54186993b69c6ed74f7a0f759b5a218f61c5
SHA512 2d601ab17d24c7cac9227a2b4fc5111d0e1a10a1f95cd458278e70f20d5345c6347b25b5ab04559f74a5396c827b1d08f31cb1a358140cceda306523f6fb23ba
TLSH
T102E0C03800FF433DF5F8E4388AC97A2919ABF2210459E2B00BD45B18F201A00BC02E30
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0181141062da123c48165df0d093a0e55afca3eea8ad027fb9481928caca78a0
MD5 7f70ecf3403463cf7c2454474fd1c5d7
SHA1 685610646b0cc829a4afa1a27aeea2d7570f020b
SHA512 463f9dce8208a06625744baca2901f95c2cc5b3660de1e9403e02c31d9dfd4907be356493577fa99579f2df1107603dca61930833d91b8dec3af77fdbf2b29c9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T167B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 70c0c72fe90de6529cf74c0077f32ecd0c55762fef9b7105d290401d88bf9258
MD5 c6f6edb6b409bea5d99970b535d30156
SHA1 dbbe6f4872678ecf204a6a04a1caa24742f1ab2a
SHA512 f2799fab63f57335520b28afb3431257aa24f39a96180a9d263c45294fe2d0df83bf1876c58fea8fc4af2a299f737ed2372d3c67ad74494b2dbd40d050e2c4ea
TLSH
T11FD0976077C9F802E1B60036C1249304635804C020A7C503E0A0880E461F0706BCC2C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a093602cd9140c2ab9b973d27fec0263c0a8fb5df2856001c726b1ab2aea870e
MD5 f6059ca67419a3a09fc4d6ffd58fba7e
SHA1 6326c23811d7ee5f83dcc541a27d8880f5c00ade
SHA512 a6a96317e12205fb4f85e00c7edec54063a73e572a37da52ee53996a0f847e6830f003998bb423bb93895e38693b89840fc5c3d3c9f24f564f68bb3460325408
TLSH
T1A9D097B0B6E8DC95C0B60031C0249320A39602C46013BA4271A0845C982F0286ACC686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc38eaa958466dde682449e5212f04bbd4577b79b26db25ec3eb5b978a381ede
MD5 c0679e30e2afcbc51acdc64250f4ce96
SHA1 a897b0c781737ea30abe58c32db4e2a684d72ea4
SHA512 08df1a98e654fc77899f1d652a9a2f7ccf3e1aa49a6cc720ea415874a179afa54b36e19b685a067155721ac35627587bc5c19560d1a1a9f39c7b8bf06692ab4f
TLSH
T1F5D097B0BAE8DC95C0B60031C4249320A39602C86013BA4271A4845C882F0286ACC686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 3bb118e46b10784cb1c8c23ac004ae0ab820e02c2c8367a33b8d92fb5a50a9e4
MD5 f26d623ed84439a197b35faf06d6bedd
SHA1 f817b2410120baee26a786545bc42c89597d08b1
SHA512 4cac93b23d1ea86d262fee4da0a73f186737c92812b62cdc8cbc20e237d8a2fbe932120b37ee29dc49043bc16604ca79aede68c56da2efcbfdb64d16429fa87b
SSDEEP 96:3nbrwzjFjtQApUdvuIHERjtbnKB6+9h2D7d30zAC1FD5+2Tq9t:3brwz1tzpUdv+HJ0zAyD549t
TLSH
T18012F5E9E7263A62E3D04734C8E207E4BCB6F4C9444B1D831BA858FD6AB63944CD316D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 185cf5a1a230ac255881a1c0d29bfab9ce1b925fa27b963e8c5cc13fb165a470
MD5 bf8064dc44a3d25a15e3376107c0b908
SHA1 500ff1589b1e424c6f583eb8555b3572bf352ce0
SHA512 e5b4e1cf0143070b55e3b067c53af0caf416e9971dc5443865db28224d570a4b980a5fa9982b4185a06befc7d5a343e1286ab1a3069048c502d8823605c9f5d6
SSDEEP 96:950ZOg216fpo6xCTmDgmttNRhABvBy9DTsANjbFFVl181Kq3ya5saslSRB:95YOSpo6xCTQLRhmv49sOoy9awqB
TLSH
T16A2219D9E7523A36E3D01630C8E207E07DB2F4C8444B9E932BA858FD5ABA3900CD316D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5ac005.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ac005.TMP
Size 3KB
SHA256 0cc64f7336c716b6c1729021620b4afd209d0be91ffc0a9c80b1de3e3ed92db5
MD5 e2549763a76f21359b4bf48b44a0ca00
SHA1 0288b8196c7bd9d01f5da01c6fc0760c5acaecf7
SHA512 18762d7956508143c0a034731e6f7789b74b456812c438eeaf6dcadad4f819a32e8dd1dc7e237c5f9b3ca884d9bfea78840f75d08dfac10c4140052270fc0a88
TLSH
T1DD71A32DC1627773E3918731D8F301F0BDB5B49E194F0E960C2C58BE6AF6B518C18268
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7aed214a-10c6-4764-a489-cee7441df984.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7aed214a-10c6-4764-a489-cee7441df984.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 950690e803cfa5a4903c5989784dd8d0989f954300f6409ecbb75b6465a938e4
MD5 d1b170a8e81f20ff6ee65ebd1bad97c0
SHA1 29a129cf2d3a4f57edfc3e3ee52fafdbc6b8547a
SHA512 0b2d7d74dd86e0fb16bd83d411919faa429e7337db5e696f6c750eeaf10b76e988866af5b432cde001eba4c93f4efb3fb751abe4532d35317d936db1c8b4fc8b
TLSH
T1D25189F3C3D8866DC91516F4AA243E2FCE2D095443283D6AC9E4AF0F93E2461E18194E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 1ec2e1222e43edd2862cc404a0fa3eb7d86513a4b5be79a9bda005d2eb0ff209
MD5 23815ac670c6143f23037a5930b0139e
SHA1 1e679c780663acf86ac5a73c30e917debd94f775
SHA512 f26623cb658dc464c4734131c6a9ccb8217ace9832fc7016f98623a09106ccc11a1f120a89848ecbfcce6289c923cd8af4cf2e519ee50c4532639b765c947c59
SSDEEP 192:DjHC2FL2aj6qrnevsL7hZxTxIrrxVGkn85hUJsm1RIxdClBvrUHexKnkxTG5Yutu:DjHCAL2aGqrnevsL7hZxTxIrrxVGkn8C
TLSH
T1B122ABF7C3E88A6E8D6551F5BA152F2BCE190914435C3C6ACAD4AE0B93F68B4F10194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 daca083631f038e096ee86bc344e638e6f2c5f0fbb51cd91c2392a86fdf094ca
MD5 e8bb94d88df33e19538210ac0e9755a4
SHA1 297184581399dc6fbcc9dd0c71db87ad0ec188e8
SHA512 f4542349eb7040822f60a3735b6feb62bcdc829e584004d20bb94c361ecc23e82b67e91c696d1ba58c174ddcb8d1f2b52177b33ddbd2572b015a2daabd79840c
TLSH
T1D651829782FFF42F20281ABB1E497C0529B5A4350762A4F5DBE6986CB0554FB0712477
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 35b407c7c64fd134752dd6bd7b106374f69deb0758ac2f98e75b41bc823081ab
MD5 beae25fcde4cd488de7fb49f8cb2d011
SHA1 3634862f2b5edbb581395c616fd721d0e0d2ed6f
SHA512 582b7f445885b10b042df63396e653148f774a5e2c4b90798e29ad67df4ffc4520f8ff8f7a413a16a90544d618c8c35c15ef93706825e0caf2db48e5ad1c3e00
SSDEEP 192:zZy7R6yM/jK1Ml8McU/fisNNVFEdpnzn/W6+WNzkF/Y0Yf6fIgyJ:zZYA0U/fisNNVuL/b4/5hO
TLSH
T12142DA126A345977CCDBD209BD51BB53D6F5057292940E48AEFC9A1C00E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 747faaba30e1edb5633224fc3f0b45e835ada202cb92ba8a08ffe3e0546c2bd6
MD5 f57c14c4744aac41fc969ee5db3511f5
SHA1 768615e7a535b77d3245dca77207766c9982bff5
SHA512 4cea63aea9234f9b8bc3df9d6973f4e11b91857651a7a91f43e2638173f854c60a8ac22a52235fc041c3fb575bb426e4460d2f55c91c55b9e456342b3e2cb6ec
SSDEEP 192:sxZyrR6yM/jK1Ml8EhU/fisVWpV+NVyha9Idpnzn/W6+WNDQkF/eBe0wrRUtIgbJ:sxZ8ADU/fisVWv+NV0a+L/bJ/eZH9
TLSH
T1C462D806AA7459B7CCDBD218FE55BB53D6F9142292900E44ADFC9A1C04EABED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 9857f4725efc388bb015d0b09218ed139a870d1a624b1ab307079f170d7a8765
MD5 d6e5a14b0e1650266a645cef94de302f
SHA1 994e3308d6e794ee520e87e173057fc7b1e801ec
SHA512 7ba7848ff031a230b7ca4a9609fc5bd64613d97f575aaae5c6112e3d62a302275601e1353e3d61ac017bb0c9a43a9914d233e5ec7deadb60ef9a789b51a3ba5e
SSDEEP 384:sxZ897U/fiswWvkuD0aaijh/bqv/8rBAcjukriVO39:skxU/f2YkU0c9/bK8rzKk+IN
TLSH
T1FD92C753A5B44DF74DD6A225FC05B72BD2F4042696904E84AFFCDA1C00DAEED7202C9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 80724a5f327a722d58dfe9b45bc4ecab31f1cb6b5936992d2229e4f4576b6383
MD5 6fb1b0ae2da0b5fabc5e90ce6b018117
SHA1 98ad38f1595ecb33422145d4ab80b67e879d64c4
SHA512 1121cc9ac94e5c58ee00b9fe464474cb5b309192291e4055f72d616a8dfd724245bbc9c1a78e812572e3f945dafd31192184522284958be78d627966ce19feb4
SSDEEP 768:FklRj8Zr2q97pLuL7MmWRmeKQ/C8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kh0ALlv:FklRj8Zr2qrE7MmWRmeKQ/Cu1jaKkh0E
TLSH
T14EF21C3B780CCB7E4F844D9CEC26BF9A6DE801CB9A9C895447FA444C02C66EF551A1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 25f2d89f34d0642948dce5f887d0a000a1c46dadcf1a12778b81e15e34612a45
MD5 8a46026ac6219abefad47e3790cafab4
SHA1 92ea034c834eb28b59b5741d91f255b19a67e8c4
SHA512 2e3b27aa83f7caf98c4ff02783488861fe6e9f3e2630aec62da1be3d739200980be824a7e634a5962a5dc4e11f456785bcb306d38c57f3749188bb42ee3d5c0a
SSDEEP 768:Fyl1j83r2YmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3XALl/C80/9Wroc9:Fyl1j83r2YmWRmeKQBCu1jaKXALpCN/K
TLSH
T176E21C3B680CCB7E4F845E9CEC266F966DD801CBAB684D5447EA494C03C73EF512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 aee9f96ff51b02a8f7d185637ab5899071889f1af3ca04e2f0bbac0dff21ce1a
MD5 c2f55cb9d431a5a1647058f6d58985f0
SHA1 06501d75ac34e5f43f2969f5ea4cada75cfef25c
SHA512 e1de695773e89977d937b0b3bf73a94a7fed5cb62daac6dee23e8267e11c46abefc0f1aa8e41b7b2bd18bfb530670256fb419253eaf5b3d0b620568c042793cd
TLSH
T13AD097ABF0434082E77F4A81023290EE46613DC8284A928CF45E362D1C71F03D213F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 5d282a8dfdf3a76bdb7a1e91b7ed2d00ccfcad647a4bf96fcb7354f08c8aeb98
MD5 aaa750345ae12864fb48b667af4b9660
SHA1 428a6db573144d039e597813f23c599f47cafa7b
SHA512 387ccd4e5d5f49335cd9bd7711f89bc251e61b758296fc55cdd4e576cb3f6dc6f03d478b2d0f2c8e84bb21b02fc7fa2b02ddc83b9968549900af1f6002fb248f
TLSH
T112D097ABF0424082E6BF8A800232A0BE461139C8284A928CB059062D1C41F03D203F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a9905.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a9905.TMP
Size 138B
SHA256 263917e93c31433f228dacd9dae74cf8c30387088724c4ea7b2dd6d4f02cda53
MD5 6797b8dd254254041b7db18420c71771
SHA1 5e94d207f3aa36d33b3028b87050051d4d4bf8c7
SHA512 4d9a507fe783ba65be2346c61b3f833ac1f430f3495e194d1e79d8d1b3ffaf68e40ef1d4c336ebaccd82ca6ec8c135fdc3bb1edb1a8c469ed83e76ebcf568b94
TLSH
T16BC04CABB1850556976A06914232D1AD57462EC85886C48D706E36582475E176203EA6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 9aa9d5e8a94fa0a4aa61663f14b5618f0cdd3eada47a3acfeb575aba2c52997c
MD5 54c28f575a8f44c7085459855bf1dc88
SHA1 b7d0e32ed80e64132f7a3e71052b71dc3616a726
SHA512 d2b0bad94be9a53e6d4b61bf88f73b052650d5df9695e299d356307d939a4ef952dac9ff91ab3922d613e32efbe67dcb9f9ede400028fc98a5fba39270fb8edb
SSDEEP 96:KkUgKtem27GKEAmuvaKswHioKvaGiqYKXKsA9:6v1tlXbXw
TLSH
T172E1290230BF22413C7E6518A655872B1B42B3733114A5AB7FA951B20E27E346DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 236B
SHA256 2b8b5ab7f3e22aa98b2a4a00721085a71cf91cc640dfbee6bdbfc0d252e723cf
MD5 27f6c468a2e8b1b23aaea456a71c43c9
SHA1 8203e181b5e299b13ff5c8ca546a09b690070800
SHA512 635cd93d89fbe866af0c9c22e48b7189cbe4f9e4a6af3d8685e3cb07a2a051ee500b54e0385158c3005bdd7fa2e16d6cd7c850cde2099a9da3a4390d2b972072
TLSH
T1DAD097E20730C8461630A9C87260B20DC023DF4ACC82CCF0E901B24A1838F03E007961
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 152B
SHA256 ad68da10998f6c9ea143d99bf393aba368800b85a959ac5d33c768952cc69a23
MD5 071932008c8f490850aa15f19fe78aae
SHA1 7cb32f304f4b6c29e9e7d31737eb76ff09aed839
SHA512 bcaee6422e46ac17ea6de9078ff5c446a36e0bb6a4c5464673f6e8d89580b85b3ebe2bdcfe4c99c8d60663b5a51059035ccc34569a4759c7d486e97e6b8a7c65
TLSH
T170C08CE30A00C6860A36A9C83290731CD127C78D8CE1CCF4E105510A1038B23E803A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5afcef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5afcef.TMP
Size 159B
SHA256 032de53fb6ad2b4f7efc328d50663385c050e1dbf9e0c6ec5c73da7a95af91b3
MD5 e820127e99449f00458541ab5adceb7b
SHA1 4c54913e70852ecd26e8fd41ef8fbc61702a6f47
SHA512 89e53741ad1cd4045d44ecfe4c5447994ce0545fea3c403b0e6cae4a2bb6b84e4e92441b264585e8add58f66e46aaed7eaa71ff646f0549d1d9c87b9be02125f
TLSH
T13AC08CE30A10C6820F32A8C431A0730CD127CF4E8CD1CCF4E106714A2038B23E806A34
MD5 SHA1 SHA512 TLSH

Submit Download

aba59119-9922-4e30-9c49-872a13f4fa9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aba59119-9922-4e30-9c49-872a13f4fa9b.tmp
Size 414B
SHA256 8d1d6f383c19ae7917448958e3b991c8cde5e450e2c7d938fc4c5a5b0f1adeae
MD5 7cc323e5465c51da8b4a615a40425485
SHA1 24866483ff16e372639cdc4b1df2a34385c64785
SHA512 4022881339e37c75555e80d5dfb6e1a85c98d378c2dcd6af9f36af1aee0e1ad690a16b2745d9b37d4880798407f9d18a336e5be56ed59cf139f7d88eb8aac806
TLSH
T150E061AACC21EC7B48FD1B5974248F06EB9203672781890F3A3D91188FB49364245D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc631ad9e3c8b0dac07104bbc1b087d0103975890deade48ec44fc9641a39201
MD5 9299a2776ef251e5a5288bbfb0f0e67b
SHA1 20a6886038ea67044285d9f510c11530ddfd4249
SHA512 d8ae16ce4c694b3f5a14bb3978b96d7f9be068467c1835d32a0ae85b9ca316cd771694c7ae9e5c9300deeb8f90563646bdf193a724ca554b1276244292f17715
SSDEEP 192:6GNz6i5fQmiUySdvO7X5zPr2xjzormDZ+Raj9nNfXU6:6GNz62hRVO7X532N8md+udtXU6
TLSH
T13D02D935A9646C778EF3AE45B58737135FE5112B9A946F84DAEC1B1C008BB8C1306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4c54d918e744656596e3833974461cf9bc11d66c0d9d7e9a4224283275b71b2b
MD5 983db21062e65e671fb43e648fd3491e
SHA1 4f7ea10f65e807244fea192948034cb0c416d872
SHA512 acab2ce2a7d789a7ece1803b516c4c3ccef2a42b40819003f50776087712cc9fd0f160cc675c13bc877a77c4719608c52b01d1c3d63cb6a38d5a89aca8fc98bf
SSDEEP 384:nvurQXjZxh6Vl38NM49lR75XgX532N8md+SX5de7uoiaSKxGz2TdFxOOeBW1Z1UF:vur0h6f3KlrgSX5g72aSK42JzOjY45
TLSH
T1DAC25A3D9C645CBF49AEBB08760E2A371EB8113BC4B41968D7D90B0DD077A99F346D21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 510c78258a0e4f4d35923ebd56b597909771dcbdd49ddd062c017598c51246d4
MD5 bdad55d42ce1d6c6e6144e2ff2be83a1
SHA1 b078b5b9760be1d50ef0e34896ff081563b9234a
SHA512 4456b71cf084edd1f5df5f666847845f3ecbdbcabd903bca94012123c33b394a46455b17b09dda6a1c93ec4db928fb1bf972d68d6a9572bb61ff13ec967afaac
SSDEEP 384:zh8N5j9lR5xXgX532N8md+SX5deedtHg2:d0lFgSX5gedtd
TLSH
T133422931A8B99C779DA7B255B99B33635FB8107798881F54EAEC1F1C008B78C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f36b0ed3a7b1198afb1ae283a997502999e1f33bc669104a393b7aed96ff498b
MD5 3aeaacd32b4bb724b9db82ce7361102b
SHA1 c23f2a9a46bdb383d17997ee4bfe23c257a8fda7
SHA512 58eededc2edaff61e0a64f4b11226153a85597e0f436ca3de29a509a73857289135281206122fa7cc14363702c4cb4251ba5a5fc3a9135e50cdd272be43d1e4d
SSDEEP 192:cGNE6i5qQmiUytvl7X5zPr2xjzormDZ+SX5gYrewGQ9nHqtQU6:cGNE62mUl7X532N8md+SX5deydtU6
TLSH
T11D12E731A8A9AC675DE3B555B5C732635FA820379D88AF84E6FC1B1C008BB8C1749C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0b18ba701bd59ee3c4735e4c02963a2d91f92f801231c65cd0f0129057026c1c
MD5 94ac956255de2cec5bfe8380459c39d1
SHA1 3a182e04119103e758fd41a0e6dd8431edd70935
SHA512 eb3c5957424a41740cf893dd00d40ffe328d464401e07436bdfadca2eabc2fbe357bef8e644a92d6bb435ee551c46d62e81252aab6c0ec8c399f56c1c8960130
SSDEEP 384:nwurQXjZxh6VE8N549lR5zXgX532N8md+SX5deeloHfUQO9rkwW8TdFxOOeBW1hM:wur0h6Sll3gSX5gewfXO9FrJzOjYZG
TLSH
T118C25A3CDD644C7F44AFB709764E26361E78013BC8B85968E7E90B0DC07AA98F746D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cf91e2455cc82f8dd50889aefc63fcf530a6f38bfbad9dd311767975e44d5391
MD5 7abaedfd2d9801df9ac23c93d3e8fc35
SHA1 7e1488ef0d6077be9f71a0785101b7ee06e96de7
SHA512 e93a171565d21e6d96fac1bcee6ab835ba6074cc78c653669d385ae82181972b36950a84f27479583e2f7b4ecd124702bda4f98ce093124c8e9087ec0617c0bc
SSDEEP 384:nwurQXjZxh6VE8NM49lR59XgX532N8md+SX5deAGGTdFxOOeBW1Z1URIzyh5:wur0h6SKlpgSX5gAGGJzOjY45
TLSH
T173927C39A8B45CF75EA3AA46BA5737232FF4106B84D41E54DAED1F0D008BB9D134AD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

421bed86-3823-4803-a916-34d80e352be7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\421bed86-3823-4803-a916-34d80e352be7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5c3cd9a1-515b-4634-b56b-fd6298ec5afc.tmp

Path C:\Users\Admin\AppData\Local\Temp\5c3cd9a1-515b-4634-b56b-fd6298ec5afc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9bf22b3f-b5d4-42a7-82c1-cb9b6f61cd58.tmp

Path C:\Users\Admin\AppData\Local\Temp\9bf22b3f-b5d4-42a7-82c1-cb9b6f61cd58.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_1970219255\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2162ec72-e54a-4ff4-ba65-47f1dceac815.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_95002181\2162ec72-e54a-4ff4-ba65-47f1dceac815.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ldopengl32x.dll

Path C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll
Size 162KB
SHA256 41dd1affcbdcfd3f0788976319c74ebffc7cb4fa0a54acf7885c78484227640f
MD5 dabd06a62c7c9e89e45367f5906ad842
SHA1 025fc3f081c759efefde1eeeed1e2bd3725f847e
SHA512 254e4a39bb2dcb368075a16c3f8d4d2a20ac9a963becbf39dfbbeabd9465d567a2f3724f91388268485d2e3337ff718710c289e67a750a39c580902143314f82
SSDEEP 3072:EV/CwNC9P+d6kDheD1uLJx/s2fnPJPlAlzFgWXEJlSH3VGAvYz:fwNO+ZDhhP/fR2RgWsSH3V3Q
TLSH
T1FDF35C1223458135F5FF167CADB87B6A527FB4644BB041C3A384896D6E382D2EE32717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-859-0x00000000726E0000-0x0000000072707000-memory.dmp

Download

memory/1476-716-0x0000000036570000-0x0000000036580000-memory.dmp

Download

memory/1476-860-0x0000000070F00000-0x0000000072333000-memory.dmp

Download

memory/1476-869-0x000000006F220000-0x000000006F246000-memory.dmp

Download

memory/1476-867-0x000000006F250000-0x000000006F36F000-memory.dmp

Download

memory/1476-855-0x000000006FB10000-0x0000000070C1E000-memory.dmp

Download

memory/1476-858-0x000000006FA70000-0x000000006FB0E000-memory.dmp

Download

memory/1476-866-0x000000006F370000-0x000000006F3C0000-memory.dmp

Download

memory/1476-856-0x0000000070C20000-0x0000000070EFE000-memory.dmp

Download

memory/1476-857-0x0000000072710000-0x0000000072740000-memory.dmp

Download

memory/1476-864-0x00000000726A0000-0x00000000726B9000-memory.dmp

Download

memory/1476-865-0x000000006F3C0000-0x000000006F3F8000-memory.dmp

Download

memory/1476-2292-0x000000006F250000-0x000000006F36F000-memory.dmp

Download

memory/1476-2293-0x000000006F220000-0x000000006F246000-memory.dmp

Download

memory/1476-2291-0x000000006F370000-0x000000006F3C0000-memory.dmp

Download

memory/1476-2279-0x0000000070F00000-0x0000000072333000-memory.dmp

Download

memory/1476-2290-0x000000006F3C0000-0x000000006F3F8000-memory.dmp

Download

memory/1476-2289-0x00000000726A0000-0x00000000726B9000-memory.dmp

Download

memory/1476-2277-0x00000000726E0000-0x0000000072707000-memory.dmp

Download

memory/1476-2276-0x000000006FA70000-0x000000006FB0E000-memory.dmp

Download

memory/1476-2275-0x0000000072710000-0x0000000072740000-memory.dmp

Download

memory/1476-2273-0x000000006FB10000-0x0000000070C1E000-memory.dmp

Download

memory/1476-2274-0x0000000070C20000-0x0000000070EFE000-memory.dmp

Download