8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b

Analysis

user interaction
yes
max time kernel
213s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_1552109_ld (1).exe
Size 3.4MB
Sample260626-e7v1gagy6z
SHA256 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b
MD5 c329a16ec3b4832e67ad84d6f6742d32
SHA1 0e91bebf54cb532293cc35cbec1ce41d35aaaed6
SHA512 5619569744565ab0c3ccd627370eaebfcc274d414bbff10296b9af737fa91d20585d529ef9e16426be90402abe9fdd402ab0fc922d5c3ad341f98d98b0e36d8e
SSDEEP 49152:tNsyYfhdpopyX2g3SCXKN5Yh4paWiNhK9Ioz6rfMWHytcT8bN8amDeDahSSwP0cI:t6yYfhdpopyXt5XyRUourfMcqbsB8Si
TLSH
T1F7F5BF12BA818176F5E30171D8BE5BBE4939AD31072494C3D3C4396E5A61AE23B3B74F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution exploit persistence privilege_escalation spyware

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.1\FuncName = "WVTAsn1CatNameValueEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverInitializePolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222\FuncName = "WVTAsn1CatMemberInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30\FuncName = "WVTAsn1SpcSigInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2002\FuncName = "WVTAsn1SpcFinancialCriteriaInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4\FuncName = "WVTAsn1SealingTimestampAttributeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPCreateIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.25\FuncName = "WVTAsn1SpcLinkEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2001\FuncName = "WVTAsn1SpcMinimalCriteriaInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "WintrustCertificateTrust"	regsvr32.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
4784	takeown.exe
4832	icacls.exe
4348	takeown.exe
2264	icacls.exe
3732	takeown.exe
4732	icacls.exe
1152	takeown.exe
220	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4784	takeown.exe
4832	icacls.exe
4348	takeown.exe
2264	icacls.exe
3732	takeown.exe
4732	icacls.exe
1152	takeown.exe
220	icacls.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
173	discord.com
183	discord.com
187	discord.com
151	discord.com
156	discord.com
163	discord.com

Downloads MZ/PE file 3 IoCs

flow	pid	Process
69	4572	LDPlayer9_ens_1552109_ld (1).exe
70	4572	LDPlayer9_ens_1552109_ld (1).exe
72	4572	LDPlayer9_ens_1552109_ld (1).exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer9_ens_1552109_ld (1).exe
File opened (read-only)	\??\F:	LDPlayer_0900051900.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4796	powercfg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\comregister.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\vbox-img.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-util-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-math-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ucrtbase.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-string-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qoffscreen.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSampleDriver.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-timezone-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\ucrtbase.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-debug-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\avformat-62.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES12Translator.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-environment-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ldutils.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletionStress.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetDHCP.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcr120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxRT-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSupLib.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9VirtualBox.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxHostChannel.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSharedClipboard.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuth.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxStubBld.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-stdio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDragAndDropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-file-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-filesystem-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.dlss_g.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libcurl.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\loadall.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\dasync.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdp6Install.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetAdpInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstSSLCertDownloads.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Core.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBTest.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxBalloonCtrl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5OpenGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetFltNobj.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSVGA3D.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxInstallHelper.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-environment-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-runtime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_CM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcr120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDTrace.exe	dnrepairer.exe

Executes dropped EXE 14 IoCs

pid	Process
376	LDPlayer_0900051900.exe
3172	dnrepairer.exe
3300	Ld9BoxSVC.exe
8	driverconfig.exe
1756	dnplayer.exe
4796	Ld9BoxSVC.exe
4244	vbox-img.exe
1380	vbox-img.exe
4244	vbox-img.exe
5504	Ld9BoxHeadless.exe
5664	Ld9BoxHeadless.exe
5932	Ld9BoxHeadless.exe
372	Ld9BoxHeadless.exe
5728	Ld9BoxHeadless.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3536	sc.exe
2904	sc.exe
2072	sc.exe
1764	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
3172	dnrepairer.exe
3172	dnrepairer.exe
3172	dnrepairer.exe
3172	dnrepairer.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
3300	Ld9BoxSVC.exe
2960	regsvr32.exe
2960	regsvr32.exe
2960	regsvr32.exe
2960	regsvr32.exe
2960	regsvr32.exe
2960	regsvr32.exe
2960	regsvr32.exe
2960	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
2540	regsvr32.exe
1972	regsvr32.exe
1972	regsvr32.exe
1972	regsvr32.exe
1972	regsvr32.exe
1972	regsvr32.exe
1972	regsvr32.exe
1972	regsvr32.exe
1972	regsvr32.exe
540	regsvr32.exe
540	regsvr32.exe
540	regsvr32.exe
540	regsvr32.exe
540	regsvr32.exe
540	regsvr32.exe
540	regsvr32.exe
540	regsvr32.exe
8	driverconfig.exe
8	driverconfig.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe
1756	dnplayer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_1552109_ld (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer_0900051900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1904	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4072	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269222810382801"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-04D0-4DB6-8D66-DC2F033120E1}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7532-45E8-96DA-EB5986AE76E4}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E621-4F70-A77E-15F0E3C714D5}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CB8D-4382-90BA-B7DA78A74573}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C8E9-466B-9660-45CB3E9979E4}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7532-45E8-96DA-EB5986AE76E4}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5409-414B-BD16-77DF7BA3451E}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0002-4B81-0077-1DCB004571BA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4A06-81FC-A916-78B2DA1FA0E5}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E4B1-486A-8F2E-747AE346C3E9}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486f-40db-9150-deee3fd24189}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7966-481D-AB0B-D0ED73E28135}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1EC0-4C0F-857F-FBE2A737A256}\TypeLib	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FEBE-4049-B476-1292A8E45B09}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B4A4-44CE-85A8-127AC5EB59DC}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-61D9-4940-A084-E6BB29AF3D83}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-61D9-4940-A084-E6BB29AF3D83}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B7DB-4616-AAC6-CFB94D89BA78}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6588-40A3-9B0A-68C05BA52C4B}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6679-422A-B629-51B06B0C6D93}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FD1C-411A-95C5-E9BB1414E632}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B855-40B8-AB0C-44D3515B4528}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AA82-4720-BC84-BD097B2B13B8}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-febe-4049-b476-1292a8e45b09}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-f7b7-4b05-900e-2a9253c00f51}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2F05-4D28-855F-488F96BAD2B2}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0FF7-46B7-A138-3C6E5AC946B4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F4C4-4020-A185-0D2881BCFA8B}\NumMethods\ = "56"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{20191216-9CEE-493C-B6FC-64FFE759B3C9}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-42DA-C94B-8AEC-21968E08355D}\ = "IDnDSource"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1F04-4191-AA2F-1FAC9646AE4C}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-808E-11E9-B773-133D9330F849}\ = "IGuestMonitorInfoChangedEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-08A7-4C8F-910D-47AABD67253A}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1F8B-4692-ABB4-462429FAE5E9}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4A75-437E-B0BB-7E7C90D0DF2A}\NumMethods\ = "88"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3188-4C8C-8756-1395E8CB691C}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-81A9-4005-9D52-FC45A78BF3F5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7f29-4aae-a627-5a282c83092c}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D545-44AA-8013-181B8C288554}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6588-40A3-9B0A-68C05BA52C4B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-44a0-a470-ba20-27890b96dba9}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-61D9-4940-A084-E6BB29AF3D83}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2F05-4D28-855F-488F96BAD2B2}\NumMethods\ = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-929C-40E8-BF16-FEA557CD8E7E}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CD54-400C-B858-797BCB82570E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CB63-47A1-84FB-02C4894B89A9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-44DE-1653-B717-2EBF0CA9B664}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-81a9-4005-9d52-fc45a78bf3f5}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4430-499F-92C8-8BED814A567A}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-477A-2497-6759-88B8292A5AF0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7FF8-4A84-BD34-0C651E118BB5}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-23D0-430A-A7FF-7ED7F05534BC}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\LocalServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1C58-440C-BB7B-3A1397284C7B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F4F4-4DD0-9D30-C89B873247EC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7BA7-45A8-B26D-C91AE3754E37}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-00B1-4E9D-0000-11FA00F9D583}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0B79-4350-BDD9-A0376CD6E6E3}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1EC6-4883-801D-77F56CFD0103}\ = "INetworkAdapterChangedEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-c9d2-4f11-a384-53f0cf917214}\VersionIndependentProgID\ = "VirtualBox.Session"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8CE7-469F-A4C2-6476F581FF72}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6989-4002-80CF-3607F377D40C}\ = "IUSBProxyBackend"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D8ED-44CF-85AC-C83A26C95A4D}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-32E7-4F6C-85EE-422304C71B90}\ProxyStubClsid32	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4572	LDPlayer9_ens_1552109_ld (1).exe
4572	LDPlayer9_ens_1552109_ld (1).exe
4572	LDPlayer9_ens_1552109_ld (1).exe
4572	LDPlayer9_ens_1552109_ld (1).exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
3172	dnrepairer.exe
3172	dnrepairer.exe
376	LDPlayer_0900051900.exe
376	LDPlayer_0900051900.exe
4572	LDPlayer9_ens_1552109_ld (1).exe
4572	LDPlayer9_ens_1552109_ld (1).exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1756	dnplayer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	376	LDPlayer_0900051900.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1756	dnplayer.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1756	dnplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 376	4572	LDPlayer9_ens_1552109_ld (1).exe	105
PID 376 wrote to memory of 3172	376	LDPlayer_0900051900.exe	106
PID 3172 wrote to memory of 2580	3172	dnrepairer.exe	107
PID 2580 wrote to memory of 4312	2580	net.exe	109
PID 3172 wrote to memory of 4276	3172	dnrepairer.exe	110
PID 3172 wrote to memory of 4824	3172	dnrepairer.exe	111
PID 3172 wrote to memory of 2896	3172	dnrepairer.exe	112
PID 3172 wrote to memory of 2248	3172	dnrepairer.exe	113
PID 3172 wrote to memory of 3708	3172	dnrepairer.exe	114
PID 3172 wrote to memory of 3296	3172	dnrepairer.exe	115
PID 3172 wrote to memory of 2272	3172	dnrepairer.exe	116
PID 3172 wrote to memory of 4784	3172	dnrepairer.exe	117
PID 3172 wrote to memory of 4832	3172	dnrepairer.exe	119
PID 3172 wrote to memory of 4348	3172	dnrepairer.exe	121
PID 3172 wrote to memory of 2264	3172	dnrepairer.exe	123
PID 3172 wrote to memory of 3732	3172	dnrepairer.exe	125
PID 3172 wrote to memory of 4732	3172	dnrepairer.exe	127
PID 3172 wrote to memory of 3300	3172	dnrepairer.exe	129
PID 3172 wrote to memory of 2960	3172	dnrepairer.exe	130
PID 3172 wrote to memory of 2540	3172	dnrepairer.exe	131
PID 3172 wrote to memory of 1972	3172	dnrepairer.exe	132
PID 3172 wrote to memory of 540	3172	dnrepairer.exe	133
PID 3172 wrote to memory of 3536	3172	dnrepairer.exe	134
PID 3172 wrote to memory of 2904	3172	dnrepairer.exe	136
PID 376 wrote to memory of 8	376	LDPlayer_0900051900.exe	138
PID 376 wrote to memory of 4796	376	LDPlayer_0900051900.exe	139
PID 376 wrote to memory of 1152	376	LDPlayer_0900051900.exe	142
PID 376 wrote to memory of 220	376	LDPlayer_0900051900.exe	144
PID 4572 wrote to memory of 4192	4572	LDPlayer9_ens_1552109_ld (1).exe	150
PID 4192 wrote to memory of 3416	4192	msedge.exe	153
PID 1756 wrote to memory of 2072	1756	dnplayer.exe	154
PID 1756 wrote to memory of 1764	1756	dnplayer.exe	156
PID 1756 wrote to memory of 2564	1756	dnplayer.exe	158
PID 2564 wrote to memory of 4072	2564	cmd.exe	161
PID 4192 wrote to memory of 3684	4192	msedge.exe	162
PID 4192 wrote to memory of 3684	4192	msedge.exe	162
PID 4192 wrote to memory of 3684	4192	msedge.exe	162
PID 4192 wrote to memory of 1904	4192	msedge.exe	163
PID 4192 wrote to memory of 1136	4192	msedge.exe	166
PID 4192 wrote to memory of 1136	4192	msedge.exe	166
PID 1756 wrote to memory of 4244	1756	dnplayer.exe	176
PID 4192 wrote to memory of 4164	4192	msedge.exe	169
PID 4192 wrote to memory of 4164	4192	msedge.exe	169
PID 4192 wrote to memory of 4164	4192	msedge.exe	169
PID 4192 wrote to memory of 4824	4192	msedge.exe	170
PID 4192 wrote to memory of 4824	4192	msedge.exe	170
PID 4192 wrote to memory of 4824	4192	msedge.exe	170
PID 1756 wrote to memory of 1380	1756	dnplayer.exe	197
PID 4192 wrote to memory of 4448	4192	msedge.exe	172
PID 4192 wrote to memory of 4448	4192	msedge.exe	172
PID 4192 wrote to memory of 4448	4192	msedge.exe	172
PID 4192 wrote to memory of 2940	4192	msedge.exe	173
PID 4192 wrote to memory of 2940	4192	msedge.exe	173
PID 4192 wrote to memory of 2940	4192	msedge.exe	173
PID 1756 wrote to memory of 4244	1756	dnplayer.exe	176
PID 4796 wrote to memory of 5504	4796	Ld9BoxSVC.exe	180
PID 4796 wrote to memory of 5664	4796	Ld9BoxSVC.exe	182
PID 4192 wrote to memory of 5784	4192	msedge.exe	184
PID 4192 wrote to memory of 5792	4192	msedge.exe	185
PID 4192 wrote to memory of 5784	4192	msedge.exe	184
PID 4192 wrote to memory of 5792	4192	msedge.exe	185
PID 4192 wrote to memory of 5792	4192	msedge.exe	185
PID 4192 wrote to memory of 5848	4192	msedge.exe	186
PID 4192 wrote to memory of 5856	4192	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1552109_ld (1).exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1552109_ld (1).exe"
1⤵
- Downloads MZ/PE file
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572
- C:\LDPlayer\LDPlayer9\LDPlayer_0900051900.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer_0900051900.exe" -silence -downloader -openid=1552109 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" cmd=install|listener=655880
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:4276
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:4824
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2896
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2248
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:3708
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:2272
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4784
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4832
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4348
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2264
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\Users\Admin\.Ld9VirtualBox" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3732
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\Users\Admin\.Ld9VirtualBox" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4732
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3300
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:2960
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2540
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1972
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:540
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3536
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2904
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:8
- - C:\Windows\SysWOW64\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /powerthrottling disable /path "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"
    3⤵
    - Power Settings
    PID:4796
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1152
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/g8Fhag9NxT
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff86503c188,0x7ff86503c194,0x7ff86503c1a0
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,3187332734178846679,6639011177894994197,262144 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,800777080110191605,13408800314507126119,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,10448942118866256400,800794793086939283,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,2326830988637229936,1033960065255886259,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,9173708780967589145,12707958515622361157,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4464,i,12521415757443674760,2271091900438161035,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4596,i,14703992275788003846,1180232322715587879,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:2
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,9406161027571369714,14313194709105860526,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5240,i,9295972731356102668,9511971538069268888,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3723302688008847757,7048499121007832673,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,7999369238765427718,4306527632338620987,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,12653215676791987734,5652352887325597469,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4212855902301499421,922811631140942132,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,1756776685888448052,13014968252954779781,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,1756776685888448052,13014968252954779781,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,13726973280924077223,368752482143594192,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,13514760971623087499,17025279968673660765,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,16228427764081045615,15955226694182479367,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,13896274510294312170,4526723816233427215,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,16587541000962192529,8056826763764022645,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6564,i,2247677598373155008,807372834714566095,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,10596529650290791209,14048424875475542214,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,324700917716627302,8744977477063465497,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:8
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7460,i,15094716792134490090,10960610770737639965,524288 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7384,i,3331519663603403976,9694430284297118748,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7100,i,7480868483349340436,17848781317409446094,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5804,i,8710854654325858157,8422979973420436170,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3112,i,16315272881313767343,18120296932100887987,2097152 --field-trial-handle=1960,i,5448277825341539260,16427791314127329154,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:1
    3⤵
    PID:3736
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\dnplayer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4072
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    - Executes dropped EXE
    PID:4244
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:1380
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ldplayer.net/blog/how-to-enable-vt.html
    3⤵
    PID:5188

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:5504
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:5664
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:5932
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:5728
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP120.dll

Path C:\LDPlayer\LDPlayer9\MSVCP120.dll
Size 449KB
SHA256 9cb478e41026982a4366d567377e3a9880e7ce8477a5ea1fd1ddd1fa96bc1084
MD5 cdfd3c9f6a972a1b3bbc0b0fabbbe39f
SHA1 d137f3a75eb9dcd7390992525dca637f9b678707
SHA512 e89a232471cddef647f990e76e0a04d0f74f81391c342e69395f3fb5de471b3f3064c335526e619d73c0b4961f2635321476c9d5451c11ead0c4ca1b7af65779
SSDEEP 12288:pZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77E:z/8wVwHZFTwFOOos3Ooc8DHkC2e77E
TLSH
T13EA45B237B864CF1D29E53B231C9532557FAFC2441B1F343ABEEE1692FA5282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 50KB
SHA256 e269811316cba3527ca1f1ff54b1bf2ca0a435349d57ff350387ad464da87617
MD5 073553b6d3b92599db810e152541b7ea
SHA1 734beaf96d0b3ff0d6b9d016c085960b3e9b9f42
SHA512 1cf9132a973070e55507cd74570c195c1e3e66a68ab1f5c61dc47a89b5faba0ca49262ad250e99eb26e65cd02ffc6fff4204a7906ccd108518be3d2679a2de06
SSDEEP 768:5Q+agNztWyGOiprkvcocNcb0H/GEM8Jf3c4sbG7nQL44SYiDLk5XkvYijjK5AL:5PGyMprkvxXb0HOafsYQM4S7ekv7P
TLSH
T12D339E929540482ADD560870B9F86B3AADFDB1610BE1C2C7F388C26967507C13F791BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnmultiplayer.exe

Path C:\LDPlayer\LDPlayer9\dnmultiplayer.exe
Size 1.3MB
SHA256 507e3cd8d749ef866edbc5a2f51fc63676a04c81fb7197413e86981714992f94
MD5 ca63ffc300d2c4fd3cf8fcccaaa17f58
SHA1 a99bde9e206d3bcc2cc2385b99fde40fbfaf14fd
SHA512 cb660b1d05d933acc680ace3c65344fe22f02132a58a090063cb9772d986329c8b56ebead38904ed4f5dd47ebde082a8942957f2d25f2c9c68d83bba06f13159
SSDEEP 24576:uPuD6sUjXl2D7vKLPDQ70gBAtUuBhBxy0DRkhP33WF:uTofvKLPM7VBAtUuBhs33WF
TLSH
T116557D207A97C235F7B201B0BDBDA65D502DBD640B2640CBE3D4391E1972EC22E7765B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnplayer.exe

Path C:\LDPlayer\LDPlayer9\dnplayer.exe
Size 4.3MB
SHA256 57fa1177063d6891b4db936d74f8b7da4320a647d2dc1bc5e15fb04bdb77938c
MD5 e989dbabaf01d675fce05144ced53d20
SHA1 f6542f6d921a1be63bdbfceb96bcdfda39560b10
SHA512 6e32423957abb13400981e68c4811a7677af1e8b850aeb0ca6a720d9d9586d714eed0c258e02429f6b00642f186c73a62f151e67ce6b93766b2185601320f970
SSDEEP 98304:mJcBpdoKduOKWp/AdlE5/nIHQmVpa1Xx:mJyV1p/AdC5g
TLSH
T115266C00BB45C226F6A202B1D97DAF6E0429BD701F2955CBF3C43F5D1971AC29E3366A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 41.9MB
SHA256 9d48ce493d7c952d4c04d17f2c35a0592027f37b3a2b40b9b28259aec43788ce
MD5 8ae4078aa040a2163c1c949969eb84ca
SHA1 b27532df518397fa2fa05265cfb1f897196ce640
SHA512 b2ebc4a6b04f966516bdeeba83ef696e9b3f570e2e3d7a662088ab13fc3ee12cacc7e20b66b9bdfd2659ee585d53b9991b9c6317db670d7dd49761fc20bc233b
SSDEEP 786432:g0Aaovi8bBeguoSwFOYDs89hN2LKG7WY2O0o8isQCPaiX916Vn9aKZKgALAmmpYe:gvNB5pSc889hQLZCY2O989HaGyh9fZTX
TLSH
T1B2A7333136B5D132F2A30AB1ACB9A91A14397E34472591CB62D43D1E5D3DAC3BC32B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.6MB
SHA256 c810442319160637ad7dcfdf14e71bc1a34b75aa9b0c55a55e72dcd3c41acbfe
MD5 80c2aa5270eafb9d7fa71a3d61ce5fd4
SHA1 00629cfb49c7b7f87c980f20081e28d83a3e3d39
SHA512 a10fbd0ee81319823eca84cdb938d7f5199bff6f0f429577b53410d7a07081b2ff4931f1df5881bfef6716708d4545649d322ac1fa5da86b7e76c4afc1285f61
SSDEEP 98304:Y3EB+HjpGjbJvmUz+tN1yr9VOcFfkovuZ0alZQkl5h8H7WdzlpCbOcX1x:Y0B+Hjp2bJvfqo9VOWu+uqo07WdzlkXH
TLSH
T10D5633AD2B7D5330259D55AA53E5B520F100CFAE733A28330BA123D4DE0E2BCD9D659E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NanumGothicLight.otf

Path C:\LDPlayer\LDPlayer9\fonts\NanumGothicLight.otf
Size 314KB
SHA256 153161ab882db768c70a753af5e8129852b9c9cae5511a23653beb6414d834a2
MD5 e2e37d20b47d7ee294b91572f69e323a
SHA1 afb760386f293285f679f9f93086037fc5e09dcc
SHA512 001500f527e2d3c3b404cd66188149c620d45ee6510a1f9902aacc25b51f8213e6654f0c1ecc927d6ff672ffbe7dc044a84ec470a9eb86d2cba2840df7390901
SSDEEP 6144:6kyWbmIwXcviKE2SmwxjVGZ/YKNSfuWBl/3DAJHu46ldvtQqu+EGi:6kXbmBZjjaHN2uQlPDAJHu46l16tGi
TLSH
T15264DF90912BE4C7E9F65032EEBB25548305C130D64AFFBD86BC4198F6D831F94DA4EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\LDPlayer\LDPlayer9\msvcr120.dll
Size 952KB
SHA256 76770d93afb655c882fade5c0909bfdd263cde0ba1762a881c69bb57dda2ccb7
MD5 b46ba3349d9b716a30e617ee8e966707
SHA1 f0a4724e9061c032b0b0cbaaec1f1d13f0de8384
SHA512 ebca95f5b431be8a0eb5b74735cadc5c175328067c091576eb01dadb53ec39fc65b22aa2cca85306320f2cae4747ff5478b232108bd4a60389cd5557f83eba4e
SSDEEP 12288:1BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJD:bmFyjLF847eiWWcoGZVOIxh/WxIAIbt
TLSH
T19425BF12B582C0B2C57202B1152DA73219BFB971443599B7BBD98F0E1EB45C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phones.data

Path C:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
TLSH
T163C1EE57BBEE4E571ADC7DCE3274C9973A0CC449C28D18F839082876DA8C9314375BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131
MD5 cde2424d99db56dd0d1eaf34811738c1
SHA1 cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f
SHA512 d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2
SSDEEP 192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn
TLSH
T16A822892CEBC9583ED969D7017A8E9837D3DEBC71D10A15521AAF4D838C33D1EB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725
MD5 acf4321ac8c8ff4d0442c799d621f8d9
SHA1 b12f87e6afc48697f1ce8b587715361e89b79cae
SHA512 7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde
SSDEEP 192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+
TLSH
T102823A929BBCD083ED979D3063A8E9837D3CDBC75D10416A05AAF5E82C833D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956
MD5 3c47c25b8141d20b2b4d576000000a61
SHA1 04543f9cdd847ff66389c9fd1e12b444dae6383a
SHA512 c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a
SSDEEP 384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI
TLSH
T12F8218918ABCD583FE979E3062A8EE837C3DA7C71D10556605A9F4E82CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410
MD5 e05ce0232e64328c62c9da37698566bf
SHA1 50c25e6ecec2cd17ecf3117bb9a646ba107d2b84
SHA512 8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb
SSDEEP 192:MmxD3KXWuufhW+sivT16uDBks/nGfe4pBjSfhXa8WebtuVaVWQ42WyMsVqnaj87p:MVXW5hWyvT1Nq0GftpBjSZgkldri
TLSH
T1008218929ABCC083ED97AD7023E4EE837D3CABC35D10556909A9F5D828D33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830
MD5 a26c7ffcf18b62904dab7786de638ea6
SHA1 b28489bc38ee2f522ee83dcf49faeb96f39a77e3
SHA512 768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f
SSDEEP 192:sohaYPvVX8rFTscWuufhWrlFO0ruDBks/nGfe4pBjSb68WebtuVaVWQ4mWst1qnq:JTPvVXiW5hWB80aq0GftpBjQZplBLcQ
TLSH
T10EA20983D9B8E297ED8F9E3112A5D9836C3893C60820459616E9F39D3CD33C6E79895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
MD5 6a55a7e284b51b086b63cc6f2061ce8b
SHA1 46a48a1ccf5262038b71ed4be09cf625009d078d
SHA512 6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363
SSDEEP 192:ByWuufhWrRivT16uDBks/nGfe4pBjSb9bXe8WebtuVaVWQ4mWWrRHqnajjpxf9cS:ByW5hW0vT1Nq0GftpBjSbRZnlHlBLcYl
TLSH
T1998219928ABCD483ED979D7063A8E9837C3CDBC35920416905A9F4E82C833D1EF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
MD5 6e38a6bed88e1c27155e4dc428188ef0
SHA1 8b47a1960ed157f7beeb80fa4a16a723279c4efa
SHA512 3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab
SSDEEP 192:HX6WuufhWr7FO0ruDBks/nGfe4pBjSbnUqs28WebtuVaVWQ4mWOYVqnaj87X/fA2:HX6W5hWX80aq0GftpBj2spZkldrps
TLSH
T1508219D19ABCC583ED8BAE7012E8EA837D3CABC75D10415616A9F1D82C833C1EB1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4
MD5 9304209688e2a18d0b26997bc78fda7a
SHA1 5d4332cf1c5123418c6419d0291486c3939e8785
SHA512 5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960
SSDEEP 192:KKWuufhWr2ivT16uDBks/nGfe4pBjSbYA/8WebtuVaVWQ4mW7TqnajPf33PLlYoM:9W5hWHvT1Nq0GftpBj4UZAljZYsqTr
TLSH
T1AF8219D2CA7C8583F9979D3013A9EA837D3CDBC75C10916A05A9F4D828933D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll
Size 18KB
SHA256 f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234
MD5 f42a84d78a5a15ff1a4dbac591e95783
SHA1 1cd5b5e68fd729bdd340463b53728634d342b0cd
SHA512 89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0
SSDEEP 192:3liWuufhW3XUxQmLuDBks/nGfe4pBjS7LX28We8WebtuVaVWQ4eWmQQPqnajy3Ss:3liW5hWOQ7q0GftpBjkEZfQQPlGinjqZ
TLSH
T11B822985CABCD583ED979D7023A4EA837C3DE7C61D10555605AAF1E938C33D1EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970
MD5 9f286e57e5b1c1a347adf9eef059ad5d
SHA1 631aa1aa364234acc5ad20b27f926e9cb9ee4276
SHA512 6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197
SSDEEP 192:KWuufhWr3ivT16uDBks/nGfe4pBjSbKUs8WebtuVaVWQ4mWMoTqnajPf33PLlYoS:KW5hWmvT1Nq0GftpBjGzZv4ljZYsqHh
TLSH
T1E38209928EBC9583F9979D7013A8EA837C3CEBC75910515A05AAF4DC28C73C5EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141
MD5 beaae8294db31afa04fa60795c6e02ae
SHA1 8a32ebd843e461864747fe0aebf4bbf83c4ec093
SHA512 dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135
SSDEEP 384:rvuBL3BEW5hWh3rq0GftpBjzkZalBLc2V:aBL3Brii2sV
TLSH
T1BF8218C2CBBCE583E99B9D7052A8D9833C3997C75920946A01EDF5D928D33D1FB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
MD5 2ac1289e4dbab076b332869bef26d3ce
SHA1 60570ddd06b671e26c6a814b9c08cdfa0ef38aba
SHA512 e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a
SSDEEP 384:ptAuOMw3zdp3bwjGjue9/0jCRrndbAW5hWA80aq0GftpBjV+ZZrmlGinjQKKX:DAuOMwBprwjGjue9/0jCRrndbX4i3qdT
TLSH
T154922B92CAB8D283FC8EDD703266E9837C39D7C60D11955106E6FAA834D33D5E754A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd
MD5 a2661a468bb87ee9cc5dee968fd3805c
SHA1 9b17fbd552e34888f1453f9113ff4c42efaf6d6a
SHA512 b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3
SSDEEP 192:zQWuufhWrixf/0uDBks/nGfe4pBjSbl7Y88WebtuVaVWQ4mWyymqnajiG7AzTvfJ:zQW5hWS3rq0GftpBj9jZlymlO62vfGkb
TLSH
T18C822A8186BCD583E8D35D3063A8DA83BC3D9BC74D60955A11A9F1D928C33D5EB2492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e
MD5 acbfc011d5842ba60c372ba3d222ab70
SHA1 16b8014060a04bb03215f6ce4c118bae48653bd5
SHA512 dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3
SSDEEP 192:1cIWuufhW3bFO0ruDBks/nGfe4pBjS7irpMk8WebtuVaVWQ4eW5eqnajy3Snk0b7:CIW5hWL80aq0GftpBjNUZkelGinjn
TLSH
T173821791CA7CC583ED8B9D7013A8E9837D3DD7C71D10945515AAF8E928C33D0EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae
MD5 19d14d348ac38737431a7ee2f82973e6
SHA1 11cd8f5dc5c08d133b9b006da5c84946f012cbb6
SHA512 b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc
SSDEEP 192:AlWuufhWrExQmLuDBks/nGfe4pBjSbYsqwZ+8WebtuVaVWQ4mWXqnajnp+MVQ/Tz:AlW5hWaQ7q0GftpBj5VghZoldBQ7Q8PX
TLSH
T1B79229C19ABCE143FADB6D7012E8E9937C3997D71C1040A55169F6E828C33D1EB48A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0
MD5 ea0e13feac13dc18c79eb682bef4676e
SHA1 b9db47624345c68cf07bd2677df537e0f975caf9
SHA512 540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7
SSDEEP 384:ik1JzNcKSIUW5hWP80aq0GftpBjMJZCZslGinjI:9cKSupiEgZ40
TLSH
T1569219D1CABCD2C3E88A9D306394EE837D3AD7C61D25456105A9F6E93DD73C2D62882C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
MD5 1af2a91dc0a4e48bab0ca123073adf30
SHA1 cf6625fd31b17d46dd31b16372840c74026d0ba2
SHA512 45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51
SSDEEP 384:vIDfIenW5hWsvT1Nq0GftpBjeOZLlGinjx:ve2N1vi/l9
TLSH
T11F822A81CABC8583E9D79E7063A4EE833D3DDBC71D20906508A9F5E828C73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786
MD5 9b9d1949b75df171884f6f8caba7ff59
SHA1 411adf413f53c56488d5cf68e9b4b692889f3c4b
SHA512 dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c
SSDEEP 384:yW5hWgR80aq0GftpBjHLzZgfhlg+ZmJy:dmi1LzWflu
TLSH
T18C820991CA7C8483E997AE3063E9EE83BD3DABC71D10556601A9F1D92CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 18KB
SHA256 eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f
MD5 c6e268c877a9be5b43877308b1231120
SHA1 949105c826dee6a32fe1288285e3e41cb7d04821
SHA512 776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331
SSDEEP 384:HGeVxW5hWEvT1Nq0GftpBjvOZZljZYsqzN:HGeVcF1viJOYnzN
TLSH
T1008219D68ABC9483F9979D7013A9EA877C3CDBC75C60916604A9F5D928C33C0EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c
MD5 5122b8aa14a25c8567d9d0335036446f
SHA1 81961f2c8a331136f8156930779964a71e0badc4
SHA512 758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9
SSDEEP 384:1yMvIW5hWER4Zq0GftpBjpTuZV0lO62vfGU:1yMv/L47i7STVHGU
TLSH
T1398218928ABCD183ED975D7023A8EE837C3CABC71D10526951A9F0D82C833D5EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b
MD5 e1b30d56617709cf7dff5f464d7566d9
SHA1 e29646b1c90550cb86ed42782c764d41f2c70651
SHA512 e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511
SSDEEP 384:pvdv3V0dfpkXc0vVa/W5hWiR4Zq0GftpBjkYZjsdljZYsqmb:ldv3VqpkXc0vVau547iCY6Onc
TLSH
T180922982DAB8E583F89BDD7052A9D5837C3897C34820856611E9F5ED3CD33D0EB1892D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
MD5 e4b64b2710725ec3332021bd8044d884
SHA1 2d7f8d87d0f395296ecdf277084d23cb9e0880e8
SHA512 ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2
SSDEEP 384:stZ3KW5hW4R4Zq0GftpBjsnTZWFlGinj6m:oX47iiTomm
TLSH
T1B2822896CBBC9583E9979C7063E4EA837C389BC61D20556115AAF1E92CD33D2EB04D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8
MD5 67fd470a60fe8fb3f9fbe32fa52871d0
SHA1 09aba019a0d0dae7415b6d9a39e1dc67d93f130b
SHA512 f8c3f1e3bee196487aec704f128240acb57fb392db918a97176793b07726f017177abbb5a6c68822fc59ce06f04d489a78284a865efdc2de518f34ecfb0cc1e6
SSDEEP 384:NzgLW5hWgNvT1Nq0GftpBjVIB6RiNZiVlg+ZmJ:NzgKB1viPbRiNUhu
TLSH
T162922A928ABCD143E9979E7063E9DA837C3C9BC71C10816901A9F2D96DD33C5EB2493D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
MD5 f53ed8a0c18157b9e37500621dfab9ee
SHA1 b8a3131150cfd46052353309843c802d9f43df03
SHA512 2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a
SSDEEP 192:QNWuufhW+IivT16uDBks/nGfe4pBjSfASU8WebtuVaVWQ42WUqnajnp+MVQ/TQF/:4W5hWGvT1Nq0GftpBjhyZdldBQ7Ql
TLSH
T17E821992CBBC9083FD9AAE3013E4D9837D38ABD70C20556615AAF5D92CC73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b
MD5 2b9f551cddd662c618432a75c546b296
SHA1 1ddd65fcc8bb401c734ebc2014d057328f771744
SHA512 54df6e692ac630d969a697c9e6f379c4826ca71b7e8eaefdf502405b1333a6b483256aeba609a4a1c61e73f72d2958aaf3eb31538cc5e7a91101d7d09e3ed9dc
SSDEEP 192:GrWuufhWrvFO0ruDBks/nGfe4pBjSb0rjk8WebtuVaVWQ4mWD0qnajiG7AzTvfGC:GrW5hWz80aq0GftpBjjbZS0lO62vfGC
TLSH
T1198228D2CABC8583ED975D3053A8EE837C3CABC71D10956515AAF5D828C33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89
MD5 7d943f85ff8d1515a02d202ae79453d3
SHA1 94def1f7368172ac50b665e74b89e8f7aae2857b
SHA512 e111dbef97c6c6cb3b5c2d183294620792c48a2cb16d9d91c12cede757a1c0c53d707f4294542bef47eae784893bf63fe0f0229bed4b2d0a961c8d1cc1cf43cb
SSDEEP 192:VyWuufhW+JFO0ruDBks/nGfe4pBjSfG488WebtuVaVWQ42WyWqnqnajjpxf9c9kY:VyW5hWU80aq0GftpBj6ZXlBLcmY
TLSH
T1D5923B9386BC9943E9878E3063F4EAC37D3D97C72910616554AAF1A828C33E5FF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
MD5 278857b86f667c47cbcce94f5ec73ca8
SHA1 a0f5b7e7c67f3c6b8f285d39d08b740e49445755
SHA512 ebc02d1a2e223eb0b30a8e62089735faed83add4161094493f62561a09c13a426815e7f06c20c44477691109a8c3040dc68527023bfee6d9984c42d6a05208c9
SSDEEP 384:vcJ2yyW5hWGQ7q0GftpBjFZ8UOwlGinjP:vQgiviDcj
TLSH
T12EA2F843AAF86F62E99B1B7121F9DBC32D384B82195052B5811BE1DC34837D1FE66C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
MD5 6493b21fefae874655c62a56a156f3eb
SHA1 c65beb46f9f03d35867ff008026d3a56fa26fb65
SHA512 93cbe187f7fa86ac58191b5384a993135e3291873a76cc2cf81dd60c68ad7591386e4eb5ab53aaac2a6f48f7f778263b7fa0a4ea0863361910a9f1efee92b64b
SSDEEP 192:45oWuufhW3dxQmLuDBks/nGfe4pBjS7Ji8WebtuVaVWQ4eWbj8qnajy3Snk0T:4GW5hW/Q7q0GftpBjmZ08lGinjT
TLSH
T113823A81CABC9583ED97AE7053B8EAC37C3DABD71D10516605AAF5D828C33D0EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
MD5 ae83311041ee793253ff10736317a09e
SHA1 c62d06cb6cbd9d997c42a6ad7f13c06f38725069
SHA512 0fabcb0370330460f8f525401f339535c08d768f075816989a16eff2256584cfa8fd6832df3ce3d9c2a5364b4ef58bfff53cc486e3b48d11b654f7174aa18458
SSDEEP 384:gTnWm5CoW5hWSvT1Nq0GftpBjMkZaA0l3uzJ:gTnWm5Cfz1vijj/l
TLSH
T1559218838BF8A953ED971F3112F8EBC33E3D9BC219114266906AE59839C33C0BF11959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
MD5 12311308d7d65895b3920b3dd3e54b3b
SHA1 3faa74c6913f451d9c575761630b507af0c15ee3
SHA512 67fd047e760dbdadb06cc2c34b935fdabc629fa988484a9f5120cd59d6167d943b612df65626701022b5e73c5b1177a8d813e90c5990468f51a5a11932c008ed
SSDEEP 192:QwY17aFBR7WuufhWrtQR4+uDBks/nGfe4pBjSb0NW8WebtuVaVWQ4mWMUVqnaj8F:QpWW5hWyR4Zq0GftpBjhNJZYldr8
TLSH
T1EB822AC28ABC8583ED97AE7022E4EBC73D3D97C36D10556641AAF1D828833D1FB1491D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
MD5 3dafcf25a2ac1becf40acbec8fc7134b
SHA1 0729fdc617403622c2edd77fdb7dd49b530e2037
SHA512 9dbb487489c8a6af8dbd6326fe4958f489552af268f2937495ada35bb8404cfaeaf54833d8bba2966e72cd0ba3284a5fd167baf4cd6d905870f5d1ed3e5ff6c0
SSDEEP 192:QPqWuufhWrHxQmLuDBks/nGfe4pBjSbZjk8WebtuVaVWQ4mWK8MVqnaj87X/fACD:rW5hWdQ7q0GftpBjWjbZZldr63
TLSH
T14E823A828ABC9583EDC7AE7013E8EA877C3D9BC31D10556511AAF5D828833D8EF1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-math-l1-1-0.dll
Size 27KB
SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
MD5 f32bd567d35d2e85504c39dede609e72
SHA1 b7a7145956466e45bbe6f7fe41e935a152c2c325
SHA512 55396f3e5821d3f3eb5988bd3362a0cddf036de4afa8cc1214813834b5a152fc3df787a8347a7aff3de6bf112e1d2a354790f593854a59f1f49393ddf967d085
SSDEEP 384:77FRU8HM4Oe59Ckb1hgmLydW5hWjQ7q0GftpBjASZLN8ldBQ7Qa:77TjMq59Bb1jyYPiyS8Q/
TLSH
T15CC2F64789ECFF93D58B4BB312F0CBCA6D385AE25491B5B5C85BA0C834923D0BE47949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc
MD5 56c02fabc2c64174009c905570c3a22d
SHA1 e52154112ad127ab01937453490091def4d21ad2
SHA512 9f22f70b5de4078fcbfdbb186d6cf220561200092eb7ceaaad9d44a5281f84abfb1729f4e447dab3753225d5fc6c44d94363e3729e5765dd2213213c327c4c1b
SSDEEP 384:YbmLPmIHJI6/CpG3t2G3t4odXLBdW5hWYR4Zq0GftpBj2q8ZWlGinjge:PPmIHJI6PY/47iok1
TLSH
T120C2835B8EB86E12D58BDBF3B5F2C7C63A354F8104C07375A56B95883842BE9BD06D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-private-l1-1-0.dll
Size 69KB
SHA256 c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac
MD5 4b27cf5cdb20aebf113df752019ffca3
SHA1 b02c6e45f704dac118f81c324122c189e3e61e17
SHA512 cd4df2478d719e159e2252e6784d24e4260c13d8f47774ac33a8e10b1fa96d38236bf2c3ebc060a5801fc19392cbe5c636befa898721bf114956c2be6476bbd1
SSDEEP 1536:ccXDvBRh1De5c4bFe2JyhcvxXWpD7d3334BkZn+PAc5ed:cczDh1De5c4bFe2JyhcvxXWpD7d3334+
TLSH
T16E6329DB49EA3F61E58FF7B367FB17C91B253A4408806174E9C7956B34853A9BC43A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8
MD5 fa677cfb18ba1370d8bb98681c48cfbd
SHA1 cbccd561bf53c59254fb04ab136996b81cc80d3a
SHA512 9312acd4955d4950d851910198d4ee622b75e11262e409c79391078d12d2d0db320723a1552048acc0e9deb30378e3cd27d4fabcf2077d429eedfb275cdb73e3
SSDEEP 384:BpOSA1W5hWk80aq0GftpBjy11Z+lTMs6WbL9J:vlkiM+TFJ
TLSH
T1CE922AC7CBBC8993E9935E3012F8DEC37E3A97C758109165946AF0DD28833D5AB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
MD5 595a997bd415c8ae0ef1e3c3b73e6091
SHA1 10f34bc2f474a43bfaac26f66ec8081106c12253
SHA512 944f6bc405c69d6bf6dc97652e9f296658bd3de078dda50ac680e56818c00dfee909b100fc2fa9c6a891c55dbc66dd62ac52819950732c83198dbb8c04f3c9b8
SSDEEP 384:ETr7ZW5hWgvT1Nq0GftpBjqZaljZYsqn3:2r7Ep1viwLn3
TLSH
T190A2F7838AFC6E53E9875F3212F8DBC32E3597821910516A88A7F4D838C37D5FE26519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
MD5 415d765aa267382a79e56e428c80b1e1
SHA1 1bf13460b8aaac1538bf45186a1624825bb8c355
SHA512 7236ef7b2937718409ef4eeda20318b1697e7c1c868d0df263f4be8673365d48ff6ffa2317bfd1881b6cb3dd1300410ad4f715b8e01ed321c4011aac88490d21
SSDEEP 384:xHCFVh/W5hWOQ7q0GftpBjDdZNil78oStBdo6:xHCwgiT7Aa3db
TLSH
T179B2088385FC6E42E6874B732AF9EBDB6A3587C3281071B98417E4D835C63D8BE13419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
MD5 5bd5a9001cb0555c5b2b14e0cbc8d922
SHA1 4562d23fba312fe95cbc777fd7c2e37ca1e76ad9
SHA512 a6271f28f069a00c2912f80552bd54bf0d8461886adff626b336d25943dd0ade19eb88c718602017a1986317af3eb5f94f8896e88b9367207e8b53225322cb84
SSDEEP 768:Yl5yguNvZ5VQgx3SbwA71IkFMLirA8Fma3dnL:Yl5yguNvZ5VQgx3SbwA71IvL2maNnL
TLSH
T147B2D8438AF87F42D98B5BB265F9CBC36A388F8615101275C467E4CC38827D2FE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
MD5 f719ad4c04043f55a21e73805997b287
SHA1 0e88b1271b242f7933e78edcb05131612cea061e
SHA512 752b9b4385162126729c3f09b3b75d7121c8dec00cce11f7cf1ecaffed3e79addcbcfe8bdd4e20e15b8494bfe2d24c3f2d11583860b1e03be021196bc83fc3bf
SSDEEP 192:N3LD3WuufhWrzGxf/0uDBks/nGfe4pBjSbA097b8WebtuVaVWQ4mWmVeqnajiPNg:N3W5hWq3rq0GftpBjr0974ZVelg+ZmJ4
TLSH
T1949207838AF8AA43E9D75F3112F9DBC73F3997C21D5061664166E4983A833E4BE2581C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
MD5 a405399d5b958a03e6054307a631553a
SHA1 dba43f0afd8c6e1f61cf0be7503c6f70b48b8240
SHA512 33c64766053058fa9fa4fe689f1ca5a345b8b70443995d71aa65b64c7bb38d4dc3a2b37ad06a4ce5ca1c927ed9ea4377443eaaecc69b0e758ff265e755194287
SSDEEP 384:IbNfmW5hWBTMq0GftpBjZtwZkilTMs6Wba:WfBYuieGQTe
TLSH
T1B1822A928ABCD583E9975E7063E8DAC37D3DABC319209165516AF1D828833D0FF1192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\LDPlayer\LDPlayer9\vbox64\concrt140.dll
Size 310KB
SHA256 01729ff33c2e3db1033fb86e899d62026dc1c03705269bb9636227f61934d9b3
MD5 67a3ad0fec3eb767e423e3d7a9134343
SHA1 42949506bc8451031425840df33f3acab5637b52
SHA512 f3b13d38f44acf37c5002f08b684cb2955b778c8a703c8fca6e07eecaac45e1bf4bb036dda055114152390322351ef936492abbf6532d1a48fcfd29304b4db1b
SSDEEP 6144:ZEI93zcNn3dMiBXHxHSSXfPnevwbbeVuX0cp90nWzgQQf3PzX:WIlwNqihUSPP2uzK
TLSH
T13364189A36140CE6F967D1398A53C90BE7F2BC416362D3CB0264879E5F537D0E93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 639B
SHA256 8ce2498155e02c42724f69f7345903813b873baa5d444566972873216f64fbab
MD5 5832889f0a2ac871c75f5ca0b94586f9
SHA1 2199d63464c81c6aa1fb35101c1aa1c140a50afe
SHA512 d4b03ec52621c072dda090f2e05a8b86a8fd6399283f90b5f42cee647b978103ed36b7e985830bbdfdd88e4bc0478d1372f5c81e6a60d690bb386941ad3abd7c
TLSH
T1FBF0C812FF099C1F00E81A027D546701FC20960F17A17A63733E691D4B69CBEB3D5836
MD5 SHA1 SHA512 TLSH

Submit Download

sdcard.vmdk

Path C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk
Size 35.1MB
SHA256 f90ace0994c8cae3a6a95e8c68ca460e68f1662a78a77a2b38eba13cc8e487b6
MD5 4d592fd525e977bf3d832cdb1482faa0
SHA1 131c31bcff32d11b6eda41c9f1e2e26cc5fbc0ef
SHA512 afa31b31e1d137a559190528998085c52602d79a618d930e8c425001fdfbd2437f732beda3d53f2d0e1fc770187184c3fb407828ac39f00967bf4ae015c6ba77
SSDEEP 768:oUakI3gnG30jnzln5pxn7en1njvfVnNnXnLA0Y3bb/qWE6I0eYyU:RIgGCzlt7e1T9NXLQX/qWE6I0eYyU
TLSH
T18D87B51358C9A522EE2D3732E99B38028EC60C9506F12B4749F53EEC0BBF5E5B56D349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roboto-Regular.otf

Path C:\LDPlayer\ldmutiplayer\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
TLSH
T188A35C4A7753AB49C5126A78C695C3A83B79BD69BB03A21FB1BEFF3211030605DD81DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 7de87442c7ad37fe630abd6ffce62ff5515ccc861e030df7c475a6b8ba157f62
MD5 d2a1074fd72ce7642bbe359a3b7aa7b2
SHA1 6de6bc1b150dc8e3b2b7df1b28f54323c38c2001
SHA512 a3a0b861d7550addd119cecce96f68013bfb45f74effeb84248b10cd82ac620894dfbba48576f816356a64dff13df8e2f1e9d4f965fee9c33a9d428114508e7e
TLSH
T179F0979710A06C90541F0D962DEAD8342A24468EACF2C6FAB9A998A658763F4A2168C0
MD5 SHA1 SHA512 TLSH

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\988B237EEF5919FAB97ED3A790613BA6
Size 471B
SHA256 24da7795dcbd4a2545c765a190c4567e24539f1d456798457168104e7503f9f0
MD5 2f2b0f3e316f12b542830bf038a156e1
SHA1 8a6f680ec54ec3f1181b221c6658cc3e8e2b6325
SHA512 75b9d04dd2e6fbc0ed8149007065f6fcb96434986e03fb9064846eb811e08e530449ef590f33eb36ad8e0ed6fd4e61150ac42d2e14a1d5cc43a66310e3113b3b
TLSH
T13FF0DC83A020E4016C38C90862EDEE603C2583B42CADC807B23DC6A2E124BE943839B8
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 471B
SHA256 9e0d73d46fd18b6e9b70426569f526dca288d95d6a39a32f27f6207f686a57b9
MD5 ce51964885b5af2d1f4c9ded18471a27
SHA1 c8549f3ff225659879ae862eaf325136ebc0f79e
SHA512 66df9abde605be17d6faf8609b7756663ac7232d73baf6d793468a02b928c4f395731457d0dc954607113f629656931536f0694b8f3742f00c7c808ac6d64816
TLSH
T1FFF054410C9EF903FA0004ED44B483FDB020A00448F18276680D4CE2CD48B316F23139
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 263b91e3f4f7dbd0b321e786295e7298c43de02b088cb1f463e6205f80be0b35
MD5 7acd3e31e88a8e14488971d33092dc3c
SHA1 a8032e227be1b9a5d3c9b92bb157f77511323869
SHA512 328157e4aa1f371dd4567653a854057150bf423f0ee269276ac7b9296d94c8a1499076ea76ac2d625db21e78dbdd385c8c89b1b38fa9031cd2da02fe4e56494c
TLSH
T140E0263869FA127CF1B2EA744BC6A562053BF1056C24D2792BD0062AA74B544DD72C35
MD5 SHA1 SHA512 TLSH

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\988B237EEF5919FAB97ED3A790613BA6
Size 408B
SHA256 ef17e5a87b5af2f8a305db2d608efe12518a15b1513ff3db063c02df1cb5169f
MD5 4e72946f9065c4fc947dc3bfc6f9dd94
SHA1 a7771c4db12ce1562a866c8cdaaa8152cf521726
SHA512 d414a2f58a88df77310ed249e0211c0a6acee0495257ea3c9c2f6a42b0c5d7662974d4eda7f3115f122b7ac3f4a7f6fd9938a7fbe8a822c2ee10f08972f1e104
TLSH
T124E0683411F9422CF172AD74C3CCB8648D64F32B0D00863268C04207A31AD429D22D34
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 416B
SHA256 044ba1cc4c802d0885954444c02caaf38d5b2b370de9dc51a02ab2404011c60a
MD5 88355f7f4c1ad0ef4967a6c588aa82b6
SHA1 78453a0874a3b8fe2a4cbfb2fd5618930e481081
SHA512 e6969a8ae4895ca1d5dd64e77e39b085fa67294136ce5e192d8def7a17105a220fcb1915f0895482e6146af4b34727fc526120c3fef44a70bbf45b9da5b037db
TLSH
T1A9E0683424BA412CF6F8E8764AC8BE20096AF1360415E2601AD49B18E606D40AC06A21
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27d61c282e4bf112aed3bd07eaaab8788d75224f5e199bab857064cbd5d982a1
MD5 46e65d035adc969e8d04500bca4c5db3
SHA1 fc81b055409d470ed84cfc8497034037eb5a1ee4
SHA512 26b4bf0615d85574c1a8017270ee3e215341811d6c55c46a00d6a9c6c2e6ebbca4202d7b57c225f8b253c27394d706b1e2825b17c78aa7a2e17599e82aceedfe
TLSH
T13FD0231076397AD3D23A147E54718B01B91581777377F3417151440D9D750C6F68B6D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 952d59ada218f6beaa8db0f01b5267d7e7a78b87d19928eb20e43a006f019dc0
MD5 28fca85e9318aa225a0996a37cb63c04
SHA1 e880227e442be6bde5263ca9ed8a52fe9f5cee4a
SHA512 108d69847435a75d17af2214ba58609f2995030afc83d10dcfd26e7fec2119720d4146f844c1fe0b3ca7ffbc52e9ec2765d453124662b3e5745b229467e13f8e
SSDEEP 192:f/qYs8pElz7BB+numEgfgc3jztN04rhl7lJ9QmZqYF5bYQ5VHsQFjOVJaamz5JqI:f/qYs8elz7BB+nu7gfgc3jz/04rhl7ll
TLSH
T19A328EB53E89CD23E7811B3349D12627B3FA85C8F1235E521510DCB0697AB852F3C2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b5763.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b5763.TMP
Size 3KB
SHA256 f2a5b60e68264965a69b49fc8ad4aee1e1a560296c78582cb0f0060bec42cfe7
MD5 bf1ac79a35e017b88a70feee2e39be16
SHA1 72383e02ea3b7425c0a7672d5a9c735d6574e285
SHA512 2d2d96862b55a28353d08d8cc252eb13841274fb85973c36fb4a3f000fe8a5b9d817e91497dc870443046fe5f7f83a41d7caed4a2edd50e782917155c3bf9b28
TLSH
T1EE719475064ECA63E3AA0A7252E13337F5FF85DAF6239E4A20544C762618F11861C7BC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 052324e9956b5f89edab28053a9c8e355efb5bca7e27c8d0f418a2a9444f425f
MD5 3c622172ca0e0519c4e4c54798b844c7
SHA1 3f2f2a34df3b38e13744b0d308bb34e04d366a40
SHA512 62303c8ec8c12e22ff915bff3f84ce2feee00cbf48afd7d5f5cf39ac782da73b43004986a68e826a114c89ebb83a5d200c4341604e668ab6c6839f9b87271a8e
SSDEEP 384:Dr4TPke6ko7Se/hKC39JCLHLbGGCr/fPOoYB8rIr2SZxI1n068gU4zKyxVWR3htH:RkLuCJIX+H2MnN
TLSH
T17662ACE7C3E88A2D8DA151F1BA152F2BCE190A14435C3D2B89D4EF4B93E6474F64184F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5386dbfaf73e8eddf4a8e6a130977609643603ce812a8f1bbad42b0447665938
MD5 295ec5a951a1e3a4b532930cc3ea013d
SHA1 4497679a02bc7cd4ccc2593628f9349696c6c17f
SHA512 2cff54390a7138b3bb219d0b331deb5bc8b49831dca211aca625ee4c27f41bb95d5b7a575d7424f5edaea0ee6a37277e1ab72b42542d8fa054d4e5f6698c1692
SSDEEP 192:sxZhRVyM/jK1Ml8Mj9/frseiAxnDIdpEUHW6+WNzRf/eB7I1Oe0Ig4J:sxZhH79/frse/m9Hbt/e7c
TLSH
T18E52F956AB345977CCDBD219F9457F53D6F80572A2900E449AFCCA0C04EAAED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 ecee5f397654c36a0b6414235d97c6b4560e83926ee1393995286d6052f3f28c
MD5 681988d7c8cb3b0de21440276264128d
SHA1 d39cd904c34dea8a83efecf6f92b41df096d4bfe
SHA512 6724757c6e1a3c65524ee152f69afeaa2baa9b095adea56f79fe907c5d33d7635d75ad2c789c5409da35e04485b29ef0a66b54a1379a9a1381e7dc25b6591b5f
SSDEEP 384:sxZhHI9/frsoWvriqDHb8i0XrkZqfr9V/Gq0:sZo9/f7YrigHb8NomhNGL
TLSH
T1E182C853B538097B4CDA9126F545BB6BD2F50466A6904E81AAFCCA0C04DFFED7202C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 a7e272fbbd10632daae36914841ce54263f27d43b85b53445b3500896101fcc3
MD5 74f7f83eb8483f3d06f74db69c398454
SHA1 8382e074a912153b60aace09adfb510a6e9ae41f
SHA512 a219335bc1432a6d64bedb5524193acf807312d22840ca3a542826e8fd77e7d284c72d0fbe61c153bec4a2cfbea5c4174b6d1155bfd86063610460448e736b8b
SSDEEP 768:wGsqx6d7pLuL7JlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKOY4Ll6AR9aroz:wGsqx6LE7JlWvJD0Tu1jaHOY4LAs9RhJ
TLSH
T148F2FB3B6D0CCB7E4F844E9CED2A7E8A6DE8018B5698C95447FA880C03C66EF11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 88d2a078b9b7a0fd331dea0d98969ab53d202f2fd5ec2681d76c5d4ff6dcc77a
MD5 590c0c475af04029581de51fd4b210db
SHA1 85c9b0024b6e9d8b1e15f9057602866c30aaf2cb
SHA512 8aedf31af9aaa01e536bbc23d93b309b0afbcff0209600d51ec6b00db4d8e65afa07d2b3aa5228123b28e1aa9c551c0b8d3322887cd8362e5bdda2da1e0a617f
TLSH
T1B4D097ABA03481A4BAAB0B853E3300AA86247C8428E8804CB51102284C847B3D201E82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 5b9a52a0a24b8425cbb5dc24e54d549fd985e4fda1fcfde3db58739e7cd0513d
MD5 87716d7468f7516709173fadf5346e6a
SHA1 df6fa7ac1d4958e806c97915e2c78bcb4a96ffd7
SHA512 ee1b7f44c816923a6b43479271c09698ab39961b459eb4e792d46882c87ed55a7e55d71ca438d969db1f32f9405e476c5ddf8bd52e34d8a90c217faeb752751b
TLSH
T156D097ABE03080A4FB6306863E3300EB46616CC42894804CE512322C18B47A3D310E82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a9319.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a9319.TMP
Size 138B
SHA256 f892f223d83af6481b87850f5766c98f7d14ecab9912a4225ffa550021e63f17
MD5 6519f6736bb18216060bceedf6ddc2c0
SHA1 93fee4a01cb9841bb3a5d4e82ba463f88135758d
SHA512 6264afb2de17c3927dbf86fe2ea69ebb1e8e3d969e01566ba11cecda87ed5812fb651122216785784f7603fe9a8c5fc5d52f16ff4b4c1787f91235af41096768
TLSH
T1BDC02BF3F0600130AF2102440233459D8B013CCC9889808CB123315C3074F336101FD2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5a327e974b00d14db039792d1f4668d52e780bb7c66b4dcd312417a27cba2d48
MD5 fabc8c6243fc2fb8329268d4e1116b26
SHA1 df130f739cff4a4077686b2cf13218e632e5d513
SHA512 b4bf7d8693d3cfde9f10699704718ba85ce100c10c3398ecf33fe4da2b2b36e726211f3a97358c22428f1ab77ba3a96ad7fa82aada2816afd5da2d09ce00cc41
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTylDIRK4A0TyRCIfKPKcfyZ2IfKf6cECh:KYbaKYIKeDaK4AKiCQKPKOK2gKf6Q
TLSH
T157C1210A327A1652383D2998B26685770F423AA3301CF47F7FB964E50B66E124DFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\96e473f0-96fd-41e5-bea4-c81649cef05e\index-dir\the-real-index
Size 72B
SHA256 77aa6c76d131930674b22717ffa320900ef22565cd5ffa8dbc4a30fcef0aa5e8
MD5 3bf4c85c1f46f3315ec1fa65dca6238a
SHA1 f80210449ddb52ce3da946ec4ada4bf35787d56e
SHA512 505ce8c14412294a879713c2f2fcf28535de1e9ab66d74dac7d008b301ecf2f364d7b873cc4bcc3be7fd58ee6e57103ddf83002820482af9e82314a660480b1e
TLSH
T125A0022922604700C800067464A7036372BD8A2AE914460280E121D4CCD61A7820357C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b5763.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\96e473f0-96fd-41e5-bea4-c81649cef05e\index-dir\the-real-index~RFe5b5763.TMP
Size 48B
SHA256 a36191447d57860c20381859cb6f72e83c70b7ff7033f18b8533f35129d94d74
MD5 e59b97d0b4270808a9efb8a08311c54b
SHA1 871a5ea7eb608997942bb6e588450b1d56971f2d
SHA512 6a447a652cfe41f21c14b0c58c3869fb26a2bf4ec40ff0f0b6b4c7392028bbac4b32d002fd4cba9fe98a9aa99e4e3349f82ec47c390278103150747280b13a46
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 152B
SHA256 8bfcbf8a2010bc70999a1d209a6769d263013ea0d5b5f685e5eda4d53f0d8a69
MD5 5be65caa145c873b59828a52831d18ab
SHA1 945104c47b5103b47f501f2832db1d22c35107ef
SHA512 0eeb7f9e4282324d4a4761e9609e8ccaf894d185f9a3cf6da71e55094496e45f44379196a14b88098e9e539375cc7cd5b39a489aa98e08f9054876d48a03e4c9
TLSH
T182C04CE31814C59A0671BADC2224731DF12B864D99D0CDF8F94D904A5178E274543739
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 236B
SHA256 d82b0c1d9d538a79430efd1a6cc5e7c54b4e698b62a51e1bef7e2d5fed07abd9
MD5 2552edb7f593db2df0551fbef4a0a04e
SHA1 af8a08698d4bcebc2490f380a66ca8547323e88b
SHA512 59b1f4687aba35713f5dfa02be73811225e0ae5d1ee8b15e17511f347c5eb3ba235405b76c3544868529176443a191dc50ac166752f20997e6e079901c55a183
TLSH
T163D05ED2453598861720A6983620331DE1278D4AEAC08CE8A909F04661B8B228102735
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 153B
SHA256 7f7176c9d00237962072c793187390c905d1dcf90d6c51e9fa17a3f1d0739bf8
MD5 8661009ccfd893ec37727cde6ccac089
SHA1 caf76ca71f6c52fe6dcc713dd55c0e10c1c4f2cb
SHA512 a0e879043a1f6094f0bdad1f20d15ddbe2d78de874c15c21215ee6d80ba6d4d772a7645d8537ac81a694271f7f8cb29d92344797cbbeacad22ae36eb4fe576bc
TLSH
T15DC04CE35814C5960A71B6DC2224735EF12B868D9DD0CDFDF90D904A51B8D374853639
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b4c48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5b4c48.TMP
Size 159B
SHA256 c1e4509f550a0be83978d45a99d51f867105f44c5a278cf56ceaae20c17dc38e
MD5 dbb45e5a1da91c9756b2a0497f6a033d
SHA1 e1b9d02f0f85dfe2784ef8a8673b58d7fc5c823c
SHA512 8bf0c6f6e2fa6754112f84233eda4021ce4abff143cfbb7d7d71acc484c7037e90c93bb50661da92b0c496a94945560aed5f5652e99e54cca5e2a44e161a635c
TLSH
T197C08CE318108086073176D82220730DF02B8D8D9DC0CDF8F84EB00A6078D238442A38
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d91b876c2a73a9d61693d8d2be8e042c7aa9ff7603948bb933b7fc3761f543b8
MD5 38fe6bed12fb20d7d4bce2040ba5764b
SHA1 6cac5673a0f99f243856ae9864279518ce1d664f
SHA512 c2fffb3b83c6ba55f1338ae3a6393977452d5db587dfce028263e1d718579128a2911adccaa67276845a8932f88400602e29ce5e13c6f23e3c4acfb11c9d4cef
SSDEEP 384:n0tNn/s3n9SbsNj9VbAZl9VRNzdTLA1zmn15wbAjEMa:0j+9MhljHzR81mn12bfMa
TLSH
T124926C315C394C275DE7A40AF88B365B5FE860BB6AC92E54D5E8CF0C01D77D8132AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37c8bf8805c87984c13cb194eaca0c2f8e18233c2491fff89c0d45d33ae2f2fd
MD5 c372f17518c3287603947ba42a604165
SHA1 8c014cf4f28372fc80f7a7eb0658983523a3f945
SHA512 b5db84d3884e69b4af11c63f916d70f0462213758e94f28d2097ff06ab3b61a308f99247b083a63da580fce940f0a0488746cb4c988f74ade5aaec10f6c50f8d
SSDEEP 192:tONx6JkRtQmiUyKIW+RNA+Fd10JoLkRh3TRRU6:tONx6Ur2W+RNzdTLM3U6
TLSH
T1B202E9356D782C7B9EF26D0AF58B37135FE4206BBA892B84D6E81F0C01D7A5C1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 38aba6bbb57205bb105f9880888343e35340d5c82b77571b51ee567a1bdd5f83
MD5 243b922ebe0050b58dec68b242afe446
SHA1 87042d94ec20e22960744cc1c65696da264204bc
SHA512 371620de419e651c4183a494e64fdf1f6eed6c12b3af6faa7976b42a3ee53878481cec313798f6d049aaeb5884ce8a20a0dfd5b093906eff8c7e6bb25ab17364
SSDEEP 384:nBtNn/s3n9SbsNj0VbnWlm2VRNzdTLJ1zmn15wbAjEMa:Bj+9MilmUHzR11mn12bfMa
TLSH
T1C2927D315C394C275DE7A40AF48B364B5FE8A0BB6AC92E54D5E8CF0D01D77D8132AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 115f90de67b5293e44bf3fdff687b2c8ef4d9419bd89a2ddc7f8b03c668d2cac
MD5 26df13c72db910c5a03e3111b28d11eb
SHA1 e493ee09abf75c9e8eafec3593b2d55c780d7a7f
SHA512 72bfb726420b2e32ca6b96a833d733d2835a51ad6b627caf10c98c73e9aa87471821cd1d44666a7f4beefe3f60f78b16dc536dcb65539df0716996ab7cbd532b
SSDEEP 384:ndtNn/s3n9SbsNN0Vbn+lm2VRNzdTLJ82ASt4XLO09ckcImn15wbAjEMa:dj+9M0lmUHzR1gS509iImn12bfMa
TLSH
T1F1C27CB0DC654DE704D2E9CAB54AE5472EA841379A8D1E1CE2F8BB3D309F5F81326C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e3c27f487d6f849a256aeb98dca5b7e748c97125c890e9092b8b53746f481cf
MD5 dc830c14c0ab34a3fdc31688cb82b0ed
SHA1 6746b2c5c892bcde16572596dfabfd2bccbf165b
SHA512 73ec56cb92e434c1be79951bcf9bcef0e6e1f273ff27a320fb6cc9e10b5c32e5dfb970eb526a09821f127b0a8ac405923d2f3f0c3b75850d10013e34d25b62fd
SSDEEP 192:3ONW6JkRLQmiUyfIV+RNA+Fd10JoLkGwPEVc0q6azU6:3ONW6U9RV+RNzdTLA1zU6
TLSH
T1711209316C785C6B5EE67806F4C736935EE4207BED8A6F84E5E84F0C01D7A9C271B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 729833132fef5b775d0f9f233d49dd760ca1b112b293044d544e8dae3e2df31d
MD5 dacd8af5ede33bb25995b5a324bccc49
SHA1 6b206abf3ca97724d3d6ac0ddb5d8b21859faf03
SHA512 9d26c6ba3481d2c8f9cb699624aaefa20893a15879573103e718f6733418198d35a914e5b4f80fccafc22a0c51aecf8d585109470c73cca5330ed16b59098adc
SSDEEP 3:MsEllllkEthXllkl2zEkl8WKlll:/M/xT02zn8WK/l
TLSH
T1724404447FD00505C50111344131C3500370D5110511DFC3745114137DDDD404D00405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae1998af-7515-4e86-b7d5-4466b2d5ec6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ae1998af-7515-4e86-b7d5-4466b2d5ec6d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7398cbcdd16a6c87f3e2194d64dafff30565afde60e09a6d4a1aab1a52f4621c
MD5 6279cd2e1bb2ca38caa025f566388aa7
SHA1 1fdb933dd1c919173f55d66e1bf344dfa14bc2a9
SHA512 4a77a655eff7cd238c60862a1b76ab732c2cca06838507f040cde788d1074723e4c8fa25300a5313f9f7504aec0adc71393d4293847e0071dcdb0cc875a6c790
TLSH
T19841D858B6E91148B3B77F56ABF6A86D487EB9772F0AD45E00110E4F0A22A40CDA1737
MD5 SHA1 SHA512 TLSH

Submit Download

8f5964f5-7ad8-407d-9406-ca106c6a695f.tmp

Path C:\Users\Admin\AppData\Local\Temp\8f5964f5-7ad8-407d-9406-ca106c6a695f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d502ff4-fdda-4506-8a91-ce4904b93ab6.tmp

Path C:\Users\Admin\AppData\Local\Temp\9d502ff4-fdda-4506-8a91-ce4904b93ab6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4192_1612104306\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7b6386b-81de-4508-a5ae-6c3edc615270.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4192_508198392\f7b6386b-81de-4508-a5ae-6c3edc615270.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ldopengl32x.dll

Path C:\Users\Admin\AppData\Roaming\XuanZhi9\ldopengl32x.dll
Size 162KB
SHA256 68d6ea951a2c0a6475a46418e243de914884e089d54afaab047b727e0b11ccfb
MD5 e632c694794c8efe3ffe40329faf04b5
SHA1 ed3dbbb96a15effb274d7f5be5f08acce428e01b
SHA512 04b95c953775a265d740a0ca120e0cf7cd56ea785e2bc7381c05d8ff8035f76fc431e8483185250ff3df91e50bffb93445141cf32e34460831dd26dcd00e88c7
SSDEEP 3072:3VPCwNC9Put6kDheD1uLJx/smfk92PlAlzFg9M4vlSH3VGA2GckNa+:swNOuJDhhP/Pl2RgO2SH3V3Eg
TLSH
T1C8F35C1223458135F6FF167CAEB86B6E527FB4544BB041C3A384896D6E382D2EE32717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-1638-0x000000006F200000-0x000000006F226000-memory.dmp

Download

memory/1756-1636-0x000000006F400000-0x000000006F438000-memory.dmp

Download

memory/1756-1614-0x000000006FC20000-0x0000000070D2E000-memory.dmp

Download

memory/1756-1617-0x000000006FBF0000-0x000000006FC17000-memory.dmp

Download

memory/1756-1618-0x000000006FB50000-0x000000006FBEE000-memory.dmp

Download

memory/1756-1615-0x0000000072170000-0x000000007244E000-memory.dmp

Download

memory/1756-1616-0x0000000072780000-0x00000000727B0000-memory.dmp

Download

memory/1756-1632-0x000000006F3E0000-0x000000006F3F9000-memory.dmp

Download

memory/1756-1619-0x0000000070D30000-0x0000000072163000-memory.dmp

Download

memory/1756-1637-0x000000006F230000-0x000000006F34F000-memory.dmp

Download

memory/1756-1635-0x000000006F350000-0x000000006F372000-memory.dmp

Download

memory/1756-1634-0x000000006F380000-0x000000006F38C000-memory.dmp

Download

memory/1756-1633-0x000000006F390000-0x000000006F3E0000-memory.dmp

Download

memory/1756-715-0x0000000036AE0000-0x0000000036AF0000-memory.dmp

Download