guerrilla | 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b

Analysis

user interaction
yes
max time kernel
233s
max time network
327s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_1552109_ld (1).exe
Size 3.4MB
Sample260626-e7v1gagy6z
SHA256 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b
MD5 c329a16ec3b4832e67ad84d6f6742d32
SHA1 0e91bebf54cb532293cc35cbec1ce41d35aaaed6
SHA512 5619569744565ab0c3ccd627370eaebfcc274d414bbff10296b9af737fa91d20585d529ef9e16426be90402abe9fdd402ab0fc922d5c3ad341f98d98b0e36d8e
SSDEEP 49152:tNsyYfhdpopyX2g3SCXKN5Yh4paWiNhK9Ioz6rfMWHytcT8bN8amDeDahSSwP0cI:t6yYfhdpopyXt5XyRUourfMcqbsB8Si
TLSH
T1F7F5BF12BA818176F5E30171D8BE5BBE4939AD31072494C3D3C4396E5A61AE23B3B74F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution exploit guerrilla otpstealer infostealer persistence privilege_escalation ransomware rat spyware trojan

Malware Config

Signatures

Family: Guerrilla
Guerrilla is an Android malware used by the Lemon Group threat actor.
trojan infostealer rat guerrilla
Family: Otpstealer
Otpstealer is an Android SMS Stealer that targets OTP first seen in February 2022.
trojan infostealer spyware otpstealer

Guerrilla payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5cf-522.dat	family_guerrilla

Otpstealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5cf-522.dat	family_otpstealer

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2009\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2001\FuncName = "WVTAsn1SpcMinimalCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.10\FuncName = "WVTAsn1SpcSpAgencyInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4\FuncName = "WVTAsn1SpcIndirectDataContentDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.1\FuncName = "WVTAsn1CatNameValueDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2222\FuncName = "WVTAsn1CatMemberInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.3\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130\FuncName = "WVTAsn1SpcSigInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11\FuncName = "WVTAsn1SpcStatementTypeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222\FuncName = "WVTAsn1CatMemberInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.12.2.3\FuncName = "WVTAsn1CatMemberInfo2Encode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4\FuncName = "WVTAsn1SealingTimestampAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.3\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.20\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
3648	takeown.exe
4288	icacls.exe
5864	takeown.exe
1736	icacls.exe
6072	takeown.exe
680	icacls.exe
4888	takeown.exe
1308	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4288	icacls.exe
5864	takeown.exe
1736	icacls.exe
6072	takeown.exe
680	icacls.exe
4888	takeown.exe
1308	icacls.exe
3648	takeown.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
54	discord.com
66	discord.com
53	discord.com

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer9_ens_1552109_ld (1).exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	LDPlayer_0900051900.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4468	powercfg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\spirv-cross-c-shared.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\bldRTIsoMaker.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetDHCP.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSampleDriver.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-process-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\nvngx_vsr.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.reflex.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetFltNobj.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-private-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-errorhandling-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\crashreport.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\UICommon.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxCpuReport.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDTrace.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetNAT.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMMPreload.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\fastpipe.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletion.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuth.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-filesystem-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\capi.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetLwfUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxEFI32.fd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-stdio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_CM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Widgets.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NvLowLatencyVk.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\avformat-62.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VirtualBoxVM.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-utility-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBInstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\EGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.pcl.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxProxyStubLegacy.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l2-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-namedpipe-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES12Translator.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\shaderc_shared.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libssl-1_1-x64.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstAnimate.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstInt.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcp120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\concrt140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcr100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-processenvironment-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\swscale-9.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-time-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\comregister.cmd	dnrepairer.exe

Executes dropped EXE 4 IoCs

pid	Process
1280	LDPlayer_0900051900.exe
5952	dnrepairer.exe
3672	Ld9BoxSVC.exe
4556	driverconfig.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4900	sc.exe
4168	sc.exe
1804	sc.exe
952	sc.exe

Loads dropped DLL 54 IoCs

pid	Process
5952	dnrepairer.exe
5952	dnrepairer.exe
5952	dnrepairer.exe
5952	dnrepairer.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
3672	Ld9BoxSVC.exe
4116	regsvr32.exe
4116	regsvr32.exe
4116	regsvr32.exe
4116	regsvr32.exe
4116	regsvr32.exe
4116	regsvr32.exe
4116	regsvr32.exe
4116	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
4880	regsvr32.exe
3332	regsvr32.exe
3332	regsvr32.exe
3332	regsvr32.exe
3332	regsvr32.exe
3332	regsvr32.exe
3332	regsvr32.exe
3332	regsvr32.exe
3332	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4556	driverconfig.exe
4556	driverconfig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_1552109_ld (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer_0900051900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3692	msedge.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5872	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3E78-11E9-B25E-7768F80C0E07}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-2E88-4436-83D7-50F3E64D0503}\NumMethods\ = "14"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-70A2-487E-895E-D3FC9679F7B3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-057D-4391-B928-F14B06B710C5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1F8B-4692-ABB4-462429FAE5E9}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-00A7-4104-0009-49BC00B2DA80}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-42DA-C94B-8AEC-21968E08355D}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D4FC-485F-8613-5AF88BFCFCDC}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}	dnrepairer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E191-400B-840E-970F3DAD7296}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-486E-472F-481B-969746AF2480}\NumMethods\ = "15"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8079-447A-A33E-47A69C7980DB}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E5DB-4D2C-BAAA-C71053A6236D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D4FC-485F-8613-5AF88BFCFCDC}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ldmnq.ldbk\Shell\Open\Command\ = "C:\\LDPlayer\\LDPlayer9\\dnmultiplayer.exe backup=%1"	LDPlayer_0900051900.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-929C-40E8-BF16-FEA557CD8E7E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9536-4EF8-820E-3B0E17E5BBC8}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0C65-11EA-AD23-0FF257C71A7F}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7E67-4144-BF34-41C38E8B4CC7}\NumMethods\ = "40"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-80F6-4266-8E20-16371F68FA25}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4289-EF4E-8E6A-E5B07816B631}\ = "IUSBDeviceFilter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-47C7-4A3F-AAE1-1B516817DB41}\ = "IRecordingSettings"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4A06-81FC-A916-78B2DA1FA0E5}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8384-11E9-921D-8B984E28A686}\NumMethods\ = "37"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-BCB2-4905-A7AB-CC85448A742B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4521-44CC-DF95-186E4D057C83}\ = "IVBoxSVCRegistration"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-58D9-43AE-8B03-C1FD7088EF15}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-23D0-430A-A7FF-7ED7F05534BC}\ = "INATNetworkPortForwardEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1F04-4191-AA2F-1FAC9646AE4C}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FA1E-4CEE-91C7-6D8496BEA3C1}\NumMethods\ = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-73A5-46CC-8227-93FE57D006A6}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4A06-81FC-A916-78B2DA1FA0E5}\NumMethods\ = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-A161-41F1-B583-4892F4A9D5D5}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}	dnrepairer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7966-481D-AB0B-D0ED73E28135}\ = "IVirtualBoxErrorInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AC97-4C16-B3E2-81BD8A57CC27}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-604D-11E9-92D3-53CB473DB9FB}\ = "IStringArray"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7BA7-45A8-B26D-C91AE3754E37}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1C58-440C-BB7B-3A1397284C7B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3E87-11E9-8AF2-576E84223953}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4289-EF4E-8E6A-E5B07816B631}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7FF8-4A84-BD34-0C651E118BB5}\ = "IUSBController"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B855-40B8-AB0C-44D3515B4528}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9849-4F47-813E-24A75DC85615}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3188-4C8C-8756-1395E8CB691C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.Session\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8079-447A-A33E-47A69C7980DB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B5BB-4316-A900-5EB28D3413DF}	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F6D4-4AB6-9CBF-558EB8959A6A}\NumMethods\ = "14"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C6EA-45B6-9D43-DC6F70CC9F02}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7E67-4144-BF34-41C38E8B4CC7}\ = "IBIOSSettings"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3618-4EBC-B038-833BA829B4B2}\ = "IExtPack"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-EE61-462F-AED3-0DFF6CBF9904}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20191216-1750-46F0-936E-BD127D5BC264}\1.3\0\win64\ = "C:\\Program Files\\ldplayer9box\\VBoxProxyStub.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-44DE-1653-B717-2EBF0CA9B664}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C8E9-466B-9660-45CB3E9979E4}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FF5A-4795-B57A-ECD5FFFA18A4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CF37-453B-9289-3B0F521CAF27}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CF37-453B-9289-3B0F521CAF27}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0979-486C-BAA1-3ABB144DC82D}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C196-4D26-B8DB-4C8C389F1F82}\ProxyStubClsid32	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1772	LDPlayer9_ens_1552109_ld (1).exe
1772	LDPlayer9_ens_1552109_ld (1).exe
3380	explorer.exe
3380	explorer.exe
1772	LDPlayer9_ens_1552109_ld (1).exe
1772	LDPlayer9_ens_1552109_ld (1).exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe
5952	dnrepairer.exe
5952	dnrepairer.exe
1280	LDPlayer_0900051900.exe
1280	LDPlayer_0900051900.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3380	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
824	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeShutdownPrivilege	3380	explorer.exe
Token: SeCreatePagefilePrivilege	3380	explorer.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	1280	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	1280	LDPlayer_0900051900.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2884	sihost.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe
3380	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3016	StartMenuExperienceHost.exe
2492	SearchHost.exe
3380	explorer.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3380	2884	sihost.exe	94
PID 1772 wrote to memory of 1280	1772	LDPlayer9_ens_1552109_ld (1).exe	100
PID 1280 wrote to memory of 5952	1280	LDPlayer_0900051900.exe	101
PID 5952 wrote to memory of 3700	5952	dnrepairer.exe	102
PID 3700 wrote to memory of 5480	3700	net.exe	104
PID 5952 wrote to memory of 2336	5952	dnrepairer.exe	105
PID 5952 wrote to memory of 5172	5952	dnrepairer.exe	106
PID 5952 wrote to memory of 4388	5952	dnrepairer.exe	107
PID 5952 wrote to memory of 2384	5952	dnrepairer.exe	108
PID 5952 wrote to memory of 3836	5952	dnrepairer.exe	109
PID 5952 wrote to memory of 4756	5952	dnrepairer.exe	110
PID 5952 wrote to memory of 5752	5952	dnrepairer.exe	111
PID 5952 wrote to memory of 4888	5952	dnrepairer.exe	112
PID 5952 wrote to memory of 1308	5952	dnrepairer.exe	114
PID 5952 wrote to memory of 3648	5952	dnrepairer.exe	116
PID 5952 wrote to memory of 4288	5952	dnrepairer.exe	118
PID 5952 wrote to memory of 5864	5952	dnrepairer.exe	120
PID 5952 wrote to memory of 1736	5952	dnrepairer.exe	122
PID 5952 wrote to memory of 3672	5952	dnrepairer.exe	124
PID 5952 wrote to memory of 4116	5952	dnrepairer.exe	125
PID 5952 wrote to memory of 4880	5952	dnrepairer.exe	126
PID 5952 wrote to memory of 3332	5952	dnrepairer.exe	127
PID 5952 wrote to memory of 4728	5952	dnrepairer.exe	128
PID 5952 wrote to memory of 952	5952	dnrepairer.exe	129
PID 5952 wrote to memory of 4900	5952	dnrepairer.exe	131
PID 1280 wrote to memory of 4556	1280	LDPlayer_0900051900.exe	133
PID 1280 wrote to memory of 4468	1280	LDPlayer_0900051900.exe	134
PID 1280 wrote to memory of 6072	1280	LDPlayer_0900051900.exe	135
PID 1280 wrote to memory of 680	1280	LDPlayer_0900051900.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1552109_ld (1).exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1552109_ld (1).exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772
- C:\LDPlayer\LDPlayer9\LDPlayer_0900051900.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer_0900051900.exe" -silence -downloader -openid=1552109 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" cmd=install|listener=196888
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:2336
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:5172
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4388
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:2384
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:3836
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:5752
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4888
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1308
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3648
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4288
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\Users\Admin\.Ld9VirtualBox" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5864
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\Users\Admin\.Ld9VirtualBox" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1736
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3672
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:4116
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4880
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3332
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4728
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:952
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4900
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4556
- - C:\Windows\SysWOW64\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /powerthrottling disable /path "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"
    3⤵
    - Power Settings
    PID:4468
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:6072
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/g8Fhag9NxT
  2⤵
  PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe5c90c188,0x7ffe5c90c194,0x7ffe5c90c1a0
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,1101406552248800583,7172345812442205659,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,801100796956678214,3804705214454018745,262144 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,9243542952459213244,14156036772237089385,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,16264711226653797642,7120542556056342569,2097152 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,14344169015778192514,3602717000639618141,2097152 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,12816675028214042849,7781874481083136026,2097152 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,4382000598132172107,10878269426765033939,2097152 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,16895421193461624197,1016383222026007209,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5428,i,12223361347162298030,6292983689611426995,2097152 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,17295569375431817015,1643713702197573255,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,17230264907735771397,14867831088405880329,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,7240624602086747173,5258195234215791060,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,10445956506031666634,2393471684372387162,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:12
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,1069264572548856994,16741625533790733441,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,1069264572548856994,16741625533790733441,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,18216398535964111000,3341865682944376384,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,11596459907821050718,7681772589383897049,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,13003071793142971199,1519793180856964579,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:6548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,12723126903556413597,13771876613542904260,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
    3⤵
    PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,515145326878511238,17550407334331907279,524288 --field-trial-handle=2184,i,5259588908058543864,10205447093354600772,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
    3⤵
    PID:6564
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\dnplayer.exe"
  2⤵
  PID:5748
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    PID:4168
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c systeminfo
    3⤵
    PID:5824
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5872
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    PID:2684
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    PID:2748
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    PID:2212

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3380

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2636

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
PID:2916
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:2644
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:3388
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:1884
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:3952
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  PID:4524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP120.dll

Path C:\LDPlayer\LDPlayer9\MSVCP120.dll
Size 449KB
SHA256 9cb478e41026982a4366d567377e3a9880e7ce8477a5ea1fd1ddd1fa96bc1084
MD5 cdfd3c9f6a972a1b3bbc0b0fabbbe39f
SHA1 d137f3a75eb9dcd7390992525dca637f9b678707
SHA512 e89a232471cddef647f990e76e0a04d0f74f81391c342e69395f3fb5de471b3f3064c335526e619d73c0b4961f2635321476c9d5451c11ead0c4ca1b7af65779
SSDEEP 12288:pZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77E:z/8wVwHZFTwFOOos3Ooc8DHkC2e77E
TLSH
T13EA45B237B864CF1D29E53B231C9532557FAFC2441B1F343ABEEE1692FA5282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\LDPlayer\LDPlayer9\MSVCR120.dll
Size 952KB
SHA256 76770d93afb655c882fade5c0909bfdd263cde0ba1762a881c69bb57dda2ccb7
MD5 b46ba3349d9b716a30e617ee8e966707
SHA1 f0a4724e9061c032b0b0cbaaec1f1d13f0de8384
SHA512 ebca95f5b431be8a0eb5b74735cadc5c175328067c091576eb01dadb53ec39fc65b22aa2cca85306320f2cae4747ff5478b232108bd4a60389cd5557f83eba4e
SSDEEP 12288:1BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJD:bmFyjLF847eiWWcoGZVOIxh/WxIAIbt
TLSH
T19425BF12B582C0B2C57202B1152DA73219BFB971443599B7BBD98F0E1EB45C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 50KB
SHA256 e269811316cba3527ca1f1ff54b1bf2ca0a435349d57ff350387ad464da87617
MD5 073553b6d3b92599db810e152541b7ea
SHA1 734beaf96d0b3ff0d6b9d016c085960b3e9b9f42
SHA512 1cf9132a973070e55507cd74570c195c1e3e66a68ab1f5c61dc47a89b5faba0ca49262ad250e99eb26e65cd02ffc6fff4204a7906ccd108518be3d2679a2de06
SSDEEP 768:5Q+agNztWyGOiprkvcocNcb0H/GEM8Jf3c4sbG7nQL44SYiDLk5XkvYijjK5AL:5PGyMprkvxXb0HOafsYQM4S7ekv7P
TLSH
T12D339E929540482ADD560870B9F86B3AADFDB1610BE1C2C7F388C26967507C13F791BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnmultiplayer.exe

Path C:\LDPlayer\LDPlayer9\dnmultiplayer.exe
Size 1.3MB
SHA256 507e3cd8d749ef866edbc5a2f51fc63676a04c81fb7197413e86981714992f94
MD5 ca63ffc300d2c4fd3cf8fcccaaa17f58
SHA1 a99bde9e206d3bcc2cc2385b99fde40fbfaf14fd
SHA512 cb660b1d05d933acc680ace3c65344fe22f02132a58a090063cb9772d986329c8b56ebead38904ed4f5dd47ebde082a8942957f2d25f2c9c68d83bba06f13159
SSDEEP 24576:uPuD6sUjXl2D7vKLPDQ70gBAtUuBhBxy0DRkhP33WF:uTofvKLPM7VBAtUuBhs33WF
TLSH
T116557D207A97C235F7B201B0BDBDA65D502DBD640B2640CBE3D4391E1972EC22E7765B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnplayer.exe

Path C:\LDPlayer\LDPlayer9\dnplayer.exe
Size 4.3MB
SHA256 57fa1177063d6891b4db936d74f8b7da4320a647d2dc1bc5e15fb04bdb77938c
MD5 e989dbabaf01d675fce05144ced53d20
SHA1 f6542f6d921a1be63bdbfceb96bcdfda39560b10
SHA512 6e32423957abb13400981e68c4811a7677af1e8b850aeb0ca6a720d9d9586d714eed0c258e02429f6b00642f186c73a62f151e67ce6b93766b2185601320f970
SSDEEP 98304:mJcBpdoKduOKWp/AdlE5/nIHQmVpa1Xx:mJyV1p/AdC5g
TLSH
T115266C00BB45C226F6A202B1D97DAF6E0429BD701F2955CBF3C43F5D1971AC29E3366A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 41.9MB
SHA256 9d48ce493d7c952d4c04d17f2c35a0592027f37b3a2b40b9b28259aec43788ce
MD5 8ae4078aa040a2163c1c949969eb84ca
SHA1 b27532df518397fa2fa05265cfb1f897196ce640
SHA512 b2ebc4a6b04f966516bdeeba83ef696e9b3f570e2e3d7a662088ab13fc3ee12cacc7e20b66b9bdfd2659ee585d53b9991b9c6317db670d7dd49761fc20bc233b
SSDEEP 786432:g0Aaovi8bBeguoSwFOYDs89hN2LKG7WY2O0o8isQCPaiX916Vn9aKZKgALAmmpYe:gvNB5pSc889hQLZCY2O989HaGyh9fZTX
TLSH
T1B2A7333136B5D132F2A30AB1ACB9A91A14397E34472591CB62D43D1E5D3DAC3BC32B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.6MB
SHA256 c810442319160637ad7dcfdf14e71bc1a34b75aa9b0c55a55e72dcd3c41acbfe
MD5 80c2aa5270eafb9d7fa71a3d61ce5fd4
SHA1 00629cfb49c7b7f87c980f20081e28d83a3e3d39
SHA512 a10fbd0ee81319823eca84cdb938d7f5199bff6f0f429577b53410d7a07081b2ff4931f1df5881bfef6716708d4545649d322ac1fa5da86b7e76c4afc1285f61
SSDEEP 98304:Y3EB+HjpGjbJvmUz+tN1yr9VOcFfkovuZ0alZQkl5h8H7WdzlpCbOcX1x:Y0B+Hjp2bJvfqo9VOWu+uqo07WdzlkXH
TLSH
T10D5633AD2B7D5330259D55AA53E5B520F100CFAE733A28330BA123D4DE0E2BCD9D659E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roboto-Regular.otf

Path C:\LDPlayer\LDPlayer9\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
TLSH
T188A35C4A7753AB49C5126A78C695C3A83B79BD69BB03A21FB1BEFF3211030605DD81DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phones.data

Path C:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
TLSH
T163C1EE57BBEE4E571ADC7DCE3274C9973A0CC449C28D18F839082876DA8C9314375BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.vmdk

Path C:\LDPlayer\LDPlayer9\system.vmdk
Size 1471.1MB
SHA256 b7cae40516e81def2231976a95c1f155c4ef3b61079faf2adb2ef8ac25a237ea
MD5 653b82cd10b33ab5e892c09285092a61
SHA1 b6bd563192545f56a96fae6d7ccc322639ab5b03
SHA512 5d12e55946a069894c59697f342ebb1f9171e76ff98dfb6dba208cc76e7544871c2e7283728c46ebad584cfd646706a8fc90f201566fc76436fddb44bdb71238
SSDEEP 6291456:8Ito8BypgAmdZHb9oMmvU5WMhdmeDjWvcZRhtbSO/m/BuMfk9Y/i1m4cVtY+Sphl:8IggAGbW1MhFWULh9/OVGrzFd
TLSH
T1B9F9C003FA4158B9C8AAD574439FD336EB347C4943339697AA487B207E736D09F2A790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EGL.dll

Path C:\LDPlayer\LDPlayer9\vbox64\EGL.dll
Size 532KB
SHA256 80ebebaac33cb7df8dfdd1344b63a3e1fecb980214218eeaab8ab2f023c31b3b
MD5 92950647ab342ccf982b33816a31ebd1
SHA1 e9c7c2603c0ed37eb890893c6e64945866f333d9
SHA512 f9487db83c33319072baa2c3e5b3222d5f40c03832705ed607bcb856dd1a860e97cb1934cbc77940ee4a755001c0461fe80cc83c3b9d78d49a5bc3cfa84dc4e8
SSDEEP 6144:GPP1r54LFWPAVL4/M4aC+4NKJewLzSvtE0Iz42+a8sct9pFa5Y:GF14ZVL4z1NK1fTgeY
TLSH
T144C46B0276464372D419733BB9638D42E3B2F2650B3F82CB7A58831EDEE76D319B9650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131
MD5 cde2424d99db56dd0d1eaf34811738c1
SHA1 cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f
SHA512 d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2
SSDEEP 192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn
TLSH
T16A822892CEBC9583ED969D7017A8E9837D3DEBC71D10A15521AAF4D838C33D1EB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725
MD5 acf4321ac8c8ff4d0442c799d621f8d9
SHA1 b12f87e6afc48697f1ce8b587715361e89b79cae
SHA512 7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde
SSDEEP 192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+
TLSH
T102823A929BBCD083ED979D3063A8E9837D3CDBC75D10416A05AAF5E82C833D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956
MD5 3c47c25b8141d20b2b4d576000000a61
SHA1 04543f9cdd847ff66389c9fd1e12b444dae6383a
SHA512 c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a
SSDEEP 384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI
TLSH
T12F8218918ABCD583FE979E3062A8EE837C3DA7C71D10556605A9F4E82CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410
MD5 e05ce0232e64328c62c9da37698566bf
SHA1 50c25e6ecec2cd17ecf3117bb9a646ba107d2b84
SHA512 8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb
SSDEEP 192:MmxD3KXWuufhW+sivT16uDBks/nGfe4pBjSfhXa8WebtuVaVWQ42WyMsVqnaj87p:MVXW5hWyvT1Nq0GftpBjSZgkldri
TLSH
T1008218929ABCC083ED97AD7023E4EE837D3CABC35D10556909A9F5D828D33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830
MD5 a26c7ffcf18b62904dab7786de638ea6
SHA1 b28489bc38ee2f522ee83dcf49faeb96f39a77e3
SHA512 768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f
SSDEEP 192:sohaYPvVX8rFTscWuufhWrlFO0ruDBks/nGfe4pBjSb68WebtuVaVWQ4mWst1qnq:JTPvVXiW5hWB80aq0GftpBjQZplBLcQ
TLSH
T10EA20983D9B8E297ED8F9E3112A5D9836C3893C60820459616E9F39D3CD33C6E79895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
MD5 6a55a7e284b51b086b63cc6f2061ce8b
SHA1 46a48a1ccf5262038b71ed4be09cf625009d078d
SHA512 6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363
SSDEEP 192:ByWuufhWrRivT16uDBks/nGfe4pBjSb9bXe8WebtuVaVWQ4mWWrRHqnajjpxf9cS:ByW5hW0vT1Nq0GftpBjSbRZnlHlBLcYl
TLSH
T1998219928ABCD483ED979D7063A8E9837C3CDBC35920416905A9F4E82C833D1EF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
MD5 6e38a6bed88e1c27155e4dc428188ef0
SHA1 8b47a1960ed157f7beeb80fa4a16a723279c4efa
SHA512 3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab
SSDEEP 192:HX6WuufhWr7FO0ruDBks/nGfe4pBjSbnUqs28WebtuVaVWQ4mWOYVqnaj87X/fA2:HX6W5hWX80aq0GftpBj2spZkldrps
TLSH
T1508219D19ABCC583ED8BAE7012E8EA837D3CABC75D10415616A9F1D82C833C1EB1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4
MD5 9304209688e2a18d0b26997bc78fda7a
SHA1 5d4332cf1c5123418c6419d0291486c3939e8785
SHA512 5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960
SSDEEP 192:KKWuufhWr2ivT16uDBks/nGfe4pBjSbYA/8WebtuVaVWQ4mW7TqnajPf33PLlYoM:9W5hWHvT1Nq0GftpBj4UZAljZYsqTr
TLSH
T1AF8219D2CA7C8583F9979D3013A9EA837D3CDBC75C10916A05A9F4D828933D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll
Size 18KB
SHA256 f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234
MD5 f42a84d78a5a15ff1a4dbac591e95783
SHA1 1cd5b5e68fd729bdd340463b53728634d342b0cd
SHA512 89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0
SSDEEP 192:3liWuufhW3XUxQmLuDBks/nGfe4pBjS7LX28We8WebtuVaVWQ4eWmQQPqnajy3Ss:3liW5hWOQ7q0GftpBjkEZfQQPlGinjqZ
TLSH
T11B822985CABCD583ED979D7023A4EA837C3DE7C61D10555605AAF1E938C33D1EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970
MD5 9f286e57e5b1c1a347adf9eef059ad5d
SHA1 631aa1aa364234acc5ad20b27f926e9cb9ee4276
SHA512 6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197
SSDEEP 192:KWuufhWr3ivT16uDBks/nGfe4pBjSbKUs8WebtuVaVWQ4mWMoTqnajPf33PLlYoS:KW5hWmvT1Nq0GftpBjGzZv4ljZYsqHh
TLSH
T1E38209928EBC9583F9979D7013A8EA837C3CEBC75910515A05AAF4DC28C73C5EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141
MD5 beaae8294db31afa04fa60795c6e02ae
SHA1 8a32ebd843e461864747fe0aebf4bbf83c4ec093
SHA512 dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135
SSDEEP 384:rvuBL3BEW5hWh3rq0GftpBjzkZalBLc2V:aBL3Brii2sV
TLSH
T1BF8218C2CBBCE583E99B9D7052A8D9833C3997C75920946A01EDF5D928D33D1FB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
MD5 2ac1289e4dbab076b332869bef26d3ce
SHA1 60570ddd06b671e26c6a814b9c08cdfa0ef38aba
SHA512 e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a
SSDEEP 384:ptAuOMw3zdp3bwjGjue9/0jCRrndbAW5hWA80aq0GftpBjV+ZZrmlGinjQKKX:DAuOMwBprwjGjue9/0jCRrndbX4i3qdT
TLSH
T154922B92CAB8D283FC8EDD703266E9837C39D7C60D11955106E6FAA834D33D5E754A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd
MD5 a2661a468bb87ee9cc5dee968fd3805c
SHA1 9b17fbd552e34888f1453f9113ff4c42efaf6d6a
SHA512 b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3
SSDEEP 192:zQWuufhWrixf/0uDBks/nGfe4pBjSbl7Y88WebtuVaVWQ4mWyymqnajiG7AzTvfJ:zQW5hWS3rq0GftpBj9jZlymlO62vfGkb
TLSH
T18C822A8186BCD583E8D35D3063A8DA83BC3D9BC74D60955A11A9F1D928C33D5EB2492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e
MD5 acbfc011d5842ba60c372ba3d222ab70
SHA1 16b8014060a04bb03215f6ce4c118bae48653bd5
SHA512 dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3
SSDEEP 192:1cIWuufhW3bFO0ruDBks/nGfe4pBjS7irpMk8WebtuVaVWQ4eW5eqnajy3Snk0b7:CIW5hWL80aq0GftpBjNUZkelGinjn
TLSH
T173821791CA7CC583ED8B9D7013A8E9837D3DD7C71D10945515AAF8E928C33D0EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae
MD5 19d14d348ac38737431a7ee2f82973e6
SHA1 11cd8f5dc5c08d133b9b006da5c84946f012cbb6
SHA512 b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc
SSDEEP 192:AlWuufhWrExQmLuDBks/nGfe4pBjSbYsqwZ+8WebtuVaVWQ4mWXqnajnp+MVQ/Tz:AlW5hWaQ7q0GftpBj5VghZoldBQ7Q8PX
TLSH
T1B79229C19ABCE143FADB6D7012E8E9937C3997D71C1040A55169F6E828C33D1EB48A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0
MD5 ea0e13feac13dc18c79eb682bef4676e
SHA1 b9db47624345c68cf07bd2677df537e0f975caf9
SHA512 540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7
SSDEEP 384:ik1JzNcKSIUW5hWP80aq0GftpBjMJZCZslGinjI:9cKSupiEgZ40
TLSH
T1569219D1CABCD2C3E88A9D306394EE837D3AD7C61D25456105A9F6E93DD73C2D62882C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
MD5 1af2a91dc0a4e48bab0ca123073adf30
SHA1 cf6625fd31b17d46dd31b16372840c74026d0ba2
SHA512 45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51
SSDEEP 384:vIDfIenW5hWsvT1Nq0GftpBjeOZLlGinjx:ve2N1vi/l9
TLSH
T11F822A81CABC8583E9D79E7063A4EE833D3DDBC71D20906508A9F5E828C73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786
MD5 9b9d1949b75df171884f6f8caba7ff59
SHA1 411adf413f53c56488d5cf68e9b4b692889f3c4b
SHA512 dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c
SSDEEP 384:yW5hWgR80aq0GftpBjHLzZgfhlg+ZmJy:dmi1LzWflu
TLSH
T18C820991CA7C8483E997AE3063E9EE83BD3DABC71D10556601A9F1D92CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 18KB
SHA256 eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f
MD5 c6e268c877a9be5b43877308b1231120
SHA1 949105c826dee6a32fe1288285e3e41cb7d04821
SHA512 776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331
SSDEEP 384:HGeVxW5hWEvT1Nq0GftpBjvOZZljZYsqzN:HGeVcF1viJOYnzN
TLSH
T1008219D68ABC9483F9979D7013A9EA877C3CDBC75C60916604A9F5D928C33C0EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c
MD5 5122b8aa14a25c8567d9d0335036446f
SHA1 81961f2c8a331136f8156930779964a71e0badc4
SHA512 758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9
SSDEEP 384:1yMvIW5hWER4Zq0GftpBjpTuZV0lO62vfGU:1yMv/L47i7STVHGU
TLSH
T1398218928ABCD183ED975D7023A8EE837C3CABC71D10526951A9F0D82C833D5EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b
MD5 e1b30d56617709cf7dff5f464d7566d9
SHA1 e29646b1c90550cb86ed42782c764d41f2c70651
SHA512 e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511
SSDEEP 384:pvdv3V0dfpkXc0vVa/W5hWiR4Zq0GftpBjkYZjsdljZYsqmb:ldv3VqpkXc0vVau547iCY6Onc
TLSH
T180922982DAB8E583F89BDD7052A9D5837C3897C34820856611E9F5ED3CD33D0EB1892D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
MD5 e4b64b2710725ec3332021bd8044d884
SHA1 2d7f8d87d0f395296ecdf277084d23cb9e0880e8
SHA512 ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2
SSDEEP 384:stZ3KW5hW4R4Zq0GftpBjsnTZWFlGinj6m:oX47iiTomm
TLSH
T1B2822896CBBC9583E9979C7063E4EA837C389BC61D20556115AAF1E92CD33D2EB04D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8
MD5 67fd470a60fe8fb3f9fbe32fa52871d0
SHA1 09aba019a0d0dae7415b6d9a39e1dc67d93f130b
SHA512 f8c3f1e3bee196487aec704f128240acb57fb392db918a97176793b07726f017177abbb5a6c68822fc59ce06f04d489a78284a865efdc2de518f34ecfb0cc1e6
SSDEEP 384:NzgLW5hWgNvT1Nq0GftpBjVIB6RiNZiVlg+ZmJ:NzgKB1viPbRiNUhu
TLSH
T162922A928ABCD143E9979E7063E9DA837C3C9BC71C10816901A9F2D96DD33C5EB2493D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
MD5 f53ed8a0c18157b9e37500621dfab9ee
SHA1 b8a3131150cfd46052353309843c802d9f43df03
SHA512 2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a
SSDEEP 192:QNWuufhW+IivT16uDBks/nGfe4pBjSfASU8WebtuVaVWQ42WUqnajnp+MVQ/TQF/:4W5hWGvT1Nq0GftpBjhyZdldBQ7Ql
TLSH
T17E821992CBBC9083FD9AAE3013E4D9837D38ABD70C20556615AAF5D92CC73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b
MD5 2b9f551cddd662c618432a75c546b296
SHA1 1ddd65fcc8bb401c734ebc2014d057328f771744
SHA512 54df6e692ac630d969a697c9e6f379c4826ca71b7e8eaefdf502405b1333a6b483256aeba609a4a1c61e73f72d2958aaf3eb31538cc5e7a91101d7d09e3ed9dc
SSDEEP 192:GrWuufhWrvFO0ruDBks/nGfe4pBjSb0rjk8WebtuVaVWQ4mWD0qnajiG7AzTvfGC:GrW5hWz80aq0GftpBjjbZS0lO62vfGC
TLSH
T1198228D2CABC8583ED975D3053A8EE837C3CABC71D10956515AAF5D828C33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89
MD5 7d943f85ff8d1515a02d202ae79453d3
SHA1 94def1f7368172ac50b665e74b89e8f7aae2857b
SHA512 e111dbef97c6c6cb3b5c2d183294620792c48a2cb16d9d91c12cede757a1c0c53d707f4294542bef47eae784893bf63fe0f0229bed4b2d0a961c8d1cc1cf43cb
SSDEEP 192:VyWuufhW+JFO0ruDBks/nGfe4pBjSfG488WebtuVaVWQ42WyWqnqnajjpxf9c9kY:VyW5hWU80aq0GftpBj6ZXlBLcmY
TLSH
T1D5923B9386BC9943E9878E3063F4EAC37D3D97C72910616554AAF1A828C33E5FF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
MD5 278857b86f667c47cbcce94f5ec73ca8
SHA1 a0f5b7e7c67f3c6b8f285d39d08b740e49445755
SHA512 ebc02d1a2e223eb0b30a8e62089735faed83add4161094493f62561a09c13a426815e7f06c20c44477691109a8c3040dc68527023bfee6d9984c42d6a05208c9
SSDEEP 384:vcJ2yyW5hWGQ7q0GftpBjFZ8UOwlGinjP:vQgiviDcj
TLSH
T12EA2F843AAF86F62E99B1B7121F9DBC32D384B82195052B5811BE1DC34837D1FE66C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
MD5 6493b21fefae874655c62a56a156f3eb
SHA1 c65beb46f9f03d35867ff008026d3a56fa26fb65
SHA512 93cbe187f7fa86ac58191b5384a993135e3291873a76cc2cf81dd60c68ad7591386e4eb5ab53aaac2a6f48f7f778263b7fa0a4ea0863361910a9f1efee92b64b
SSDEEP 192:45oWuufhW3dxQmLuDBks/nGfe4pBjS7Ji8WebtuVaVWQ4eWbj8qnajy3Snk0T:4GW5hW/Q7q0GftpBjmZ08lGinjT
TLSH
T113823A81CABC9583ED97AE7053B8EAC37C3DABD71D10516605AAF5D828C33D0EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
MD5 ae83311041ee793253ff10736317a09e
SHA1 c62d06cb6cbd9d997c42a6ad7f13c06f38725069
SHA512 0fabcb0370330460f8f525401f339535c08d768f075816989a16eff2256584cfa8fd6832df3ce3d9c2a5364b4ef58bfff53cc486e3b48d11b654f7174aa18458
SSDEEP 384:gTnWm5CoW5hWSvT1Nq0GftpBjMkZaA0l3uzJ:gTnWm5Cfz1vijj/l
TLSH
T1559218838BF8A953ED971F3112F8EBC33E3D9BC219114266906AE59839C33C0BF11959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
MD5 12311308d7d65895b3920b3dd3e54b3b
SHA1 3faa74c6913f451d9c575761630b507af0c15ee3
SHA512 67fd047e760dbdadb06cc2c34b935fdabc629fa988484a9f5120cd59d6167d943b612df65626701022b5e73c5b1177a8d813e90c5990468f51a5a11932c008ed
SSDEEP 192:QwY17aFBR7WuufhWrtQR4+uDBks/nGfe4pBjSb0NW8WebtuVaVWQ4mWMUVqnaj8F:QpWW5hWyR4Zq0GftpBjhNJZYldr8
TLSH
T1EB822AC28ABC8583ED97AE7022E4EBC73D3D97C36D10556641AAF1D828833D1FB1491D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
MD5 3dafcf25a2ac1becf40acbec8fc7134b
SHA1 0729fdc617403622c2edd77fdb7dd49b530e2037
SHA512 9dbb487489c8a6af8dbd6326fe4958f489552af268f2937495ada35bb8404cfaeaf54833d8bba2966e72cd0ba3284a5fd167baf4cd6d905870f5d1ed3e5ff6c0
SSDEEP 192:QPqWuufhWrHxQmLuDBks/nGfe4pBjSbZjk8WebtuVaVWQ4mWK8MVqnaj87X/fACD:rW5hWdQ7q0GftpBjWjbZZldr63
TLSH
T14E823A828ABC9583EDC7AE7013E8EA877C3D9BC31D10556511AAF5D828833D8EF1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-math-l1-1-0.dll
Size 27KB
SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
MD5 f32bd567d35d2e85504c39dede609e72
SHA1 b7a7145956466e45bbe6f7fe41e935a152c2c325
SHA512 55396f3e5821d3f3eb5988bd3362a0cddf036de4afa8cc1214813834b5a152fc3df787a8347a7aff3de6bf112e1d2a354790f593854a59f1f49393ddf967d085
SSDEEP 384:77FRU8HM4Oe59Ckb1hgmLydW5hWjQ7q0GftpBjASZLN8ldBQ7Qa:77TjMq59Bb1jyYPiyS8Q/
TLSH
T15CC2F64789ECFF93D58B4BB312F0CBCA6D385AE25491B5B5C85BA0C834923D0BE47949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc
MD5 56c02fabc2c64174009c905570c3a22d
SHA1 e52154112ad127ab01937453490091def4d21ad2
SHA512 9f22f70b5de4078fcbfdbb186d6cf220561200092eb7ceaaad9d44a5281f84abfb1729f4e447dab3753225d5fc6c44d94363e3729e5765dd2213213c327c4c1b
SSDEEP 384:YbmLPmIHJI6/CpG3t2G3t4odXLBdW5hWYR4Zq0GftpBj2q8ZWlGinjge:PPmIHJI6PY/47iok1
TLSH
T120C2835B8EB86E12D58BDBF3B5F2C7C63A354F8104C07375A56B95883842BE9BD06D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-private-l1-1-0.dll
Size 69KB
SHA256 c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac
MD5 4b27cf5cdb20aebf113df752019ffca3
SHA1 b02c6e45f704dac118f81c324122c189e3e61e17
SHA512 cd4df2478d719e159e2252e6784d24e4260c13d8f47774ac33a8e10b1fa96d38236bf2c3ebc060a5801fc19392cbe5c636befa898721bf114956c2be6476bbd1
SSDEEP 1536:ccXDvBRh1De5c4bFe2JyhcvxXWpD7d3334BkZn+PAc5ed:cczDh1De5c4bFe2JyhcvxXWpD7d3334+
TLSH
T16E6329DB49EA3F61E58FF7B367FB17C91B253A4408806174E9C7956B34853A9BC43A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8
MD5 fa677cfb18ba1370d8bb98681c48cfbd
SHA1 cbccd561bf53c59254fb04ab136996b81cc80d3a
SHA512 9312acd4955d4950d851910198d4ee622b75e11262e409c79391078d12d2d0db320723a1552048acc0e9deb30378e3cd27d4fabcf2077d429eedfb275cdb73e3
SSDEEP 384:BpOSA1W5hWk80aq0GftpBjy11Z+lTMs6WbL9J:vlkiM+TFJ
TLSH
T1CE922AC7CBBC8993E9935E3012F8DEC37E3A97C758109165946AF0DD28833D5AB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
MD5 595a997bd415c8ae0ef1e3c3b73e6091
SHA1 10f34bc2f474a43bfaac26f66ec8081106c12253
SHA512 944f6bc405c69d6bf6dc97652e9f296658bd3de078dda50ac680e56818c00dfee909b100fc2fa9c6a891c55dbc66dd62ac52819950732c83198dbb8c04f3c9b8
SSDEEP 384:ETr7ZW5hWgvT1Nq0GftpBjqZaljZYsqn3:2r7Ep1viwLn3
TLSH
T190A2F7838AFC6E53E9875F3212F8DBC32E3597821910516A88A7F4D838C37D5FE26519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
MD5 415d765aa267382a79e56e428c80b1e1
SHA1 1bf13460b8aaac1538bf45186a1624825bb8c355
SHA512 7236ef7b2937718409ef4eeda20318b1697e7c1c868d0df263f4be8673365d48ff6ffa2317bfd1881b6cb3dd1300410ad4f715b8e01ed321c4011aac88490d21
SSDEEP 384:xHCFVh/W5hWOQ7q0GftpBjDdZNil78oStBdo6:xHCwgiT7Aa3db
TLSH
T179B2088385FC6E42E6874B732AF9EBDB6A3587C3281071B98417E4D835C63D8BE13419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
MD5 5bd5a9001cb0555c5b2b14e0cbc8d922
SHA1 4562d23fba312fe95cbc777fd7c2e37ca1e76ad9
SHA512 a6271f28f069a00c2912f80552bd54bf0d8461886adff626b336d25943dd0ade19eb88c718602017a1986317af3eb5f94f8896e88b9367207e8b53225322cb84
SSDEEP 768:Yl5yguNvZ5VQgx3SbwA71IkFMLirA8Fma3dnL:Yl5yguNvZ5VQgx3SbwA71IvL2maNnL
TLSH
T147B2D8438AF87F42D98B5BB265F9CBC36A388F8615101275C467E4CC38827D2FE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
MD5 f719ad4c04043f55a21e73805997b287
SHA1 0e88b1271b242f7933e78edcb05131612cea061e
SHA512 752b9b4385162126729c3f09b3b75d7121c8dec00cce11f7cf1ecaffed3e79addcbcfe8bdd4e20e15b8494bfe2d24c3f2d11583860b1e03be021196bc83fc3bf
SSDEEP 192:N3LD3WuufhWrzGxf/0uDBks/nGfe4pBjSbA097b8WebtuVaVWQ4mWmVeqnajiPNg:N3W5hWq3rq0GftpBjr0974ZVelg+ZmJ4
TLSH
T1949207838AF8AA43E9D75F3112F9DBC73F3997C21D5061664166E4983A833E4BE2581C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
MD5 a405399d5b958a03e6054307a631553a
SHA1 dba43f0afd8c6e1f61cf0be7503c6f70b48b8240
SHA512 33c64766053058fa9fa4fe689f1ca5a345b8b70443995d71aa65b64c7bb38d4dc3a2b37ad06a4ce5ca1c927ed9ea4377443eaaecc69b0e758ff265e755194287
SSDEEP 384:IbNfmW5hWBTMq0GftpBjZtwZkilTMs6Wba:WfBYuieGQTe
TLSH
T1B1822A928ABCD583E9975E7063E8DAC37D3DABC319209165516AF1D828833D0FF1192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\LDPlayer\LDPlayer9\vbox64\concrt140.dll
Size 310KB
SHA256 01729ff33c2e3db1033fb86e899d62026dc1c03705269bb9636227f61934d9b3
MD5 67a3ad0fec3eb767e423e3d7a9134343
SHA1 42949506bc8451031425840df33f3acab5637b52
SHA512 f3b13d38f44acf37c5002f08b684cb2955b778c8a703c8fca6e07eecaac45e1bf4bb036dda055114152390322351ef936492abbf6532d1a48fcfd29304b4db1b
SSDEEP 6144:ZEI93zcNn3dMiBXHxHSSXfPnevwbbeVuX0cp90nWzgQQf3PzX:WIlwNqihUSPP2uzK
TLSH
T13364189A36140CE6F967D1398A53C90BE7F2BC416362D3CB0264879E5F537D0E93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\vbox64\crashreport.dll
Size 51KB
SHA256 6f35dc1553fdc0070464004e9ed1f5eb17ac5979405b1f30a9bd8240ca5019b5
MD5 488dd1dac662038f7152801dc01b21bb
SHA1 5e3bdce9cae493d993f94c9f47ef58581c26b29f
SHA512 881dc7b48d21e3b0fd1bd7f1916d73ac9e6a59edf228fc16a4d4de61ef2db8abb8c32c62324f4a429eec111c75ddf5ffcf7e69b5a8e502532a4f5c4655a039b3
SSDEEP 768:rNYs6LsazaYID9XICSszm36nVl8xzez40YiDLk5wkFQG9YiXkFQT5ALJQ:pOQQaYIRzjVl8xqzf75+7ZD
TLSH
T174339EAB47D414A5CA17D670B8E2AA17FAB3B2950B51C2CB2330C25B0F72BD13F79255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 641B
SHA256 64d0dc1fb3f871c97c8d22a8659633d4d14ab7526cca1af526bbe16021fa5434
MD5 bfa85ca1c69c7367380ff50c93934147
SHA1 e3e72322ec1836d075163e0b5236824ae94a2fdd
SHA512 cf19c7a68093bdf21e0fae943140d7ba9a37365af5fb08593ba91b4b5a7e4cf0ed10b0cd812a6e78edb2a5aec6c24e3303b952b9561a25246b1632be73ea8ee0
TLSH
T1EAF0F412EF495C9F00E85906BD555701FC20960F0761B267733D59198B28CBAB3C6832
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 7de87442c7ad37fe630abd6ffce62ff5515ccc861e030df7c475a6b8ba157f62
MD5 d2a1074fd72ce7642bbe359a3b7aa7b2
SHA1 6de6bc1b150dc8e3b2b7df1b28f54323c38c2001
SHA512 a3a0b861d7550addd119cecce96f68013bfb45f74effeb84248b10cd82ac620894dfbba48576f816356a64dff13df8e2f1e9d4f965fee9c33a9d428114508e7e
TLSH
T179F0979710A06C90541F0D962DEAD8342A24468EACF2C6FAB9A998A658763F4A2168C0
MD5 SHA1 SHA512 TLSH

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\988B237EEF5919FAB97ED3A790613BA6
Size 471B
SHA256 24da7795dcbd4a2545c765a190c4567e24539f1d456798457168104e7503f9f0
MD5 2f2b0f3e316f12b542830bf038a156e1
SHA1 8a6f680ec54ec3f1181b221c6658cc3e8e2b6325
SHA512 75b9d04dd2e6fbc0ed8149007065f6fcb96434986e03fb9064846eb811e08e530449ef590f33eb36ad8e0ed6fd4e61150ac42d2e14a1d5cc43a66310e3113b3b
TLSH
T13FF0DC83A020E4016C38C90862EDEE603C2583B42CADC807B23DC6A2E124BE943839B8
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 471B
SHA256 9e0d73d46fd18b6e9b70426569f526dca288d95d6a39a32f27f6207f686a57b9
MD5 ce51964885b5af2d1f4c9ded18471a27
SHA1 c8549f3ff225659879ae862eaf325136ebc0f79e
SHA512 66df9abde605be17d6faf8609b7756663ac7232d73baf6d793468a02b928c4f395731457d0dc954607113f629656931536f0694b8f3742f00c7c808ac6d64816
TLSH
T1FFF054410C9EF903FA0004ED44B483FDB020A00448F18276680D4CE2CD48B316F23139
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 f201f2c2be16028c27d68819f170d977af14a14564485f2d3f234b1a5c38c319
MD5 fed0e36c7e393cad9666a82986d79344
SHA1 dc3273b1475d4673ba0af7885c97ccd41f0d3c13
SHA512 c80c4a1aa3c3758cc99ccad6e2025a62a8dd7187d9000183e06c825407f4f316a380fbdf3f6c035eac643ab87d8cdf0ad8da7a585817b0018b03d9956524c34f
TLSH
T18DE0C63828FA127CF1B0EA340BC6A622003BF2015C28A6792BD0061AAB0B500DC72C35
MD5 SHA1 SHA512 TLSH

Submit Download

988B237EEF5919FAB97ED3A790613BA6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\988B237EEF5919FAB97ED3A790613BA6
Size 408B
SHA256 b48598b6320fc35ab7b416089e1384998e721386f3cea604f96d0cc3c600fc1f
MD5 b9beb4d907c112f38436a61e1e242aaa
SHA1 ca0be0acfb5d420ab16358c788cea1c27a06c175
SHA512 f31af2379e04ede35a1abf08dd187c9c2491370d7813b67cfb09d21638bae42910cfc823c731a916f63ac55c2334d7fbf8edc9e5afe359630aff33327d45bbb7
TLSH
T190E0263852FA825CF176FD78C3CDB4658CA5F32B0D109B7669C0420BA71BD829E62E35
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 416B
SHA256 1482e45962c3bdd515272771bca2a849485b14a0620a8b88fa60018347726315
MD5 ded97cebe2180dc90adfa5dab8b1ad0e
SHA1 c5aab8fb3ef479e94710d57486e3be27d098b818
SHA512 0769e2a14e8b0f0b5776286a38c8384c355ec90edd4e260a890f8d0ebb99faf6efe1124656dde4f44ec84bb3569806179b6940706fd04da9925c05014004f884
TLSH
T1CFE0683414BA812CF2E4E4365AC47A20086AF2320415F2600BD49B08E206940AC52A21
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 4bb6f48834be2ddbbf82c9a823c85aab163bd0846dd7699d51e70f4df3066cfd
MD5 8017e72808e578269bf5a21a22fd6527
SHA1 3cca498a9002ad5313c76fcf67cb3435bca2c20a
SHA512 67bdb49511dbae2e3e10ed6a91f2f49836582ee8366af91ac85530a3987d6d7f6901705a6427dd05208c1b0b809b08609ba1c0de6ca93948eb3e2e572f5039b5
SSDEEP 192:xLXBknysAmREfDFUZCBaNBQubwvzI4+fD1dzx+v2Zb7gMIj1EFCJ8MniQwKKUfMh:xLXBkysAmREfDFUZCBaNBQaMzI4kD1dB
TLSH
T1E4F1C8D6B2BB6097D70D97B500EF6546737D9049FACB2D81092801B2FAEF354176313A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5dead0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5dead0.TMP
Size 1KB
SHA256 7de8571f2cf009ccaad0d85571cb1c50be1a0b31983d85c316ed0674f94e863f
MD5 8844a6e3e2f41c561432f595e861c97e
SHA1 33775991c6603222c367bfb490f800647b6d7562
SHA512 9d45bb1114bb69c25968f8d26fae8591247ad8252a7233751d289d1dc95e8aa9835cd8c926a4e51d9021c3b837eb2fb49447a47db319fac7eec378f2fb6ae7aa
TLSH
T10831FC60B7778427D764C4F810F07E857370A85AB59F2ED0095900B7BF3C7A9587364A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cb5493001c79b9d02d785296f1623fa9a577f017ee8f0936a3ae46a366ab7e23
MD5 dc6f6a30eb9450f689da9858142b820a
SHA1 6f64b273afacf4eafdc977a6c04ad393759c9e82
SHA512 4bb5de64cc4b2bd599a9b6dc570449d835b318303f750fe18bcdeacb113ecbb8fd544f2c2bd3f52749a1a8b9da31c44f48798308e949a16d55d9041d19070cba
TLSH
T177318DF3C2E8467D8A4146F87B182E6BCE2D0854532C3D5BC9D49F5F93E18B1E28094E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 27094dc7002e194012322cda8f9cb2c4403bf5d8c14745474d47c0a853112ca4
MD5 06bca5211d7267f53d5364ef177b2003
SHA1 fea07b36d9a329d6e6be1b9c123d1e016710b86e
SHA512 a69a339cdc60138ff663e8ce15ef1b935f621fc42e745eda2d61e280da0b2330d17666705b6fe2930bc03f17de2f691cf040e4976ebb2ed9dba432b3c275252f
SSDEEP 192:sxRGRRcn/fKsDxcaDVB9pyozoA8plB/g6+WNptL/YJ9KGtIgFJ:sxRGYn/fKsDxcaBB9pyxz/5z/gv
TLSH
T1B8329816AD28993B8CCBE219FB55BF53D6F91032A5941E48E6FC861C04EBADD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8ed1791fc41abbf2804e1ffc3c809462208afcf7cfe8db1b67b2994441a2e6d3
MD5 0cc88259bc1af0d89f5d82870f3db5d3
SHA1 4c5640d85440b93e3208906a22215952f726128e
SHA512 aa8096303a2caa301e68bc60b1509471cf6ffde67baccc1812e0e6166717a2ff56fc7ac5f3fa2e6531f69b50668e087cb904c960ffce5bbad7b923a90f903839
SSDEEP 192:sxRtRhyM/jK1Ml8wcn/fKs6xcaSZlozoA8plB/g6+WNptL/eBYJ9KGtIgDtJ:sxRtBCn/fKs6xca0lxz/5z/eeT
TLSH
T1F862CB16AA345977CCDBD209FA957F53D6F80573A2901E44A9FC8A1C04EBADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 61ca3fe62d022c366ff7abf11c6e756267149b4879bb68ab34ed1ac48df79c73
MD5 b143c795327ad201046c797ac95c9d97
SHA1 52dd905fd1202278876a6224c289dfc285483174
SHA512 1d8c289962c00e4e5cc73d45b3fb55665d147c5a99823db7641497932d8529e0e4b3398eee3d0a00149b2ab885b05d6b1e7565b20d31bf145a03e5af09ebe46e
SSDEEP 768:v1D8Pw7pLuL7e7WgeEfLq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2tHDZhCrol2ZFo:v1D8P8E7e7WgeEfLqu1jaltHNhZN
TLSH
T17DE20C3B680CCB7E4F444A9DEC29BD9A6DE801CF96D8CD5447FA880C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b8b794dbfb6f79eea016df5ad04fecb02b5cd11127952be449c5c80b1679e4f5
MD5 98206dbc5d0a06012f4553f0ab927cc9
SHA1 4d7c385157fb7355757e662e0e141ca2eec4e643
SHA512 56261ab7638ac16f91bf64915b5a465a0ff8eab48c567e4946613df3f3fc4512ca3c3e06474bf12e7fc9f6de8b9eb959d6e9af3852abc9a833047e21ac321b84
SSDEEP 768:vYh85w7pLuL7a7WgeEfUq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7DZPCron2ZFN:vYh858E7a7WgeEfUqu1jaYNPZO
TLSH
T197C2DB7B740CCB7E4F900ADDAC197E9B6DA802CB96D8CD5047FE981C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 5722cf7af086caaf9f8a1e100fbefc839d52528691debfea9ef8476878c59761
MD5 f901a3b4c8310a10c3f97e483fa26cb7
SHA1 5c7745ea126f7d8c9ef24d0bf48510000c35aadf
SHA512 10328b902c0ee92cd2c7ee8af86ee059355ddff4c87d8f401e655374768557e86ac35798012c28b72f52874ba3a1bc14e798622a568d4c350877bb457072dafd
TLSH
T18BD09773E4680A80D7BA4F82A722102E07203C8C209EC08C9C0201299804A56A422F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 60fa832476b9db070a4e0046d78f36d2da6b4f465468dbe39d07ba8247934b85
MD5 e69b958ccd111a57c23ce2fd7c823712
SHA1 4933437011706c9a3689b5e397c21bc755d494c1
SHA512 8c5b7dee74f21a44de70f5ac2ed8e218a1ac342e5b1c5391388490fe489a67761db9045f0ab4384862434d4d25acd50979ca33b2216ee1586d4ae5bb8558bb44
TLSH
T15BD09777E8750A80D7760F82A722106E06602C8C288AC08C8C02313DA434A46A121F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d5e40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5d5e40.TMP
Size 138B
SHA256 51af141fb68aaaa16e87ea1694999835b26d8c3ed328a0e19ef9ba92458ebb5c
MD5 3e8973fb8abaaea85378fb1c34867ff9
SHA1 694dc9ffc4921f26bdbdc1bd08060de6e5178ce0
SHA512 4a44f30b9d0005f62c32e13afe44698ddeb856f0fd1b787b9d9be2b145d78155d2fcb364fa67386a9850f3ab57f10745263562c443489b10910a7d49e01c19ca
TLSH
T175C08C73F0450A008B3402419322104D47442C8C58C3898DA81231246035A232901FA2
MD5 SHA1 SHA512 TLSH

Submit Download

bed373ba-8d14-4e95-9ae1-31ac336a0b7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bed373ba-8d14-4e95-9ae1-31ac336a0b7e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1fdddf675e0969c6e2c9e5844d91ffd01d00804bc743d78266e231e53f61533f
MD5 ba9907278fe7f3fca89558863fc43bf4
SHA1 ccfcf9ba9f78ae21254293d66bcaba24438634eb
SHA512 16394b5a40439e00d115f3183a246f9ff5fd35f7ca80c0c1d5000e2217cbca9ebb3f53952e85d92d1998971a8a3206e47931bc016d2b28bd67f96bc54233ba1c
SSDEEP 768:Cj+9E3Jvx5G89qyVCgZSVCKPFECrBhpjcNTzn12bf4:x9E3T8gs0KPF1HRcVBy4
TLSH
T12BF2BF74A8F85E634CA7C699B207724ABEF452A3D1C91F48D5D89B0D48CB39D2317C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 76b3269b5c3e7cf53b2b170172930db9d3e0088f95e02a1cf2595cf3af39ffdc
MD5 611a43e6f3d5e7f8ff6419af3ce536d2
SHA1 3a12e81b39316201e156e0fbe65e3138a31f1d6b
SHA512 dc83c73b00c0237989ce36bfb20eef09d2382f6a88b51c8bc7ff8ea841bb7703170d42bfd713ed7fff78d1083b846ead717f3191ef16871d902edff6ca230e5d
SSDEEP 768:3jaeqD4MlshiLdMmi3avx5G89qyVCgZSVCKPFECrBhpjcNT+ApX3JT6:3qcjhIdMZ308gs0KPF1HRcV+KXk
TLSH
T19D13BF74A8E85E634C77D255B25776876E7802E7C2C92F8CD8D99A0C45C73DD230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6587986cc0bae470eab6b598ba6ddfe3659840423ac0c42c36ad14c1e44095c1
MD5 fc49a9efbcfb41641922fd8fdd502378
SHA1 c1ea7dfac4b93372f247eb52417635d9a527d71a
SHA512 c20f6b7a94f7464320cf03e42751a7d40a88096a820fa948ad0918d022f398e9955b188b9346951992f7163757d796875adf58e4ec8e98dc6e49ff45330107e0
SSDEEP 768:rjaeqD4MlshiLdMmi3dRx5G89qAVCgZSVCKPFECrBhpjcNT+ApX3JT6:rqcjhIdMZ3/8gs0KPF1HRcV+KXk
TLSH
T14F13BF78A8E85E638C77D255B25776876E7802E7C2C92F8CD8D96A0C45C73DD230782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c49cd70b4a19c599f8f124f281547fd4c6a6cd67b6ce191297418a785e5d5d8f
MD5 bdb6a4c0bae1a4a04edfbc10c43c8bb0
SHA1 0777ce14c4187f067e2f545a0b36589954890756
SHA512 225f34671227c45578b9e62ff9adc2dbe3157ffe2c103eadc8254480ea0060f050dd08206e45f54fa19a6ef5b4ce702a253a121e172b74dc9e3ca143ca2d5e82
SSDEEP 768:bjaeqD4MlshiLdMmu3Ag5G8OVCgZSVCKPFECrBhpjcx3+ApX32TB:bqcjhIdMB3G8gs0KPF1HRc5+KXk
TLSH
T10203CF79A8A41E738C77D245B207B2566EB84297D2CA2F8CD8ED6A0D45D73CD130382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b733348-e4ef-4acb-877a-1fc81ab545c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6b733348-e4ef-4acb-877a-1fc81ab545c3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 7c21835f01895c1ee4e12f81e71ef06a0f6e2b9281de493ff8ec95f913e9680d
MD5 5743e1a9cbba5e0ac691678e538977f0
SHA1 6ae4efd8c79374e75a436dea2ed2bf7f3232c492
SHA512 994e1fa69d5e98a6814cd94b1b34d30ca6ffb422651e55f87ca1f021d522828902c1989d057b0a7d483edf4809fcd12953f09db86895bc279b25ad9791377933
TLSH
T129F0DC63E3E21157E837427C88A725D2B230E1106EC925338290AE4E3C373052F224F8
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2404_1024759293\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2492-22-0x000001D101BD0000-0x000001D101BF0000-memory.dmp

Download

memory/2492-15-0x000001D1001E0000-0x000001D1002E0000-memory.dmp

Download

memory/2492-23-0x000001D101DE0000-0x000001D101EE0000-memory.dmp

Download

memory/2492-25-0x000001D101CE0000-0x000001D101D00000-memory.dmp

Download

memory/2492-55-0x000001D1145E0000-0x000001D114600000-memory.dmp

Download

memory/3380-984-0x000000000EA40000-0x000000000F2BB000-memory.dmp

Download

memory/3380-199-0x000000000EA40000-0x000000000F2BB000-memory.dmp

Download

memory/5748-1130-0x00000000712D0000-0x00000000712F2000-memory.dmp

Download

memory/5748-1129-0x0000000071450000-0x0000000071477000-memory.dmp

Download

memory/5748-1137-0x000000006FAB0000-0x000000006FAC9000-memory.dmp

Download

memory/5748-1125-0x00000000729E0000-0x0000000072CBE000-memory.dmp

Download

memory/5748-1126-0x0000000072EC0000-0x0000000072EF0000-memory.dmp

Download

memory/5748-1133-0x0000000070F10000-0x000000007102F000-memory.dmp

Download

memory/5748-858-0x0000000036C70000-0x0000000036C80000-memory.dmp

Download

memory/5748-1127-0x00000000718D0000-0x00000000729DE000-memory.dmp

Download

memory/5748-1128-0x0000000071740000-0x00000000717DE000-memory.dmp

Download

memory/5748-1132-0x0000000071050000-0x0000000071076000-memory.dmp

Download

memory/5748-1131-0x0000000071080000-0x00000000710B8000-memory.dmp

Download

memory/5748-1134-0x000000006FAD0000-0x0000000070F03000-memory.dmp

Download