guerrilla | 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b

Analysis

user interaction
yes
max time kernel
1049s
max time network
1046s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDPlayer9_ens_1252_ld.exe
Size 3.4MB
Sample260707-qa3vlafv4p
SHA256 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b
MD5 c329a16ec3b4832e67ad84d6f6742d32
SHA1 0e91bebf54cb532293cc35cbec1ce41d35aaaed6
SHA512 5619569744565ab0c3ccd627370eaebfcc274d414bbff10296b9af737fa91d20585d529ef9e16426be90402abe9fdd402ab0fc922d5c3ad341f98d98b0e36d8e
SSDEEP 49152:tNsyYfhdpopyX2g3SCXKN5Yh4paWiNhK9Ioz6rfMWHytcT8bN8amDeDahSSwP0cI:t6yYfhdpopyXt5XyRUourfMcqbsB8Si
TLSH
T1F7F5BF12BA818176F5E30171D8BE5BBE4939AD31072494C3D3C4396E5A61AE23B3B74F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution exploit guerrilla otpstealer infostealer persistence privilege_escalation rat spyware trojan

Malware Config

Signatures

Family: Guerrilla
Guerrilla is an Android malware used by the Lemon Group threat actor.
trojan infostealer rat guerrilla
Family: Otpstealer
Otpstealer is an Android SMS Stealer that targets OTP first seen in February 2022.
trojan infostealer spyware otpstealer

Guerrilla payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c702-315.dat	family_guerrilla

Otpstealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c702-315.dat	family_otpstealer

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2004\FuncName = "WVTAsn1SpcPeImageDataEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.20\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "GenericChainFinalProv"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{18B3C141-AE0D-40F9-9465-E542AFC1ABC7}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.4\FuncName = "WVTAsn1SpcIndirectDataContentDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.4.3\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2008\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.15\FuncName = "WVTAsn1SpcPeImageDataEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPVerifyIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverFinalPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "GenericChainCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221\FuncName = "WVTAsn1CatNameValueEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2006\FuncName = "WVTAsn1SpcStatementTypeDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
6028	takeown.exe
5108	icacls.exe
3900	takeown.exe
2568	icacls.exe
5616	takeown.exe
2572	icacls.exe
2724	takeown.exe
3168	icacls.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2724	takeown.exe
3168	icacls.exe
6028	takeown.exe
5108	icacls.exe
3900	takeown.exe
2568	icacls.exe
5616	takeown.exe
2572	icacls.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
59	discord.com
68	discord.com
86	discord.com
92	discord.com
45	discord.com
46	discord.com
54	discord.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	LDPlayer_0900051900.exe
File opened (read-only)	\??\F:	LDPlayer9_ens_1252_ld.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1472	powercfg.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-convert-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\libcrypto-1_1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-synch-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ossltest.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\vccorlib140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxEFI64.fd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\capi.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDragAndDropSvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetDHCP.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-datetime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-file-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcp100.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-conio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\capi.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\vcruntime140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.inf	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\regsvr32_x86.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxAuth.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSDL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_V2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libOpenglRender.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\swresample-6.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-console-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-processthreads-l1-1-1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libeay32.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\msvcr120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxCpuReport.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-stdio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5OpenGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-profile-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup-PreW10.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSharedFolders.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxTestOGL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxVMMPreload.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-localization-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\nvngx_deepdvc.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetNAT.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VirtualBoxVM.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-interlocked-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBTest.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-profile-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SDL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-runtime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-handle-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\shaderc_shared.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxRT.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qminimal.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxHostChannel.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.dlss_g.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\padlock.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxBalloonCtrl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\crashreport.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDD2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcp100.dll	dnrepairer.exe

Drops file in Windows directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1257033244\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1784628675\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_856351086\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_856351086\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1864098997\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1864098997\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1864098997\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1541172028\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1162222829\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1489250584\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1489250584\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1489250584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1915299932\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1721353144\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1721353144\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1541172028\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1162222829\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1162222829\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1417622564\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1642612815\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_856351086\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1489250584\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1417622564\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_396569540\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1784628675\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_396569540\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1541172028\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1162222829\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1162222829\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_396569540\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_396569540\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1642612815\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_856351086\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1162222829\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1915299932\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_396569540\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1541172028\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1864098997\manifest.json	msedge.exe

Executes dropped EXE 14 IoCs

pid	Process
5660	LDPlayer_0900051900.exe
5404	dnrepairer.exe
5208	Ld9BoxSVC.exe
4916	driverconfig.exe
2676	dnplayer.exe
5188	Ld9BoxSVC.exe
4996	vbox-img.exe
3320	vbox-img.exe
3164	vbox-img.exe
1716	Ld9BoxHeadless.exe
6028	Ld9BoxHeadless.exe
4528	Ld9BoxHeadless.exe
3128	Ld9BoxHeadless.exe
3492	Ld9BoxHeadless.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3652	sc.exe
3008	sc.exe
3128	sc.exe
1724	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
5404	dnrepairer.exe
5404	dnrepairer.exe
5404	dnrepairer.exe
5404	dnrepairer.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
5208	Ld9BoxSVC.exe
4956	regsvr32.exe
4956	regsvr32.exe
4956	regsvr32.exe
4956	regsvr32.exe
4956	regsvr32.exe
4956	regsvr32.exe
4956	regsvr32.exe
4956	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
5560	regsvr32.exe
2912	regsvr32.exe
2912	regsvr32.exe
2912	regsvr32.exe
2912	regsvr32.exe
2912	regsvr32.exe
2912	regsvr32.exe
2912	regsvr32.exe
2912	regsvr32.exe
6072	regsvr32.exe
6072	regsvr32.exe
6072	regsvr32.exe
6072	regsvr32.exe
6072	regsvr32.exe
6072	regsvr32.exe
6072	regsvr32.exe
6072	regsvr32.exe
4916	driverconfig.exe
4916	driverconfig.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe
2676	dnplayer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_1252_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer_0900051900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1596	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-1807-4249-5BA5-EA42D66AF0BF}\InProcServer32\ = "C:\\Program Files\\ldplayer9box\\VBoxProxyStub.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3ff2-4f2e-8f09-07382ee25088}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8f30-401b-a8cd-fe31dbe839c0}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-48DF-438D-85EB-98FFD70D18C9}\NumMethods\ = "14"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ldmnq.apk\DefaultIcon\ = "C:\\LDPlayer\\LDPlayer9\\apk_icon.ico"	LDPlayer_0900051900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2FD3-47E2-A5DC-2C2431D833CC}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4BA3-7903-2AA4-43988BA11554}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-F1F8-4590-941A-CDB66075C5BF}\ = "IInternalSessionControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FA1E-4CEE-91C7-6D8496BEA3C1}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0D96-40ED-AE46-A564D484325E}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1EC0-4C0F-857F-FBE2A737A256}\NumMethods\ = "16"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-aedf-461c-be2c-99e91bdad8a1}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-8384-11E9-921D-8B984E28A686}\ = "IStringFormValue"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ldmnq.ldbk\Shell	LDPlayer_0900051900.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-CD54-400C-B858-797BCB82570E}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C6EA-45B6-9D43-DC6F70CC9F02}\ = "IGuestProcessRegisteredEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1640-41F9-BD74-3EF5FD653250}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B7F1-4A5A-A4EF-A11DD9C2A458}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-07DA-41EC-AC4A-3DD99DB35594}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-929c-40e8-bf16-fea557cd8e7e}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-EE61-462F-AED3-0DFF6CBF9904}\NumMethods\ = "16"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6B76-4805-8FAB-00A9DCF4732B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3E8A-11E9-825C-AB7B2CABCE23}\ = "IChoiceFormValue"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7BA7-45A8-B26D-C91AE3754E37}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7966-481D-AB0B-D0ED73E28135}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-9536-4EF8-820E-3B0E17E5BBC8}\ = "IGuestFileIOEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3E87-11E9-8AF2-576E84223953}\ = "IBooleanFormValue"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-B5BB-4316-A900-5EB28D3413DF}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7BA7-45A8-B26D-C91AE3754E37}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6588-40A3-9B0A-68C05BA52C4B}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7071-4894-93D6-DCBEC010FA91}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4453-4F3E-C9B8-5686939C80B6}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CC87-4F6E-A0E9-47BB7F2D4BE5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-23D0-430A-A7FF-7ED7F05534BC}\NumMethods	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-70a2-487e-895e-d3fc9679f7b3}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-70A2-487E-895E-D3FC9679F7B3}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-AA82-4720-BC84-BD097B2B13B8}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-30E8-447E-99CB-E31BECAE6AE4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-73A5-46CC-8227-93FE57D006A6}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-48df-438d-85eb-98ffd70d18c9}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1EC6-4883-801D-77F56CFD0103}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-3FF2-4F2E-8F09-07382EE25088}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-5637-472A-9736-72019EABD7DE}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-70A2-487E-895E-D3FC9679F7B3}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-9641-4397-854A-040439D0114B}\ = "IGuestScreenInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FF5A-4795-B57A-ECD5FFFA18A4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-416B-4181-8C4A-45EC95177AEF}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1640-41F9-BD74-3EF5FD653250}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-44A0-A470-BA20-27890B96DBA9}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7FF8-4A84-BD34-0C651E118BB5}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-A1A9-4AC2-8E80-C049AF69DAC8}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-647D-45AC-8FE9-F49B3183BA37}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-5637-472A-9736-72019EABD7DE}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{20191216-1750-46F0-936E-BD127D5BC264}\1.3\0\win64\ = "C:\\Program Files\\ldplayer9box\\VBoxProxyStub.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-6E15-4F71-A6A5-94E707FAFBCC}\ = "INATEngine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7556-4CBC-8C04-043096B02D82}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-486F-40DB-9150-DEEE3FD24189}\ = "IGuestFileReadEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-A161-41F1-B583-4892F4A9D5D5}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-FEBE-4049-B476-1292A8E45B09}\ = "IGraphicsAdapter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-787b-44ab-b343-a082a3f2dfb1}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7F29-4AAE-A627-5A282C83092C}\ = "INATNetworkSettingEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBoxClient.1\ = "VirtualBoxClient Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-B45C-48AE-8B36-D35E83D207AA}\ = "IFramebuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-FD1C-411A-95C5-E9BB1414E632}\ProxyStubClsid32	regsvr32.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	LDPlayer9_ens_1252_ld.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800006b00000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c701610f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	LDPlayer9_ens_1252_ld.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4204	LDPlayer9_ens_1252_ld.exe
4204	LDPlayer9_ens_1252_ld.exe
4204	LDPlayer9_ens_1252_ld.exe
4204	LDPlayer9_ens_1252_ld.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
5404	dnrepairer.exe
5404	dnrepairer.exe
5660	LDPlayer_0900051900.exe
5660	LDPlayer_0900051900.exe
4204	LDPlayer9_ens_1252_ld.exe
4204	LDPlayer9_ens_1252_ld.exe
5604	msedge.exe
5604	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	dnplayer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeTakeOwnershipPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe
Token: SeDebugPrivilege	5660	LDPlayer_0900051900.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3828	msedge.exe
2676	dnplayer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2676	dnplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 5660	4204	LDPlayer9_ens_1252_ld.exe	89
PID 5660 wrote to memory of 5404	5660	LDPlayer_0900051900.exe	90
PID 5404 wrote to memory of 5776	5404	dnrepairer.exe	91
PID 5776 wrote to memory of 4132	5776	net.exe	93
PID 5404 wrote to memory of 568	5404	dnrepairer.exe	94
PID 5404 wrote to memory of 5904	5404	dnrepairer.exe	95
PID 5404 wrote to memory of 820	5404	dnrepairer.exe	96
PID 5404 wrote to memory of 5964	5404	dnrepairer.exe	97
PID 5404 wrote to memory of 1328	5404	dnrepairer.exe	98
PID 5404 wrote to memory of 4820	5404	dnrepairer.exe	99
PID 5404 wrote to memory of 2856	5404	dnrepairer.exe	100
PID 5404 wrote to memory of 3900	5404	dnrepairer.exe	101
PID 5404 wrote to memory of 2568	5404	dnrepairer.exe	103
PID 5404 wrote to memory of 5616	5404	dnrepairer.exe	105
PID 5404 wrote to memory of 2572	5404	dnrepairer.exe	107
PID 5404 wrote to memory of 2724	5404	dnrepairer.exe	109
PID 5404 wrote to memory of 3168	5404	dnrepairer.exe	111
PID 5404 wrote to memory of 5208	5404	dnrepairer.exe	113
PID 5404 wrote to memory of 4956	5404	dnrepairer.exe	114
PID 5404 wrote to memory of 5560	5404	dnrepairer.exe	115
PID 5404 wrote to memory of 2912	5404	dnrepairer.exe	116
PID 5404 wrote to memory of 6072	5404	dnrepairer.exe	117
PID 5404 wrote to memory of 3652	5404	dnrepairer.exe	118
PID 5404 wrote to memory of 3008	5404	dnrepairer.exe	120
PID 5660 wrote to memory of 4916	5660	LDPlayer_0900051900.exe	122
PID 5660 wrote to memory of 1472	5660	LDPlayer_0900051900.exe	123
PID 5660 wrote to memory of 6028	5660	LDPlayer_0900051900.exe	172
PID 5660 wrote to memory of 5108	5660	LDPlayer_0900051900.exe	128
PID 4204 wrote to memory of 3828	4204	LDPlayer9_ens_1252_ld.exe	133
PID 3828 wrote to memory of 1112	3828	msedge.exe	136
PID 3828 wrote to memory of 6064	3828	msedge.exe	138
PID 3828 wrote to memory of 5576	3828	msedge.exe	139
PID 3828 wrote to memory of 5576	3828	msedge.exe	139
PID 3828 wrote to memory of 5576	3828	msedge.exe	139
PID 3828 wrote to memory of 3732	3828	msedge.exe	140
PID 3828 wrote to memory of 3732	3828	msedge.exe	140
PID 3828 wrote to memory of 4784	3828	msedge.exe	143
PID 3828 wrote to memory of 4784	3828	msedge.exe	143
PID 3828 wrote to memory of 4784	3828	msedge.exe	143
PID 3828 wrote to memory of 1380	3828	msedge.exe	144
PID 3828 wrote to memory of 1380	3828	msedge.exe	144
PID 3828 wrote to memory of 1380	3828	msedge.exe	144
PID 3828 wrote to memory of 3576	3828	msedge.exe	145
PID 3828 wrote to memory of 3576	3828	msedge.exe	145
PID 3828 wrote to memory of 3576	3828	msedge.exe	145
PID 3828 wrote to memory of 1612	3828	msedge.exe	146
PID 3828 wrote to memory of 1612	3828	msedge.exe	146
PID 3828 wrote to memory of 1612	3828	msedge.exe	146
PID 2676 wrote to memory of 3128	2676	dnplayer.exe	177
PID 2676 wrote to memory of 1724	2676	dnplayer.exe	149
PID 2676 wrote to memory of 2684	2676	dnplayer.exe	151
PID 3828 wrote to memory of 2444	3828	msedge.exe	153
PID 3828 wrote to memory of 2444	3828	msedge.exe	153
PID 3828 wrote to memory of 5344	3828	msedge.exe	154
PID 3828 wrote to memory of 5344	3828	msedge.exe	154
PID 3828 wrote to memory of 5344	3828	msedge.exe	154
PID 2684 wrote to memory of 1596	2684	cmd.exe	156
PID 3828 wrote to memory of 1600	3828	msedge.exe	158
PID 3828 wrote to memory of 1600	3828	msedge.exe	158
PID 3828 wrote to memory of 5324	3828	msedge.exe	159
PID 3828 wrote to memory of 5324	3828	msedge.exe	159
PID 3828 wrote to memory of 5224	3828	msedge.exe	161
PID 3828 wrote to memory of 476	3828	msedge.exe	162
PID 3828 wrote to memory of 476	3828	msedge.exe	162

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1252_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_1252_ld.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204
- C:\LDPlayer\LDPlayer9\LDPlayer_0900051900.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer_0900051900.exe" -silence -downloader -openid=1252 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\LDPlayer\LDPlayer9\dnrepairer.exe
    "C:\LDPlayer\LDPlayer9\dnrepairer.exe" cmd=install|listener=525014
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\Windows\SysWOW64\net.exe
      "net" start cryptsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Softpub.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:568
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Wintrust.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:5904
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:820
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32" Initpki.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:5964
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" dssenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:1328
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" rsaenh.dll /s
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" cryptdlg.dll /s
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:2856
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\vms" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3900
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2568
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\LDPlayer\LDPlayer9\\system.vmdk"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5616
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2572
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f "C:\Users\Admin\.Ld9VirtualBox" /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2724
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" "C:\Users\Admin\.Ld9VirtualBox" /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3168
  - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
      "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5208
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
      4⤵
      Loads dropped DLL
      PID:4956
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5560
  - - C:\Windows\SYSTEM32\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2912
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6072
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3652
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\system32\sc" start Ld9BoxSup
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3008
- - C:\LDPlayer\LDPlayer9\driverconfig.exe
    "C:\LDPlayer\LDPlayer9\driverconfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4916
- - C:\Windows\SysWOW64\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /powerthrottling disable /path "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"
    3⤵
    - Power Settings
    PID:1472
- - C:\Windows\SysWOW64\takeown.exe
    "takeown" /f C:\LDPlayer\ldmutiplayer\ /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:6028
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/g8Fhag9NxT
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x348,0x7ffb6640c188,0x7ffb6640c194,0x7ffb6640c1a0
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,7832643048291639059,5300924351231269997,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14118432059962871311,14023465549014864105,262144 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,16993180039518154124,5306285622036334898,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,11547666379607885356,11235592835166673479,2097152 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,17149493490253636272,16454561047026633635,2097152 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,6562291056439342495,7755144415049551378,2097152 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,12003615601922543458,13953225757762396036,2097152 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,6308434745139878290,11779439854736736188,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5436,i,6609378556890639406,9069164476863289,2097152 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,13412086177360543875,14533010172694222789,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,3602651942026614125,13704414344267454916,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,10207481162776080420,12963046134884274539,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12085279178771689456,7013127227227192082,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:12
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,13885430629336836864,11616156837089176161,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,13885430629336836864,11616156837089176161,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,17804606879635499065,13551953455699829291,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,8582588656242525188,9426997334776820721,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15357357114152269602,10040701278086293548,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,4031844975161941066,2431209586203966020,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,1496443767870976905,10824850136991317971,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,10421431424363038791,12919553357447194782,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,10932054898389554023,13721844600329937969,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=940,i,9006882974304497301,9308322152130268241,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,9933269500582149035,3262072762791864557,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6736,i,7994055136822196606,12429242691954793028,262144 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,18387972870330410713,15925294294225034730,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,1527113255138825468,17724616125502746926,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,2689578165059772634,14167850487423416229,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:14
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,436247503245381377,16670981770598664048,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,16509232773347551812,15623787197492488853,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,12692998890846778841,12728251684811488565,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,1252952568279926401,6879630177592238419,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7092714246860564483,4549881359404675857,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,16371293641771558768,13090809724021260147,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,312062885630759759,12755089563556899918,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,9674534947526378151,2051984168834853305,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,9300556291027520824,5716370794786706035,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:14
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,17085267367555924351,11868897047212842743,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,9914264066083866531,7716986065452223346,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,17465134975623855258,10870602264715190408,524288 --field-trial-handle=2304,i,2754962102203929996,16811285281715970947,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
    3⤵
    PID:5308
- C:\LDPlayer\LDPlayer9\dnplayer.exe
  "C:\LDPlayer\LDPlayer9\dnplayer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\sc.exe
    sc query HvHost
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3128
- - C:\Windows\SysWOW64\sc.exe
    sc query vmms
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c systeminfo
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:1596
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-0eee-bbbb00000000
    3⤵
    - Executes dropped EXE
    PID:4996
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:3320
- - C:\Program Files\ldplayer9box\vbox-img.exe
    "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "C:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-0eee-000000000000
    3⤵
    - Executes dropped EXE
    PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5596

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Modifies registry class
PID:5188
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:6028
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-0eee-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:3492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4992

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP120.dll

Path C:\LDPlayer\LDPlayer9\MSVCP120.dll
Size 449KB
SHA256 9cb478e41026982a4366d567377e3a9880e7ce8477a5ea1fd1ddd1fa96bc1084
MD5 cdfd3c9f6a972a1b3bbc0b0fabbbe39f
SHA1 d137f3a75eb9dcd7390992525dca637f9b678707
SHA512 e89a232471cddef647f990e76e0a04d0f74f81391c342e69395f3fb5de471b3f3064c335526e619d73c0b4961f2635321476c9d5451c11ead0c4ca1b7af65779
SSDEEP 12288:pZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77E:z/8wVwHZFTwFOOos3Ooc8DHkC2e77E
TLSH
T13EA45B237B864CF1D29E53B231C9532557FAFC2441B1F343ABEEE1692FA5282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\LDPlayer\LDPlayer9\MSVCR120.dll
Size 952KB
SHA256 76770d93afb655c882fade5c0909bfdd263cde0ba1762a881c69bb57dda2ccb7
MD5 b46ba3349d9b716a30e617ee8e966707
SHA1 f0a4724e9061c032b0b0cbaaec1f1d13f0de8384
SHA512 ebca95f5b431be8a0eb5b74735cadc5c175328067c091576eb01dadb53ec39fc65b22aa2cca85306320f2cae4747ff5478b232108bd4a60389cd5557f83eba4e
SSDEEP 12288:1BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJD:bmFyjLF847eiWWcoGZVOIxh/WxIAIbt
TLSH
T19425BF12B582C0B2C57202B1152DA73219BFB971443599B7BBD98F0E1EB45C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\crashreport.dll
Size 50KB
SHA256 e269811316cba3527ca1f1ff54b1bf2ca0a435349d57ff350387ad464da87617
MD5 073553b6d3b92599db810e152541b7ea
SHA1 734beaf96d0b3ff0d6b9d016c085960b3e9b9f42
SHA512 1cf9132a973070e55507cd74570c195c1e3e66a68ab1f5c61dc47a89b5faba0ca49262ad250e99eb26e65cd02ffc6fff4204a7906ccd108518be3d2679a2de06
SSDEEP 768:5Q+agNztWyGOiprkvcocNcb0H/GEM8Jf3c4sbG7nQL44SYiDLk5XkvYijjK5AL:5PGyMprkvxXb0HOafsYQM4S7ekv7P
TLSH
T12D339E929540482ADD560870B9F86B3AADFDB1610BE1C2C7F388C26967507C13F791BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnmultiplayer.exe

Path C:\LDPlayer\LDPlayer9\dnmultiplayer.exe
Size 1.3MB
SHA256 507e3cd8d749ef866edbc5a2f51fc63676a04c81fb7197413e86981714992f94
MD5 ca63ffc300d2c4fd3cf8fcccaaa17f58
SHA1 a99bde9e206d3bcc2cc2385b99fde40fbfaf14fd
SHA512 cb660b1d05d933acc680ace3c65344fe22f02132a58a090063cb9772d986329c8b56ebead38904ed4f5dd47ebde082a8942957f2d25f2c9c68d83bba06f13159
SSDEEP 24576:uPuD6sUjXl2D7vKLPDQ70gBAtUuBhBxy0DRkhP33WF:uTofvKLPM7VBAtUuBhs33WF
TLSH
T116557D207A97C235F7B201B0BDBDA65D502DBD640B2640CBE3D4391E1972EC22E7765B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnplayer.exe

Path C:\LDPlayer\LDPlayer9\dnplayer.exe
Size 4.3MB
SHA256 57fa1177063d6891b4db936d74f8b7da4320a647d2dc1bc5e15fb04bdb77938c
MD5 e989dbabaf01d675fce05144ced53d20
SHA1 f6542f6d921a1be63bdbfceb96bcdfda39560b10
SHA512 6e32423957abb13400981e68c4811a7677af1e8b850aeb0ca6a720d9d9586d714eed0c258e02429f6b00642f186c73a62f151e67ce6b93766b2185601320f970
SSDEEP 98304:mJcBpdoKduOKWp/AdlE5/nIHQmVpa1Xx:mJyV1p/AdC5g
TLSH
T115266C00BB45C226F6A202B1D97DAF6E0429BD701F2955CBF3C43F5D1971AC29E3366A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnrepairer.exe

Path C:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 41.9MB
SHA256 9d48ce493d7c952d4c04d17f2c35a0592027f37b3a2b40b9b28259aec43788ce
MD5 8ae4078aa040a2163c1c949969eb84ca
SHA1 b27532df518397fa2fa05265cfb1f897196ce640
SHA512 b2ebc4a6b04f966516bdeeba83ef696e9b3f570e2e3d7a662088ab13fc3ee12cacc7e20b66b9bdfd2659ee585d53b9991b9c6317db670d7dd49761fc20bc233b
SSDEEP 786432:g0Aaovi8bBeguoSwFOYDs89hN2LKG7WY2O0o8isQCPaiX916Vn9aKZKgALAmmpYe:gvNB5pSc889hQLZCY2O989HaGyh9fZTX
TLSH
T1B2A7333136B5D132F2A30AB1ACB9A91A14397E34472591CB62D43D1E5D3DAC3BC32B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnresource.rcc

Path C:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.6MB
SHA256 c810442319160637ad7dcfdf14e71bc1a34b75aa9b0c55a55e72dcd3c41acbfe
MD5 80c2aa5270eafb9d7fa71a3d61ce5fd4
SHA1 00629cfb49c7b7f87c980f20081e28d83a3e3d39
SHA512 a10fbd0ee81319823eca84cdb938d7f5199bff6f0f429577b53410d7a07081b2ff4931f1df5881bfef6716708d4545649d322ac1fa5da86b7e76c4afc1285f61
SSDEEP 98304:Y3EB+HjpGjbJvmUz+tN1yr9VOcFfkovuZ0alZQkl5h8H7WdzlpCbOcX1x:Y0B+Hjp2bJvfqo9VOWu+uqo07WdzlkXH
TLSH
T10D5633AD2B7D5330259D55AA53E5B520F100CFAE733A28330BA123D4DE0E2BCD9D659E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roboto-Regular.otf

Path C:\LDPlayer\LDPlayer9\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
TLSH
T188A35C4A7753AB49C5126A78C695C3A83B79BD69BB03A21FB1BEFF3211030605DD81DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phones.data

Path C:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
TLSH
T163C1EE57BBEE4E571ADC7DCE3274C9973A0CC449C28D18F839082876DA8C9314375BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.vmdk

Path C:\LDPlayer\LDPlayer9\system.vmdk
Size 1783.2MB
SHA256 78f330b72f91630b8e4eb54bd8edd6cf9d131298320af161e84bde52b93ae58f
MD5 89a263363aa174ea8b105b092857eeac
SHA1 2bc74272959e0d071f12cfcf0e0fad153b5311d9
SHA512 3504299268ce5b1cf34bcff999745b9fceb6450ea7d0a2ffaca2d47c6ade0c04a9e908868277d0327ce79c77e3cc4f69e6f71a18ac87bd461652a30ec9cdb9d3
SSDEEP 12582912:8IggAGbW1MhFWULh9/OVGrzFdKlGEuVB7/oGVWLC:8IggAGbWajWULPOo11Esk
TLSH
T18B1ACF03FA515879C8BAD474424FD336EB347C4983339697AA487B247E73AE05F2A790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EGL.dll

Path C:\LDPlayer\LDPlayer9\vbox64\EGL.dll
Size 532KB
SHA256 80ebebaac33cb7df8dfdd1344b63a3e1fecb980214218eeaab8ab2f023c31b3b
MD5 92950647ab342ccf982b33816a31ebd1
SHA1 e9c7c2603c0ed37eb890893c6e64945866f333d9
SHA512 f9487db83c33319072baa2c3e5b3222d5f40c03832705ed607bcb856dd1a860e97cb1934cbc77940ee4a755001c0461fe80cc83c3b9d78d49a5bc3cfa84dc4e8
SSDEEP 6144:GPP1r54LFWPAVL4/M4aC+4NKJewLzSvtE0Iz42+a8sct9pFa5Y:GF14ZVL4z1NK1fTgeY
TLSH
T144C46B0276464372D419733BB9638D42E3B2F2650B3F82CB7A58831EDEE76D319B9650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLES12Translator.dll

Path C:\LDPlayer\LDPlayer9\vbox64\GLES12Translator.dll
Size 379KB
SHA256 0a79bcec36153354a938332b8bf6224182ed5b298a915ab2b82f4d2ac56407e3
MD5 35069fcbf98379952e60fdec3a17d180
SHA1 901187efbe95e5d17ad9e015e436ddb945d574e6
SHA512 253fa2b0704711830e988ff00af604049ca139d19ba5fae3aa5bdabfd2a45f22cccb775a95380ab147a40b23f93d0d5c4423bb1887520d69299500d15fea0fbe
SSDEEP 6144:ofqqCQ0mbPI0B8/h5WQujYGU8c6dXJlFH+IzeWvK3iqyXn2PlajS7eUZ5BniLT7L:0f6/WX7AaQ5TWgfT+
TLSH
T144843A59E764486AD00BD03DCA9ACA13F3B574490B508FDB2AB1462E6F33BF16D7A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLES_CM.dll

Path C:\LDPlayer\LDPlayer9\vbox64\GLES_CM.dll
Size 1.0MB
SHA256 fb2bd4d5e47cc02a5bfb327e2097032fca2bc4215fe0df47e8c3beacfe11f89c
MD5 9d1623c2b55b64fe3f2a43e567db107d
SHA1 09ba05baaa0034a0aa23168d684d68d7f323db23
SHA512 7c360edcd83bab967cabe0cc48920e4cbca6ede02c902b5329e65874140565405b5818e93abaaeb5ec65122e54b810b6d5ba6f53b13c78bcdbe32028eaddd832
SSDEEP 12288:8BPkYbIWmDf1JTyRooN1M+A4JqRuXnzZyH24A5si:8BP3bIWCvWei1M/vu31cwsi
TLSH
T182354A4967808025C01AB77B96D38D22D171F0502B7C06EF7955A34EBEFBAE3257EA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131
MD5 cde2424d99db56dd0d1eaf34811738c1
SHA1 cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f
SHA512 d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2
SSDEEP 192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn
TLSH
T16A822892CEBC9583ED969D7017A8E9837D3DEBC71D10A15521AAF4D838C33D1EB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725
MD5 acf4321ac8c8ff4d0442c799d621f8d9
SHA1 b12f87e6afc48697f1ce8b587715361e89b79cae
SHA512 7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde
SSDEEP 192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+
TLSH
T102823A929BBCD083ED979D3063A8E9837D3CDBC75D10416A05AAF5E82C833D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956
MD5 3c47c25b8141d20b2b4d576000000a61
SHA1 04543f9cdd847ff66389c9fd1e12b444dae6383a
SHA512 c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a
SSDEEP 384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI
TLSH
T12F8218918ABCD583FE979E3062A8EE837C3DA7C71D10556605A9F4E82CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410
MD5 e05ce0232e64328c62c9da37698566bf
SHA1 50c25e6ecec2cd17ecf3117bb9a646ba107d2b84
SHA512 8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb
SSDEEP 192:MmxD3KXWuufhW+sivT16uDBks/nGfe4pBjSfhXa8WebtuVaVWQ42WyMsVqnaj87p:MVXW5hWyvT1Nq0GftpBjSZgkldri
TLSH
T1008218929ABCC083ED97AD7023E4EE837D3CABC35D10556909A9F5D828D33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830
MD5 a26c7ffcf18b62904dab7786de638ea6
SHA1 b28489bc38ee2f522ee83dcf49faeb96f39a77e3
SHA512 768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f
SSDEEP 192:sohaYPvVX8rFTscWuufhWrlFO0ruDBks/nGfe4pBjSb68WebtuVaVWQ4mWst1qnq:JTPvVXiW5hWB80aq0GftpBjQZplBLcQ
TLSH
T10EA20983D9B8E297ED8F9E3112A5D9836C3893C60820459616E9F39D3CD33C6E79895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
MD5 6a55a7e284b51b086b63cc6f2061ce8b
SHA1 46a48a1ccf5262038b71ed4be09cf625009d078d
SHA512 6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363
SSDEEP 192:ByWuufhWrRivT16uDBks/nGfe4pBjSb9bXe8WebtuVaVWQ4mWWrRHqnajjpxf9cS:ByW5hW0vT1Nq0GftpBjSbRZnlHlBLcYl
TLSH
T1998219928ABCD483ED979D7063A8E9837C3CDBC35920416905A9F4E82C833D1EF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
MD5 6e38a6bed88e1c27155e4dc428188ef0
SHA1 8b47a1960ed157f7beeb80fa4a16a723279c4efa
SHA512 3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab
SSDEEP 192:HX6WuufhWr7FO0ruDBks/nGfe4pBjSbnUqs28WebtuVaVWQ4mWOYVqnaj87X/fA2:HX6W5hWX80aq0GftpBj2spZkldrps
TLSH
T1508219D19ABCC583ED8BAE7012E8EA837D3CABC75D10415616A9F1D82C833C1EB1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4
MD5 9304209688e2a18d0b26997bc78fda7a
SHA1 5d4332cf1c5123418c6419d0291486c3939e8785
SHA512 5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960
SSDEEP 192:KKWuufhWr2ivT16uDBks/nGfe4pBjSbYA/8WebtuVaVWQ4mW7TqnajPf33PLlYoM:9W5hWHvT1Nq0GftpBj4UZAljZYsqTr
TLSH
T1AF8219D2CA7C8583F9979D3013A9EA837D3CDBC75C10916A05A9F4D828933D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll
Size 18KB
SHA256 f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234
MD5 f42a84d78a5a15ff1a4dbac591e95783
SHA1 1cd5b5e68fd729bdd340463b53728634d342b0cd
SHA512 89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0
SSDEEP 192:3liWuufhW3XUxQmLuDBks/nGfe4pBjS7LX28We8WebtuVaVWQ4eWmQQPqnajy3Ss:3liW5hWOQ7q0GftpBjkEZfQQPlGinjqZ
TLSH
T11B822985CABCD583ED979D7023A4EA837C3DE7C61D10555605AAF1E938C33D1EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970
MD5 9f286e57e5b1c1a347adf9eef059ad5d
SHA1 631aa1aa364234acc5ad20b27f926e9cb9ee4276
SHA512 6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197
SSDEEP 192:KWuufhWr3ivT16uDBks/nGfe4pBjSbKUs8WebtuVaVWQ4mWMoTqnajPf33PLlYoS:KW5hWmvT1Nq0GftpBjGzZv4ljZYsqHh
TLSH
T1E38209928EBC9583F9979D7013A8EA837C3CEBC75910515A05AAF4DC28C73C5EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141
MD5 beaae8294db31afa04fa60795c6e02ae
SHA1 8a32ebd843e461864747fe0aebf4bbf83c4ec093
SHA512 dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135
SSDEEP 384:rvuBL3BEW5hWh3rq0GftpBjzkZalBLc2V:aBL3Brii2sV
TLSH
T1BF8218C2CBBCE583E99B9D7052A8D9833C3997C75920946A01EDF5D928D33D1FB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
MD5 2ac1289e4dbab076b332869bef26d3ce
SHA1 60570ddd06b671e26c6a814b9c08cdfa0ef38aba
SHA512 e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a
SSDEEP 384:ptAuOMw3zdp3bwjGjue9/0jCRrndbAW5hWA80aq0GftpBjV+ZZrmlGinjQKKX:DAuOMwBprwjGjue9/0jCRrndbX4i3qdT
TLSH
T154922B92CAB8D283FC8EDD703266E9837C39D7C60D11955106E6FAA834D33D5E754A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd
MD5 a2661a468bb87ee9cc5dee968fd3805c
SHA1 9b17fbd552e34888f1453f9113ff4c42efaf6d6a
SHA512 b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3
SSDEEP 192:zQWuufhWrixf/0uDBks/nGfe4pBjSbl7Y88WebtuVaVWQ4mWyymqnajiG7AzTvfJ:zQW5hWS3rq0GftpBj9jZlymlO62vfGkb
TLSH
T18C822A8186BCD583E8D35D3063A8DA83BC3D9BC74D60955A11A9F1D928C33D5EB2492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e
MD5 acbfc011d5842ba60c372ba3d222ab70
SHA1 16b8014060a04bb03215f6ce4c118bae48653bd5
SHA512 dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3
SSDEEP 192:1cIWuufhW3bFO0ruDBks/nGfe4pBjS7irpMk8WebtuVaVWQ4eW5eqnajy3Snk0b7:CIW5hWL80aq0GftpBjNUZkelGinjn
TLSH
T173821791CA7CC583ED8B9D7013A8E9837D3DD7C71D10945515AAF8E928C33D0EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae
MD5 19d14d348ac38737431a7ee2f82973e6
SHA1 11cd8f5dc5c08d133b9b006da5c84946f012cbb6
SHA512 b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc
SSDEEP 192:AlWuufhWrExQmLuDBks/nGfe4pBjSbYsqwZ+8WebtuVaVWQ4mWXqnajnp+MVQ/Tz:AlW5hWaQ7q0GftpBj5VghZoldBQ7Q8PX
TLSH
T1B79229C19ABCE143FADB6D7012E8E9937C3997D71C1040A55169F6E828C33D1EB48A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0
MD5 ea0e13feac13dc18c79eb682bef4676e
SHA1 b9db47624345c68cf07bd2677df537e0f975caf9
SHA512 540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7
SSDEEP 384:ik1JzNcKSIUW5hWP80aq0GftpBjMJZCZslGinjI:9cKSupiEgZ40
TLSH
T1569219D1CABCD2C3E88A9D306394EE837D3AD7C61D25456105A9F6E93DD73C2D62882C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
MD5 1af2a91dc0a4e48bab0ca123073adf30
SHA1 cf6625fd31b17d46dd31b16372840c74026d0ba2
SHA512 45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51
SSDEEP 384:vIDfIenW5hWsvT1Nq0GftpBjeOZLlGinjx:ve2N1vi/l9
TLSH
T11F822A81CABC8583E9D79E7063A4EE833D3DDBC71D20906508A9F5E828C73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786
MD5 9b9d1949b75df171884f6f8caba7ff59
SHA1 411adf413f53c56488d5cf68e9b4b692889f3c4b
SHA512 dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c
SSDEEP 384:yW5hWgR80aq0GftpBjHLzZgfhlg+ZmJy:dmi1LzWflu
TLSH
T18C820991CA7C8483E997AE3063E9EE83BD3DABC71D10556601A9F1D92CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 18KB
SHA256 eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f
MD5 c6e268c877a9be5b43877308b1231120
SHA1 949105c826dee6a32fe1288285e3e41cb7d04821
SHA512 776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331
SSDEEP 384:HGeVxW5hWEvT1Nq0GftpBjvOZZljZYsqzN:HGeVcF1viJOYnzN
TLSH
T1008219D68ABC9483F9979D7013A9EA877C3CDBC75C60916604A9F5D928C33C0EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c
MD5 5122b8aa14a25c8567d9d0335036446f
SHA1 81961f2c8a331136f8156930779964a71e0badc4
SHA512 758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9
SSDEEP 384:1yMvIW5hWER4Zq0GftpBjpTuZV0lO62vfGU:1yMv/L47i7STVHGU
TLSH
T1398218928ABCD183ED975D7023A8EE837C3CABC71D10526951A9F0D82C833D5EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b
MD5 e1b30d56617709cf7dff5f464d7566d9
SHA1 e29646b1c90550cb86ed42782c764d41f2c70651
SHA512 e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511
SSDEEP 384:pvdv3V0dfpkXc0vVa/W5hWiR4Zq0GftpBjkYZjsdljZYsqmb:ldv3VqpkXc0vVau547iCY6Onc
TLSH
T180922982DAB8E583F89BDD7052A9D5837C3897C34820856611E9F5ED3CD33D0EB1892D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
MD5 e4b64b2710725ec3332021bd8044d884
SHA1 2d7f8d87d0f395296ecdf277084d23cb9e0880e8
SHA512 ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2
SSDEEP 384:stZ3KW5hW4R4Zq0GftpBjsnTZWFlGinj6m:oX47iiTomm
TLSH
T1B2822896CBBC9583E9979C7063E4EA837C389BC61D20556115AAF1E92CD33D2EB04D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-sysinfo-l1-1-0.dll
Size 19KB
SHA256 1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8
MD5 67fd470a60fe8fb3f9fbe32fa52871d0
SHA1 09aba019a0d0dae7415b6d9a39e1dc67d93f130b
SHA512 f8c3f1e3bee196487aec704f128240acb57fb392db918a97176793b07726f017177abbb5a6c68822fc59ce06f04d489a78284a865efdc2de518f34ecfb0cc1e6
SSDEEP 384:NzgLW5hWgNvT1Nq0GftpBjVIB6RiNZiVlg+ZmJ:NzgKB1viPbRiNUhu
TLSH
T162922A928ABCD143E9979E7063E9DA837C3C9BC71C10816901A9F2D96DD33C5EB2493D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-timezone-l1-1-0.dll
Size 18KB
SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
MD5 f53ed8a0c18157b9e37500621dfab9ee
SHA1 b8a3131150cfd46052353309843c802d9f43df03
SHA512 2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a
SSDEEP 192:QNWuufhW+IivT16uDBks/nGfe4pBjSfASU8WebtuVaVWQ42WUqnajnp+MVQ/TQF/:4W5hWGvT1Nq0GftpBjhyZdldBQ7Ql
TLSH
T17E821992CBBC9083FD9AAE3013E4D9837D38ABD70C20556615AAF5D92CC73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-util-l1-1-0.dll
Size 18KB
SHA256 070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b
MD5 2b9f551cddd662c618432a75c546b296
SHA1 1ddd65fcc8bb401c734ebc2014d057328f771744
SHA512 54df6e692ac630d969a697c9e6f379c4826ca71b7e8eaefdf502405b1333a6b483256aeba609a4a1c61e73f72d2958aaf3eb31538cc5e7a91101d7d09e3ed9dc
SSDEEP 192:GrWuufhWrvFO0ruDBks/nGfe4pBjSb0rjk8WebtuVaVWQ4mWD0qnajiG7AzTvfGC:GrW5hWz80aq0GftpBjjbZS0lO62vfGC
TLSH
T1198228D2CABC8583ED975D3053A8EE837C3CABC71D10956515AAF5D828C33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-conio-l1-1-0.dll
Size 19KB
SHA256 1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89
MD5 7d943f85ff8d1515a02d202ae79453d3
SHA1 94def1f7368172ac50b665e74b89e8f7aae2857b
SHA512 e111dbef97c6c6cb3b5c2d183294620792c48a2cb16d9d91c12cede757a1c0c53d707f4294542bef47eae784893bf63fe0f0229bed4b2d0a961c8d1cc1cf43cb
SSDEEP 192:VyWuufhW+JFO0ruDBks/nGfe4pBjSfG488WebtuVaVWQ42WyWqnqnajjpxf9c9kY:VyW5hWU80aq0GftpBj6ZXlBLcmY
TLSH
T1D5923B9386BC9943E9878E3063F4EAC37D3D97C72910616554AAF1A828C33E5FF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-convert-l1-1-0.dll
Size 22KB
SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
MD5 278857b86f667c47cbcce94f5ec73ca8
SHA1 a0f5b7e7c67f3c6b8f285d39d08b740e49445755
SHA512 ebc02d1a2e223eb0b30a8e62089735faed83add4161094493f62561a09c13a426815e7f06c20c44477691109a8c3040dc68527023bfee6d9984c42d6a05208c9
SSDEEP 384:vcJ2yyW5hWGQ7q0GftpBjFZ8UOwlGinjP:vQgiviDcj
TLSH
T12EA2F843AAF86F62E99B1B7121F9DBC32D384B82195052B5811BE1DC34837D1FE66C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-environment-l1-1-0.dll
Size 18KB
SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
MD5 6493b21fefae874655c62a56a156f3eb
SHA1 c65beb46f9f03d35867ff008026d3a56fa26fb65
SHA512 93cbe187f7fa86ac58191b5384a993135e3291873a76cc2cf81dd60c68ad7591386e4eb5ab53aaac2a6f48f7f778263b7fa0a4ea0863361910a9f1efee92b64b
SSDEEP 192:45oWuufhW3dxQmLuDBks/nGfe4pBjS7Ji8WebtuVaVWQ4eWbj8qnajy3Snk0T:4GW5hW/Q7q0GftpBjmZ08lGinjT
TLSH
T113823A81CABC9583ED97AE7053B8EAC37C3DABD71D10516605AAF5D828C33D0EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-filesystem-l1-1-0.dll
Size 20KB
SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
MD5 ae83311041ee793253ff10736317a09e
SHA1 c62d06cb6cbd9d997c42a6ad7f13c06f38725069
SHA512 0fabcb0370330460f8f525401f339535c08d768f075816989a16eff2256584cfa8fd6832df3ce3d9c2a5364b4ef58bfff53cc486e3b48d11b654f7174aa18458
SSDEEP 384:gTnWm5CoW5hWSvT1Nq0GftpBjMkZaA0l3uzJ:gTnWm5Cfz1vijj/l
TLSH
T1559218838BF8A953ED971F3112F8EBC33E3D9BC219114266906AE59839C33C0BF11959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-heap-l1-1-0.dll
Size 18KB
SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
MD5 12311308d7d65895b3920b3dd3e54b3b
SHA1 3faa74c6913f451d9c575761630b507af0c15ee3
SHA512 67fd047e760dbdadb06cc2c34b935fdabc629fa988484a9f5120cd59d6167d943b612df65626701022b5e73c5b1177a8d813e90c5990468f51a5a11932c008ed
SSDEEP 192:QwY17aFBR7WuufhWrtQR4+uDBks/nGfe4pBjSb0NW8WebtuVaVWQ4mWMUVqnaj8F:QpWW5hWyR4Zq0GftpBjhNJZYldr8
TLSH
T1EB822AC28ABC8583ED97AE7022E4EBC73D3D97C36D10556641AAF1D828833D1FB1491D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-locale-l1-1-0.dll
Size 18KB
SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
MD5 3dafcf25a2ac1becf40acbec8fc7134b
SHA1 0729fdc617403622c2edd77fdb7dd49b530e2037
SHA512 9dbb487489c8a6af8dbd6326fe4958f489552af268f2937495ada35bb8404cfaeaf54833d8bba2966e72cd0ba3284a5fd167baf4cd6d905870f5d1ed3e5ff6c0
SSDEEP 192:QPqWuufhWrHxQmLuDBks/nGfe4pBjSbZjk8WebtuVaVWQ4mWK8MVqnaj87X/fACD:rW5hWdQ7q0GftpBjWjbZZldr63
TLSH
T14E823A828ABC9583EDC7AE7013E8EA877C3D9BC31D10556511AAF5D828833D8EF1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-math-l1-1-0.dll
Size 27KB
SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
MD5 f32bd567d35d2e85504c39dede609e72
SHA1 b7a7145956466e45bbe6f7fe41e935a152c2c325
SHA512 55396f3e5821d3f3eb5988bd3362a0cddf036de4afa8cc1214813834b5a152fc3df787a8347a7aff3de6bf112e1d2a354790f593854a59f1f49393ddf967d085
SSDEEP 384:77FRU8HM4Oe59Ckb1hgmLydW5hWjQ7q0GftpBjASZLN8ldBQ7Qa:77TjMq59Bb1jyYPiyS8Q/
TLSH
T15CC2F64789ECFF93D58B4BB312F0CBCA6D385AE25491B5B5C85BA0C834923D0BE47949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-multibyte-l1-1-0.dll
Size 25KB
SHA256 0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc
MD5 56c02fabc2c64174009c905570c3a22d
SHA1 e52154112ad127ab01937453490091def4d21ad2
SHA512 9f22f70b5de4078fcbfdbb186d6cf220561200092eb7ceaaad9d44a5281f84abfb1729f4e447dab3753225d5fc6c44d94363e3729e5765dd2213213c327c4c1b
SSDEEP 384:YbmLPmIHJI6/CpG3t2G3t4odXLBdW5hWYR4Zq0GftpBj2q8ZWlGinjge:PPmIHJI6PY/47iok1
TLSH
T120C2835B8EB86E12D58BDBF3B5F2C7C63A354F8104C07375A56B95883842BE9BD06D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-private-l1-1-0.dll
Size 69KB
SHA256 c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac
MD5 4b27cf5cdb20aebf113df752019ffca3
SHA1 b02c6e45f704dac118f81c324122c189e3e61e17
SHA512 cd4df2478d719e159e2252e6784d24e4260c13d8f47774ac33a8e10b1fa96d38236bf2c3ebc060a5801fc19392cbe5c636befa898721bf114956c2be6476bbd1
SSDEEP 1536:ccXDvBRh1De5c4bFe2JyhcvxXWpD7d3334BkZn+PAc5ed:cczDh1De5c4bFe2JyhcvxXWpD7d3334+
TLSH
T16E6329DB49EA3F61E58FF7B367FB17C91B253A4408806174E9C7956B34853A9BC43A00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-process-l1-1-0.dll
Size 19KB
SHA256 36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8
MD5 fa677cfb18ba1370d8bb98681c48cfbd
SHA1 cbccd561bf53c59254fb04ab136996b81cc80d3a
SHA512 9312acd4955d4950d851910198d4ee622b75e11262e409c79391078d12d2d0db320723a1552048acc0e9deb30378e3cd27d4fabcf2077d429eedfb275cdb73e3
SSDEEP 384:BpOSA1W5hWk80aq0GftpBjy11Z+lTMs6WbL9J:vlkiM+TFJ
TLSH
T1CE922AC7CBBC8993E9935E3012F8DEC37E3A97C758109165946AF0DD28833D5AB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-runtime-l1-1-0.dll
Size 22KB
SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
MD5 595a997bd415c8ae0ef1e3c3b73e6091
SHA1 10f34bc2f474a43bfaac26f66ec8081106c12253
SHA512 944f6bc405c69d6bf6dc97652e9f296658bd3de078dda50ac680e56818c00dfee909b100fc2fa9c6a891c55dbc66dd62ac52819950732c83198dbb8c04f3c9b8
SSDEEP 384:ETr7ZW5hWgvT1Nq0GftpBjqZaljZYsqn3:2r7Ep1viwLn3
TLSH
T190A2F7838AFC6E53E9875F3212F8DBC32E3597821910516A88A7F4D838C37D5FE26519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-stdio-l1-1-0.dll
Size 24KB
SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
MD5 415d765aa267382a79e56e428c80b1e1
SHA1 1bf13460b8aaac1538bf45186a1624825bb8c355
SHA512 7236ef7b2937718409ef4eeda20318b1697e7c1c868d0df263f4be8673365d48ff6ffa2317bfd1881b6cb3dd1300410ad4f715b8e01ed321c4011aac88490d21
SSDEEP 384:xHCFVh/W5hWOQ7q0GftpBjDdZNil78oStBdo6:xHCwgiT7Aa3db
TLSH
T179B2088385FC6E42E6874B732AF9EBDB6A3587C3281071B98417E4D835C63D8BE13419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-string-l1-1-0.dll
Size 24KB
SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
MD5 5bd5a9001cb0555c5b2b14e0cbc8d922
SHA1 4562d23fba312fe95cbc777fd7c2e37ca1e76ad9
SHA512 a6271f28f069a00c2912f80552bd54bf0d8461886adff626b336d25943dd0ade19eb88c718602017a1986317af3eb5f94f8896e88b9367207e8b53225322cb84
SSDEEP 768:Yl5yguNvZ5VQgx3SbwA71IkFMLirA8Fma3dnL:Yl5yguNvZ5VQgx3SbwA71IvL2maNnL
TLSH
T147B2D8438AF87F42D98B5BB265F9CBC36A388F8615101275C467E4CC38827D2FE67909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-time-l1-1-0.dll
Size 20KB
SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
MD5 f719ad4c04043f55a21e73805997b287
SHA1 0e88b1271b242f7933e78edcb05131612cea061e
SHA512 752b9b4385162126729c3f09b3b75d7121c8dec00cce11f7cf1ecaffed3e79addcbcfe8bdd4e20e15b8494bfe2d24c3f2d11583860b1e03be021196bc83fc3bf
SSDEEP 192:N3LD3WuufhWrzGxf/0uDBks/nGfe4pBjSbA097b8WebtuVaVWQ4mWmVeqnajiPNg:N3W5hWq3rq0GftpBjr0974ZVelg+ZmJ4
TLSH
T1949207838AF8AA43E9D75F3112F9DBC73F3997C21D5061664166E4983A833E4BE2581C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\LDPlayer\LDPlayer9\vbox64\api-ms-win-crt-utility-l1-1-0.dll
Size 18KB
SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
MD5 a405399d5b958a03e6054307a631553a
SHA1 dba43f0afd8c6e1f61cf0be7503c6f70b48b8240
SHA512 33c64766053058fa9fa4fe689f1ca5a345b8b70443995d71aa65b64c7bb38d4dc3a2b37ad06a4ce5ca1c927ed9ea4377443eaaecc69b0e758ff265e755194287
SSDEEP 384:IbNfmW5hWBTMq0GftpBjZtwZkilTMs6Wba:WfBYuieGQTe
TLSH
T1B1822A928ABCD583E9975E7063E8DAC37D3DABC319209165516AF1D828833D0FF1192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\LDPlayer\LDPlayer9\vbox64\concrt140.dll
Size 310KB
SHA256 01729ff33c2e3db1033fb86e899d62026dc1c03705269bb9636227f61934d9b3
MD5 67a3ad0fec3eb767e423e3d7a9134343
SHA1 42949506bc8451031425840df33f3acab5637b52
SHA512 f3b13d38f44acf37c5002f08b684cb2955b778c8a703c8fca6e07eecaac45e1bf4bb036dda055114152390322351ef936492abbf6532d1a48fcfd29304b4db1b
SSDEEP 6144:ZEI93zcNn3dMiBXHxHSSXfPnevwbbeVuX0cp90nWzgQQf3PzX:WIlwNqihUSPP2uzK
TLSH
T13364189A36140CE6F967D1398A53C90BE7F2BC416362D3CB0264879E5F537D0E93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path C:\LDPlayer\LDPlayer9\vbox64\crashreport.dll
Size 51KB
SHA256 6f35dc1553fdc0070464004e9ed1f5eb17ac5979405b1f30a9bd8240ca5019b5
MD5 488dd1dac662038f7152801dc01b21bb
SHA1 5e3bdce9cae493d993f94c9f47ef58581c26b29f
SHA512 881dc7b48d21e3b0fd1bd7f1916d73ac9e6a59edf228fc16a4d4de61ef2db8abb8c32c62324f4a429eec111c75ddf5ffcf7e69b5a8e502532a4f5c4655a039b3
SSDEEP 768:rNYs6LsazaYID9XICSszm36nVl8xzez40YiDLk5wkFQG9YiXkFQT5ALJQ:pOQQaYIRzjVl8xqzf75+7ZD
TLSH
T174339EAB47D414A5CA17D670B8E2AA17FAB3B2950B51C2CB2330C25B0F72BD13F79255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fastpipe.dll

Path C:\LDPlayer\LDPlayer9\vbox64\fastpipe.dll
Size 67KB
SHA256 a21a75564b8c39bb9f164a7c718f77d85127c07954d8c604157f7a914170cfe7
MD5 2951fa3f9a755014dd91a86b46a31674
SHA1 4d4b88158140c4b5525eec1d41d2dd3d67088ac2
SHA512 d0c1f33abfaacba9944706ae845f2041e5a4a76d084b525f514cc67a024fe96ef96bc1dc91d257503d3136c8d419381a10563d5af38aacaaef13e840c64fa97d
SSDEEP 768:vtrd+xB2OVFkdYbU3ZOFRL5RMFsZNCj1Aq2CAYiDLk5wkFQPYiXkFQH5AL7nQ:dMxnVrbIZaRYiCjCCA75P7Z7
TLSH
T10C637B16429928BCCC1AE175E5F6A223E1FA7518173085EF2B24492A1F3B3D6773D3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leidian0.config

Path C:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 641B
SHA256 d166a0a96f1ca242a212ba6e857a352bdca87d8022cbb86ba9368e42963db53e
MD5 56777ae24bee35afd1223c0027887650
SHA1 3803b97f7f9091aa34b5371af344e2d94f3a17aa
SHA512 d054ebcd0e16f669abab53f8c15fd3fbd723f6abed4ba2311941b64877a9cbd745a331f7059b112c36e5728611861b6b8dce78521a8ae09c1335313f122b2801
TLSH
T18DF0A452FF455C5F00EC68067D685702F820950F17B27667773E191D8A69CBDB7C5832
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 ff346a15a50d79866b4d75d65272752a056e6c03468df6a34e23fc99339c203d
MD5 1373205e9ddfe4c1145edeb7f8c5bf18
SHA1 638e35329900ba743bb0564f4101738b472ffc31
SHA512 18c5a445843070cfd9adf759fa0c81500263680d9f84d8ec26ff3ffbf99b9d1636fd42119028bc3e0513d013fefb66283be2a84baeb61d5b116d57b5d44b8673
TLSH
T13EF05C4308F0782A1B0329963EF3882C706C500E0CE093B2392864A3890A7F1B84B8E0
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 74cc3a4ddaa652c08b251a389c3e43b8bfaf1c096c367839b5edd70fcaefdd32
MD5 5ed64d09b7b90e115a32c33df84fca50
SHA1 2416a7a3c96165e0184c6a2558fd03a3cd738867
SHA512 86cc2af70b4159645f6b9973512f9fdcbb5f709f61a8c14f302a46e23974d56b30927ea7e03d4440cad2898907bde40ee33e4cd91dab0ef04f36dd8b97f77280
TLSH
T184E07D2416FE027CF1B2EA740FCAE562006BE1012C68D27915C4571DAB03500DC72D35
MD5 SHA1 SHA512 TLSH

Submit Download

0db55cd7-51da-4cdd-b7e2-ea075861ab00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0db55cd7-51da-4cdd-b7e2-ea075861ab00.tmp
Size 38KB
SHA256 18f39719f3ac167c2122eef6efc6b568d17d881db937511240e988a6eb326dc8
MD5 91899e64917064794e82eb69804b4c05
SHA1 2a8c5c543374a52cf30a5429e34e9fcff6a3e21f
SHA512 c5a6473f099849cd8bc82001d3c5ffdb4708453abac49138ca608f64e3d6a6dc5719e174171b34ed33c203ab49bbc1b5946053914bd46f4ce41f7b8be301bfe2
SSDEEP 768:hrv+4UNbdF3XeLa7+hWwUZ+VCrh0yAJDQfQYBk:hbsbz3W9mSWh0Sf1Bk
TLSH
T16303BF71F4A4CD7348EAD688B14737936EB8207759C90A54ECE95F8D068B6AE230FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72e3c96821e1675fe949371f7dde093aa987ba73e13ac2053add5929be3baca6
MD5 785d9c5f85abbfdfbe09037d227db1e7
SHA1 0096e95c62308b282ed47d2f60a384f36687fa31
SHA512 07cf1d30000bf8cf9e0ee474ff4d5515875ec99388cd206cbc4071d2bc97a23a79f2ba8ba2622e0924d8f4e6f66c366c744539041db9061c9cca43f498638a4b
TLSH
T1ADD09BF162744956DC80703534F1536572545E31445556544590F0B89867381121B49D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f520caf991803ff7a4b9b24a234e8d45e2d7ebcd034bd29be158a277c90d557
MD5 953849921ea6bc8b5ea99349afa1d1a1
SHA1 8a4859d6b2c80f8b9293d2e3e3e747b2c856e54d
SHA512 77b8de5cd35c575619cc81161c080816dfe4ee2b2f370917274f423b17812abac9d16b25797cb03e038779495870aae086ebf6eff2ca53f64fe59585826e8ba1
TLSH
T1EBD09BF562744956DC80703534F1536572545E31985556544490F0A89867381121B4AD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 352B
SHA256 d547920184718ec8cad4b7e25a9d7de50e3926e7a38168ddfb0dff943b7e3570
MD5 80f0494f5112bf9edf6a60a78b16738e
SHA1 c7c887cecc3caa711ebd3d9fa43e0ced661445b0
SHA512 e01f4c42be81b2b2e7d2f28ed162f2a8f03ae0070890a03ba7661c93310463cc9cc8c7aef09337a9399c0f0164cbcf22f54cf0c18dc15cf575b87f8b7dc9a7aa
TLSH
T170E0685B5F86D46007C08442D024E318C0F030EFAA8C877E3248E79D1D824025B311E8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 636403ce719d54343b70e85a3aa0d92bcfa6939c08498eee5bb7f0467a0cb3f7
MD5 a722962e55775e8ad67f3a9f8b81bc0a
SHA1 81aaf11d6547ca47f840ff3d4e4a6281cb509c74
SHA512 7a91d6c587bf17c32e199c2f65981c3687f34c03f911807421040da3c5d047a19463d2ef320673ffda20657b44ca0f71b57b9aee3a2a9c6f50dee8d9c6ad5e2a
TLSH
T1F7E0208507C7C25E979164574274570C41C0365F96C4BA572B08C45C3502156E7815E4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 dcb1eb57cb9b930fbbd61112726240163af8842afad49ca3f3db20154fe91165
MD5 4a6cc98f90683839d580ab77803ff70b
SHA1 be9dfde19e529f5c30bbf66c6aea6d2a9079b024
SHA512 140730494c1b4491745c42304364fd3bb629f0c3c8f1c453a00c497ee4cef1342645a4623589507f2abe68196330044d48008dbc101c2f1bcb60af0870907701
TLSH
T161C08079794C845DC285187EA736F000177066115417DA130551FCD031409A01F2E124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1f8a31e9a8dee28950fc8f81c5e15caf16466db5b3041293c2dd545265d87bc4
MD5 d3d4421aea139684f4f9530eff01eabd
SHA1 1e19c9fee6c121471c7bc9545f4668b0378164c5
SHA512 7b91187b3bb72d42fb6ee8ea12c1b23bcab8314e87f1556ceb2f2b9f14ed34b1b9afa414c519fa27cafc812a170d5afe7b089c67425ea5b6ddcd9f32a9fb7561
SSDEEP 96:i7hK8Iiu+xrMdmqx4DkXG8zdMfwLAvKCFSHa51L6t:i7eiuBd5E8BZLAyiSHCLC
TLSH
T1C0D1ED804B3BFFCBCB140E3364E5386837B4946B558FADC2059E68F5A85E3AC502845C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5f9a45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f9a45.TMP
Size 3KB
SHA256 6680de8f0404ea016ae7d4a705b981f5f541673a36844ac3f64feab8bccd76be
MD5 476fc5c4d1fa5078351843a505603f96
SHA1 a2f449c7f864f431ce01d6d0e5b66f1b1013ceef
SHA512 55f69648fa6333c07f579da154a27424f2147f7fd5972448517c79fd56a49bd66ccffc14fa56ac62a85f4c9d47c327785f6f228198048b384d7267c96a3ab65a
TLSH
T1626152C0433B6FD2C7244F7370F628A83738E467664BBD24548AA0F538167B865498D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a24ecea03ba05aa35f3b490057ede3940cee075bc180b46d7a74b2f06b039b7a
MD5 32b72f6dfa9c2db0295ecea8b1dd34b7
SHA1 a8c0a5a385dc3e9a3415f2cc33da82509e40a8ba
SHA512 e3d4774c3271067e49898a5237d611e41535d2e85ebf5e4f63f0071150255048d15f02c00989ec8360fb55df6e293adff93496ad44f8fb603737b77ec9e6505a
TLSH
T125619AF7C3E8862DC90556F4AA186E2BCE2D0914432C3C6AC8D4AE5B97E34B1F141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7c749022ad5f10a18a56c256841b4cc5f0f9978b283dffb4e25989ce5c0ad9ca
MD5 03b357473459c8970edad0ad63a62399
SHA1 5872fa02459434c57d560c58af089464e112c7ea
SHA512 f70df5c6e5d50f2b283d342a67a4d208aaaebd65b2fc6f563cbb48266d95ced96041993f26ff77d5cb88df0b0a04acacff6049141548cff6ae173455e54a2f5f
TLSH
T1EF81BDF7C3E8822DC90556F4AA187E2BCE2D0914432C3C2AC8D4EF5B97E24B1F141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 15f6c646cb640a8c8dfd283dfc6a38d4122b3dc76a5bbd0935c1f849bc301f3b
MD5 18d324ee47b2f12dcb61260236a9fc10
SHA1 622da7661a3b39ba34ea7207b5c9e524b546d411
SHA512 f59354afc62bf93dd85735390928006920ae03f965c4523d5043dd578f0ed3f9577023bef7e7a018279d09d8feb3bb191333b061a8dd64a08047c607aa03c30e
TLSH
T16871BFF783E4866DDA1156F4AA047E2FCE2C0914432C3D7AC9D0AE5BA3E3071F181A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1cacdb138681fd7a4ed27b1dd33663bedb741ed09e9178220429d2565f5991df
MD5 e86435faf6905f7c8558c182ae7cf050
SHA1 0cbe97c915f25e628d3615021fe4c91691c03de8
SHA512 04c046aa7eb05625b5b3af664bd81381bd2ea996ee19150c5b53eb45361de86da4c629b0f6b310c81b1e8afa19d3abe813eafd47960d38b7a438f9c56b61ce4e
TLSH
T14381BFF7C3E8862DD91156F4AA187E2BCE2D0914432C3C6AC8D4EF5B97E24B1F141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 34f89687fb835f25d95c2f78cad32d4878852df7004c45a78b6a40ae723c2f77
MD5 49db0c70c5a9f1c38e602a55e7f7f609
SHA1 5899c6670cf9f8d4191644be0c684528d4d8fc33
SHA512 5fe73ffc9d32d8261a525518745337db7f085639b45abadc108c5e39d8010119116516dbe7f7362c5165e845610482d0a855eb74ab39ad948b5d6ccd574b1be8
SSDEEP 192:sxR5R3yM/jK1Ml8wC6/fAsXmjMs9aBoKOcqzoA8plO/g6+WNpqx/eBePtGNUtGev:sxR5x86/fAsXmMMaBVRnw/5i/etN2v
TLSH
T12862C916AA6499778CDBD20DFA45BB53D2F9157392900E44A9FCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1459e7bc1ae389470eef00cffcb9f36f1ac48fa045e0bc9f61256b7800836c5a
MD5 59671ea503cc8c86f314e11e588e5057
SHA1 cf18d24ce2a5aefbe876d014f278abec99acfcb4
SHA512 da026e8a694ab1896a2b5e0659efc7369fbe49052f8ddf4b86d61c7c16e348116f8e157c37b9367a2441caf8edeafcd6760dc5d7c885d606cb11b54e4f1b0dc8
SSDEEP 192:sxRaR3yM/jK1Ml8UQgC6/fAshlmjM/ZN1mGOcqzoA8pTO/g6+WNpqx/eBePtGNUO:sxRaxq36/fAshlmMhHRn6/5i/eXN2u
TLSH
T17D62EA16AA3499778CDBD20DFA457F53D2F81573A2900E44AAFCCA0C05E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6264a553d63a46cdb403cb5a44d131bf1435e15c8c499bd272a785c682e6016d
MD5 be0661782e16af36d2ddd6031d2ef8f7
SHA1 473ddc02b7322c560ed34b7ff8114f21e7e5a14c
SHA512 6a6763e93093b65454f3f939b262a4c57997e8e01703176a307a74ac0246dda7250eec48a3496c9142e40e0840162a63180a013d26665fef60045abb96731d51
SSDEEP 192:sxRaR3yM/jK1Ml8wC6/fAshlmjM/ZN1mGOcqzoA8plO/g6+WNpqx/eBePtGNUtGv:sxRax86/fAshlmMhHRnw/5i/etN2u
TLSH
T19362D916AA2499778CDBD20DFA457F53D2F81573A2900E44AAFCCA0C05E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 ce3af79e262ef045251bbfb0680becda372b92853c61ec22e16f3790e4fc50a7
MD5 42c1de9eee172f554d6f7389f218e454
SHA1 76e68caf89e0a3f6b1916fcb61e0e2ec5a30059a
SHA512 abf2233e28372ed57011aa06ff75df250191cab414ead8b9840fa34743a99d31ac1fc678deff5399aa7ec4c96833927967496430104fb56dbe37fbfba8b1f7e6
SSDEEP 384:sxRawq36/fAshlo66s8qMpRiYnazAW8pZS15posJWeT+kMhHRn6/5i/eXN+u:su336/fllo4Mnc7WeT+rn6/5YeXN3
TLSH
T114D219059924C8379EC39D19B47D7E33DAEC50626295CEDA5AECCE0C019E1FDAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 478cff33983f98a96a271b47589a42b448129fff829d5b92625e323de210c616
MD5 99b16a615364e42bcb41e67b352de46f
SHA1 f960aa990d24f51f0e7667c6fea10ee464e31529
SHA512 b87f2cabc327f5d3a945addd093e61c78ef80f015c81b8dcd4376352dce1d1bc32b5cabee809136b670c1e7142040ea6d45f021d99b8381566102368a0d92513
SSDEEP 768:VroBVL6d7pLuL7vOWgy8fml8F1+UoAYDCx9Tuqh0VfUC9xbog/OVczEOMrocVIgh:VroBpME7vOWgy8fmlu1jaTYOXcVIgh
TLSH
T155E2FD3B684CCB7E4F844DDCEC297D8AADA902CB96D88D5447FA880C03C67EF55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\248163c1-60f9-4f73-aa97-62cf9a0902e9\index-dir\the-real-index
Size 768B
SHA256 4f009e70886d0d6ecaa3359b74f494a8fa260b1d6b7c0cb261e841b2c8888ecd
MD5 7fde892e003ad899db96e7d6adc97f89
SHA1 215f3c5ad7b2da770ee1db6e677216123c6d4483
SHA512 51caf37498c84a2ab7b1609507c0d543f67ce507c13215ee83921b8bada33981117a0081ee81b8d7690552ec29e9995ec66c214316f3175aa54a8938d8c48850
TLSH
T11201E1D7CCB22C0BCC03117D15B9604D273325DD76489F43012CAB3CDE4BB68510410D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe63ba6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\248163c1-60f9-4f73-aa97-62cf9a0902e9\index-dir\the-real-index~RFe63ba6c.TMP
Size 768B
SHA256 f7559a0e6cc4bef9083ea2d616715fd6716fe0c454221b7278c9ccee73ca7358
MD5 4cd1d483b70a7a205a8083f4f0a73e67
SHA1 3dc848e7dadef74a42789f57486b30c1fd5cbf36
SHA512 11db0ec59f6b32fef92120bb944f20b746ba61bd193212202daec8e485ed9c9e1c5e576699b41a88bad4bfa97cc39eed31b1b365b201ba2c87d5700b3fa9e756
TLSH
T1790105D782B06D47CD0322FE654BA40D333364A02548DB030029BC7D8D56F7C515259E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ac81e86840dfc2c50505d1979def18fa7ad7ee822b17a0ada76345f980488a36
MD5 9ff13ec1e19ef48d95d0afee552648e4
SHA1 8014400288ec83c8c1f4fa93fb26053b305972ba
SHA512 8ccf32d481fd7f1bc108ec8d0f3ef7ac72ad368de1af78b239e28ce31aa1c334e7d07661f7bd2594c1977ca1322de9024ab793280e50d38baf3ef8b2cce7093a
TLSH
T155E0D8B62EF62425FD6EC3D9243350940842B9599559FC8FB02ED58710E23A4745AC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 3825ac62508bda2e70c0240c65133e77ab60d5140b17e15e2f63bd7a1da5c239
MD5 1d4998607d03e296508e876a8149042f
SHA1 f292beea946385dcafcf8d070ea94a189392f551
SHA512 ad89600a989745d005700df8ea1546fb7c07c44c3540932374603dd85e20d68574a481e7e964231e849d45302997bfa67ea30d220c646f44d9e69f354bc0f52b
TLSH
T181D0974BE0990445C76B8B52093242AB42A23C885488904CD123383E14B4F87E220EE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 6a4083d1c4cafca0d98f6d53c7d008274c9adcdf8c013eaa3e8ac219faa672b9
MD5 930918c41ac220dfe0b46cfc57d02830
SHA1 1cd17775c98cd33b1f22a0e1d8506dd05a7de26a
SHA512 b0ca8b8effbc91e80dbd021e0dfb441a18c6e873f64b028be0365872279cc1ae4cbd306baa95d3dd3769bba3de19ac5b08316b7ef3cf8bfd64d8b0075528db82
TLSH
T106D0A75BE0981545D7ABCB521972427B46523C88549DA04CA123083A9495F87E151EE7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5f267c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5f267c.TMP
Size 138B
SHA256 f94ab269cf2f93dc690a2222ce4c0d1c83528170c5f6806d919666a879ade2f1
MD5 ccc7ea240d07445238bfee8aac0369a1
SHA1 0417fc85bd8ee042c0ade6ead83794d041774190
SHA512 5b438e389153fc15a1793b9c180227ec23b24ebd99184ffe4db8bbd22d37c41e765bb3c3010ad14949fff7269fe257792f45717e9cb6069e7de6ebc7401f81c3
TLSH
T182C09BEBF4D51515C716C6954233579E87052CCCD8C9844D7227383A5075F57B251FE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 bfd3596a81a9b6bfbf0d759fffcc583cd607d99851530f53d252e24b5be6583f
MD5 d8e446e615a5c35e66f6b05a7ca33199
SHA1 bf4b76a97e21f321ee376aca4be525b81f87bd09
SHA512 f09ebf92cb2d4719f4efd5068aa4a2cc3b04c63b6b30002f61e2834e921c06975faf6b53ee4c921ca314eb3c423f8f1019c7179115a21db56299e9cac55e638f
SSDEEP 192:CMN4cWaOjqngkApgujscHGshHjsJ9rhhY1ahl3cgLyzLiVhS3eyEkUN8piiK3gYX:olg1wq
TLSH
T12FD1C754303702807C7D398891D9DC66D6C2B0E23015A42F7BAA42E72F67E169FFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe600023.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe600023.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f92373621a99a18fbf419aef1b0ebb50b8a577028173a4992d7bba2c77d5ddb4
MD5 6819e5aad475bb79345ee1b3fc650469
SHA1 122eb05b86516cc813b2cff8833c84c4fa5bba51
SHA512 9a16d0ea600c9a17322fb2469a247f0d355bb9a4351ff1ef1bc8694570f7b00312224f82ae66a508016e265149d03fd1c4a2c7705dcf267fe8050f2c2b6577e1
SSDEEP 768:aj+9n3XCLa7+hWwUZ+VCrh0yAJDQfQYb9Mf:Z9n3i9mSWh0Sf1b+f
TLSH
T124F2BF70F8A1CD7348D6C689B28737969EF461778AC80D48E8ED9F8D06837AD130B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 48a43aa7767a8fd1880d914f0257aedce56fa75bfcc9191cd31b01b8a64205a6
MD5 dbb67111249cfa68011c74505a22be8e
SHA1 bcf279eada31d432ff2254206cd8b1b2de28e1a1
SHA512 1dcde3aec91e2d2173c1b7087d4d649f33c0046cd4c2a8bdb47ff7ca927a5fae69d195489fc7b8d781979bd75cd2cea6533c269227bf49e84fa104ca2f1c1c8d
SSDEEP 768:1rv+4UNbdF38eLa7+hWwUZ+VCrh0yAJDQfQYBk:1bsbz3H9mSWh0Sf1Bk
TLSH
T14E03BF71F4A4CD7348EAD6C8B14737936EB8207759C90A54ECE95F8D06876AE230FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 68e5f43803bb229d06c23382075783ff60e1001d5df5303c89d810010b9141b5
MD5 38d5f006d5028cae5d6003a831f586e5
SHA1 376d339b1920e08b9a8dd599f042d6e48212e80a
SHA512 9112e3b40ee82cc8ed42fc057ee9e4695f17cee4e3a087c479eaea65d5ee16688ecb361b3604a8a2d1d4fb5f9e25c67ad0ecbbe1cd6c9a7a27f0f1398af3fc32
SSDEEP 768:+rv+4UNbdt3Qxa7+hvUZ+VCrh0yAJDQfAhUiW+J:+bsbn3298SWh0Sf0U7e
TLSH
T15203CF32F8A4C9738CE2D6C5B18B76576EB8602356C90A94D8ED2FCD078B65D230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 220c567b83eec5830d250d768855fa389b493f442e8ba3e351478d207a43f464
MD5 c5e92fea11642e00cbe8bcecc11aa376
SHA1 73d0311751261dc7683e18acf55a42bcb1e2d64d
SHA512 9467e2fe392a001a0a51a6c8d1e4b5567ca8425d35a02390215512501fdc9c57af3acb8777f47c0300b8c719ba9e4b44a3a01e89aa8c6db1b399436b433565ad
SSDEEP 768:ZF1j+9n3nwg+C13a7+hWKeUZ+VCrh0yAJDQfQYb9Mf:o9n3P95lSWh0Sf1b+f
TLSH
T12E038C72E891CE7799E68BC5B7463796DEE011B78ACC9CC4E9D99E8C01C32AD030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

91e2e1fe-abcc-4899-aaca-e0d1fa031f2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\91e2e1fe-abcc-4899-aaca-e0d1fa031f2f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3828_1765135078\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1489250584\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2676-651-0x0000000035F90000-0x0000000035FA0000-memory.dmp

Download

memory/2676-970-0x000000006FC50000-0x0000000071083000-memory.dmp

Download

memory/2676-981-0x000000006F9B0000-0x000000006FA00000-memory.dmp

Download

memory/2676-953-0x0000000071A10000-0x0000000072B1E000-memory.dmp

Download

memory/2676-955-0x00000000712E0000-0x00000000715BE000-memory.dmp

Download

memory/2676-969-0x00000000712B0000-0x00000000712D7000-memory.dmp

Download

memory/2676-980-0x000000006FA00000-0x000000006FA22000-memory.dmp

Download

memory/2676-954-0x0000000071970000-0x0000000071A0E000-memory.dmp

Download

memory/2676-979-0x000000006FA30000-0x000000006FA3C000-memory.dmp

Download

memory/2676-978-0x000000006FB10000-0x000000006FB29000-memory.dmp

Download

memory/2676-977-0x000000006FB30000-0x000000006FB68000-memory.dmp

Download

memory/2676-952-0x0000000072D20000-0x0000000072D50000-memory.dmp

Download