3aa43cc320220eccd8d9155d205f1105cadba544954f375b4e30f5d6de7091be

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LingoPlayer-Windows.exe
Size 27.4MB
Sample260810-hyl8raef76
SHA256 3aa43cc320220eccd8d9155d205f1105cadba544954f375b4e30f5d6de7091be
MD5 b883b12853d0259b9b5ebe2d654a20f6
SHA1 f295650a15fa9246d45f77aee6adce3d4ae909ba
SHA512 486d0c80f4bf1ac729a973be571bbd6752e217b236f5b28f088ce6d685f7874a24824c0953767e69758d1f12a3d21dcce1b4cf05e81c2e8caf7a6973c3e55f83
SSDEEP 786432:kaKh+8MwP3M737HDLzL1OX5+5tDxdJLus91sqqkW:kAJ8M73DDLzLGGHHHsqLW
TLSH
T15F57333FE287B53BE42E2A367976A520543B6561A5438C5286ECF48CCF341B01D3FA97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5736	LingoPlayer-Windows.tmp
4648	lingo_player_next.exe

Loads dropped DLL 12 IoCs

pid	Process
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe
4648	lingo_player_next.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lingo_player_next.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\LingoPlayer\flutter_inappwebview_windows_plugin.dll	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-IMREDZO7HS.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-P6CR35KAMS.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\is-IRFSU8ZO38.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\packages\cupertino_icons\assets\is-IPYW847607.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\shaders\is-9OBFTN8TRB.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\shaders\is-O0FKZBRWTH.tmp	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\zlib.dll	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-3M40WDEOIX.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\is-N1D5CY3YAF.tmp	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\vk_swiftshader.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\volume_controller_plugin.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\flutter_windows.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\libEGL.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\sqlite3.dll	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-UT8FY8S6C6.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-TR6BPKCGES.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\is-CZTE6GSLYQ.tmp	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\dartjni.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\media_kit_video_plugin.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\vulkan-1.dll	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-MLSTCLZXYH.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-D8A1SL7S4G.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-VLMICX8HXV.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-E059CB80W7.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\is-KFAICLIL9N.tmp	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\d3dcompiler_47.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\media_kit_libs_windows_video_plugin.dll	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\libmpv-2.dll	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-XI52XZ3A82.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-FMXNKA01M7.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\fonts\is-I5X50BXXU9.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\packages\flutter_inappwebview_web\assets\web\is-1IFWYBAKF8.tmp	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\unins000.dat	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\unins000.dat	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-TZDO43S892.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-FW568WODTY.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\is-8ZCA4EIPXM.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\is-PA0A8COTRO.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\packages\flutter_inappwebview\assets\t_rex_runner\is-2EJAXMRCA1.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\packages\flutter_inappwebview\assets\t_rex_runner\is-FLJ76EKX94.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\packages\media_kit\assets\web\is-WRS2H9LRPQ.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-BQAEXYEN7S.tmp	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\libGLESv2.dll	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-2A7YS2ZOW2.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\data\flutter_assets\packages\wakelock_plus\assets\is-TM3CHYSSAC.tmp	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\lingo_player_next.exe	LingoPlayer-Windows.tmp
File opened for modification	C:\Program Files\LingoPlayer\WebView2Loader.dll	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-3E6FFFGR05.tmp	LingoPlayer-Windows.tmp
File created	C:\Program Files\LingoPlayer\is-AOU1P0U204.tmp	LingoPlayer-Windows.tmp

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_415354331\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_2079023699\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_2079023699\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_2079023699\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_2079023699\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_2079023699\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_415354331\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5912_415354331\protocols.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LingoPlayer-Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LingoPlayer-Windows.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3352-1-0x0000000000DA0000-0x0000000000E89000-memory.dmp	innosetup
behavioral2/memory/3352-8-0x0000000000DA0000-0x0000000000E89000-memory.dmp	innosetup
behavioral2/memory/3352-118-0x0000000000DA0000-0x0000000000E89000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5736	LingoPlayer-Windows.tmp
5736	LingoPlayer-Windows.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5912	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5736	LingoPlayer-Windows.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4648	lingo_player_next.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 5736	3352	LingoPlayer-Windows.exe	88
PID 5736 wrote to memory of 4648	5736	LingoPlayer-Windows.tmp	89
PID 4648 wrote to memory of 5912	4648	lingo_player_next.exe	92
PID 5912 wrote to memory of 3252	5912	msedgewebview2.exe	93
PID 5912 wrote to memory of 4808	5912	msedgewebview2.exe	94
PID 5912 wrote to memory of 4808	5912	msedgewebview2.exe	94
PID 5912 wrote to memory of 4808	5912	msedgewebview2.exe	94
PID 5912 wrote to memory of 4808	5912	msedgewebview2.exe	94
PID 5912 wrote to memory of 4220	5912	msedgewebview2.exe	95
PID 5912 wrote to memory of 1268	5912	msedgewebview2.exe	96
PID 5912 wrote to memory of 1268	5912	msedgewebview2.exe	96
PID 5912 wrote to memory of 1268	5912	msedgewebview2.exe	96
PID 5912 wrote to memory of 1008	5912	msedgewebview2.exe	97
PID 5912 wrote to memory of 1008	5912	msedgewebview2.exe	97
PID 5912 wrote to memory of 1008	5912	msedgewebview2.exe	97
PID 5912 wrote to memory of 1008	5912	msedgewebview2.exe	97
PID 5912 wrote to memory of 1008	5912	msedgewebview2.exe	97
PID 5912 wrote to memory of 1904	5912	msedgewebview2.exe	100
PID 5912 wrote to memory of 1904	5912	msedgewebview2.exe	100
PID 5912 wrote to memory of 1904	5912	msedgewebview2.exe	100
PID 5912 wrote to memory of 4688	5912	msedgewebview2.exe	101
PID 5912 wrote to memory of 4688	5912	msedgewebview2.exe	101
PID 5912 wrote to memory of 4688	5912	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\LingoPlayer-Windows.exe
"C:\Users\Admin\AppData\Local\Temp\LingoPlayer-Windows.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\is-1E8RIEK0Z0.tmp\LingoPlayer-Windows.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1E8RIEK0Z0.tmp\LingoPlayer-Windows.tmp" /SL5="$40104,27571584,893952,C:\Users\Admin\AppData\Local\Temp\LingoPlayer-Windows.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Program Files\LingoPlayer\lingo_player_next.exe
    "C:\Program Files\LingoPlayer\lingo_player_next.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=lingo_player_next.exe --webview-exe-version=1.0.11 --user-data-dir="C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4648.2736.10419852458335263869 /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5912
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView /prefetch:4 /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff91a85fd8,0x7fff91a85fe4,0x7fff91a85ff0
        5⤵
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView" --webview-exe-name=lingo_player_next.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,2705389212926964425,15117686717564348137,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb
        5⤵
        
        PID:4808
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView" --webview-exe-name=lingo_player_next.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1764,i,2705389212926964425,15117686717564348137,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb
        5⤵
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView" --webview-exe-name=lingo_player_next.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1764,i,2705389212926964425,15117686717564348137,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb
        5⤵
        
        PID:1268
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView" --webview-exe-name=lingo_player_next.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=1764,i,2705389212926964425,15117686717564348137,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb /prefetch:1
        5⤵
        
        PID:1008
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView" --webview-exe-name=lingo_player_next.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=1764,i,2705389212926964425,15117686717564348137,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb
        5⤵
        
        PID:1904
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView" --webview-exe-name=lingo_player_next.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1764,i,2705389212926964425,15117686717564348137,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fb1937b3a53f6eaa97c1e443da1d134bb8fb55cb
        5⤵
        
        PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebView2Loader.dll

Path C:\Program Files\LingoPlayer\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files\LingoPlayer\d3dcompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\LingoPlayer\data\app.so
Size 8.9MB
SHA256 d39d08741d6a96d6fb7fa8c466bac7767eb7f8c87e1c0619cf26881dea1d428c
MD5 81780a1919fc2de092aacd5038c2a265
SHA1 59708b53225a46f250b956c458a26af1b1ce1535
SHA512 76622074aea3555d3afa68a2c24591fa3758974d520f89f2a7213d3d8d9216cddbb160fcfbef8ae61edb6704ed21d53d72cca9c2b239e947b7e5e333852f3d12
SSDEEP 98304:FxXmKD5TuLUMo086KinUUeQEKenLx03k87Ropz7CTP3OY:3Xm4kLUMo08unUdQEKenLe3z1opzE3/
TLSH
T18096E847D1E89360E472E776B76F26E69E2438DC4F30774A068996552F87CE04ACB332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Program Files\LingoPlayer\data\flutter_assets\FontManifest.json
Size 208B
SHA256 cd7e03645bc44b2dd47b7cb626f51c4ecbf55a197ab77241628b47ac165fbe21
MD5 dc3d03800ccca4601324923c0b1d6d57
SHA1 bca264548730f8b1871672891b0ad0c02444bfaf
SHA512 eda04affa31ef1d3fe4b081762380a6a5a9364a48e7b6998e870c84495f51a9658724e3f496d90a574f7d5e13740dcf47ccc1c7914b77b6ef0826fe87379cdf8
TLSH
T106D0C74B581909F6458D9845F0E11253BC4429579E46DCCDE3A40E54D3A11641739213
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\LingoPlayer\data\flutter_assets\NativeAssetsManifest.json
Size 131B
SHA256 4ac70f7d67abb2ffc105d2cabfdee68c9aa138d132107e5be4949c539f7ce379
MD5 93fd9d2b0d844c5bddd73c3ae2973328
SHA1 73aea486854647bc6c20f32a4df178e36eb39643
SHA512 8c0815974fd8fc1a2dfd12c05c5100d07bad5fe4126577b590e910bdf492e5acde0055deaeac357a1470dff9a279453d1cbed9eeb41b959604c2e9c0b5cc8242
TLSH
T14DC02B9681000B6134C85705E8090BC0015D3310E8721C9C05E0410C0F0050EC1100B0
MD5 SHA1 SHA512 TLSH

Submit Download

MaterialIcons-Regular.otf

Path C:\Program Files\LingoPlayer\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\LingoPlayer\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_inappwebview_windows_plugin.dll

Path C:\Program Files\LingoPlayer\flutter_inappwebview_windows_plugin.dll
Size 961KB
SHA256 652e399592c03b6ecc4f17ceadab1e6daac09c49376365c8a3fe7547724b1219
MD5 b54279477ecadf6f00667153ff8625b0
SHA1 21bd18b656f63296d5a6dc1b460ec5344849e9b9
SHA512 1bb5ad23447d2a8bde2f9e1fa240ced94309273b1ea5c9b93c7448d8e445e27aeee0f84e4223c03b11da6c96a4b8fdcc32a4a8b5bebb96af206ddf96259e25e1
SSDEEP 24576:Xsfy5Em5iyt72deere+zVrO0iC+u5G5FWm1s:XtEzu2dBBOi+75FV1
TLSH
T1EA256C3BA61C00ADD076D5F98E675A42E771B4D60331AFCF16D01A663F1B6E80A7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\LingoPlayer\flutter_windows.dll
Size 20.3MB
SHA256 011e87e890b7bfbac89f63c763341ffb8393d2b4a617dd836c471a0cdaa1346f
MD5 ae8508a20a3c598ae3668aeb39633755
SHA1 1052c38074e8836da5becf616cbd147775e9400f
SHA512 61781fad83efc462ae5dbb616e1b0a2a30e6f35fdb63926913c1c0172f8302f9c39f4e8c2bf1a9a18c0cdab1199eae03c5a4a683248a3e180cce07245643453c
SSDEEP 98304:FE7hoeyV+kw1ULtPbwDggwZr3hH5epehPTuwTlckSTKZSx8tkvMzVdD+cWUN25el:F3IgBfefQzH7wpuIFybvI9YA4V
TLSH
T132276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47253F66BE01B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files\LingoPlayer\libEGL.dll
Size 461KB
SHA256 b2590bd0692f0381fc45c20bf1c7f7f713c9ea19c7ea6bab62efdd1fadc4eaac
MD5 0f61da7cea39e89861117f3cb4620dae
SHA1 9ca286bf6d5617eb38101d5e166edac29497c9c5
SHA512 7dc2bbce9808e00122ae0d960ad6b0156d201494aedf4c4c9e261f50986b72dd19b41d443138ffdf1b2e5b8e29614f0a1e909e4c867262eab311f6675618369d
SSDEEP 6144:bAJGuTlLMP/jvtG0uMgvgZS+U85p+2uEA3sB9KeZTyT/tSOaj0yPepA9YK9f:oTaP/jvtG0urvgZS724sBbj0ZS7
TLSH
T156A48D15B79448A9D02AC074CA538643EA72B8960F64FADF13A0D37D1F777E85B3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files\LingoPlayer\libGLESv2.dll
Size 7.1MB
SHA256 620bb6e38d7ed6c760a0cf4a8eb6a8f64b259b96ff286551cd32cefc6c35ca39
MD5 d22c92bee4e7a14d6c74e7376eca7605
SHA1 0592d72d5e0e38e5cfd9a090309260962bf8c4d9
SHA512 2aeec8ccf9db442a2b1e3b391e6c3e899de1266199e6ee6040aceeaf8931e1d10c55ea1ab9ebbd3cc662bf56aea698c09e38f75c7b3e8b0b27c02af63d36993f
SSDEEP 49152:fR1vq8X1ZxC721Mr+IqizQ0LQj7KxKT1wvIOCaDCmvWI2YQkGk6jouaLlbpx/fur:b/xO21eqnoIw+vknAYYszpuSxxZi8Y1
TLSH
T142765A03F69141EAD05DD2B98B5B9622F231BC861371B6DF229473153F76BE0AB3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmpv-2.dll

Path C:\Program Files\LingoPlayer\libmpv-2.dll
Size 28.4MB
SHA256 d5f0694b08c124e785d858d00082f3e3b158dd9138bfc48c0382bf1eb443a5fc
MD5 3a6bd0dc9ab32d7b450f06bca2359274
SHA1 b2be6a73be23b60f1d23543363ea559438218c72
SHA512 4c8133321833bc94c8a2f1ddc83523fd554d9699efa09d8dea6ef4aa9bbca0a4f041a10e4793b6424c8cffc4583e36c2a96039017f29465458a9a2e5510631ef
SSDEEP 196608:2E4MJL6OGzrpR79PnKPBv00IbW8p6NMA+31bGb34+1VVMjbCtuQ/OHAs4:CMMOap19/KPR0Zz50I+5Mjbou4Eb4
TLSH
T116676D07E29350ACC56BC170876AE733A631785D02B47A7F2695E7B02F22F90775EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lingo_player_next.exe

Path C:\Program Files\LingoPlayer\lingo_player_next.exe
Size 95KB
SHA256 5e7ac599231ce0d6cc60fcfc908579d9889a7c178116fdebb121605790ac945c
MD5 4c19df8b842be00f3c019d07f0f425a0
SHA1 ca2f13cb94c85efa90c2ff348a1683e1120dbc5c
SHA512 ee92ce2bb7321ec27ab7e2853f5694ceb63bd66083318f14a8940ef84b7ae6501a8f164a9db9a5b359d175149fa5ae26cb1804cfb0d3307fd4b477cec46c495e
SSDEEP 1536:MJi7XiHLKXYNFqWYi1oEbrl3WHrLNYdsrMmdxHps0ZVTdR:MJi7umXKYi1oEb5G3TLps0ZNdR
TLSH
T13D932A36EA5810EFE21AD8BCCA574906CB72F8864B61A7CF57800EDB0E279D51F3E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_kit_libs_windows_video_plugin.dll

Path C:\Program Files\LingoPlayer\media_kit_libs_windows_video_plugin.dll
Size 12KB
SHA256 bab1db1b8ad649df684a92307ee2ce6d77e28c2bac8916b11b6264096225dad6
MD5 94094dd1da0ca9c13624b675b503641f
SHA1 0c754daf1fdd1c2cc86585d338a0dca9f2a4e990
SHA512 3ea102da498ddc30ebb9080f6b260f5375b44659c77457d5a5b3e1f3035515351b0dae88ea56411e8a5ec4f86b1df09c5a504f4959efa4e5ca8f7e04cdbe13cf
SSDEEP 192:zjD69xiHLVKwgXrMvDKLzwlNrsIHqUZKfWSAvX2TrWDty6yfF9ZeP:HD69QKwQMvDKLslGt1FSP
TLSH
T16542D84B7B550A95E23143B8A0930F10A6B5BC315BA267CB23E1915E0F577C9B07BA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_kit_video_plugin.dll

Path C:\Program Files\LingoPlayer\media_kit_video_plugin.dll
Size 147KB
SHA256 1013c1b9187f2a4879a7e73c51c31b162781ad17b298fa7dc6fe54ac9d93dd2b
MD5 ca3a5015ab9f4c84bf7360e5451844e4
SHA1 64f5a149b2fc28649d8e444b79b7cf24e92b1167
SHA512 2457d966e8273035eb67e00ae1bf13003a22a0e33ba25296c72e850a6715846cd1dbd8de639db35997d71c2f6690646a5454a2cd0a17d284997b668983056605
SSDEEP 3072:mTwF/k8+AMznSGJtjfti+r1zEKiE5F52nxoPS:0e+AKJ9li+5wKiE5F52nxoPS
TLSH
T15FE33B2BB65940ABE22AD0BC89474D06EB72F885476167CB17904BEF0F17FE46E3E510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volume_controller_plugin.dll

Path C:\Program Files\LingoPlayer\volume_controller_plugin.dll
Size 94KB
SHA256 faab482a87c1c304fa03ad13e6ccd4fb41eb1be75a83cf268add34431fb49394
MD5 7097eeaace699166f02174bd78ac1b22
SHA1 2211462321e1c1e867743cda9e234168ac7dd00e
SHA512 c2525a15ad1765ad303149e94690fa9924997e72b392a4f7eaa80cf5c0ab10b8cdf8aaf1e8586c292f2abd97de352a54b30a14ff7d2dfdbbd77134289f1340cb
SSDEEP 1536:UGwPvPO+mspNe3JPhsi7yNdXRHXqofzQcr7XCMYlA5riW4fQtjrV:UGvY0jsimNfvfzQcr7XCdlA5riW4fQBJ
TLSH
T1DE930A2AA66D406FE21AD4F8CA534D05CB72F89647A1ABCF17501EDA0F17FE50E3E610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0338886b2f06ea14f33c5c3e1a3e879ca0ed6d8fbe00a6f3269edf16b8b80270
MD5 31d16058db09138c57c1fe6ee32243f4
SHA1 3114f105db343c839bf2cc4e5e83633afca0e570
SHA512 0cd1ac8a04a0ca48652849bea31042ea25ae423a67d1b9be032ef15f556f18a04b07a56833d9d0922095db131b2efc7888330e74e1db6d134a504a80894fe5f3
TLSH
T13BD0047455471010D4501D311010C1000D13C401D401115110151C550551004510F45C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 87ac20e98790c44a96b8fdf26968e600016791b97f9e2efc5c480da058845ca4
MD5 202fa9a46332a33ef1ec723e80419d29
SHA1 9cb8c82ee47c7b8f00bdf264ee35dd27b7eff297
SHA512 601f0967e8c056719b8e7e9943bfc45d56e7300f45cc5aa902d1a2438a9dacce04c32b72892eb51e525c18f20dd845dfb967e972beda9ecfe37a8f6c9111e3d2
TLSH
T1E4D0122636430134C42029331002A1080C02C10BC0054041642D9D6E1B140541A0B895
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b6bf5.TMP

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5b6bf5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 6bf6a76614d021707390a57294cdf363f46c5a294cacff19385e2d1b8e42584b
MD5 a7e5366bf752f59c4b17133da0b2654f
SHA1 c4fcc01da40b09553d3b854a9f1ccf9cec3709cc
SHA512 f4330e49341b8356013e12af317a7343ac12325ab72bb6be6c010b508df0d2dc70d1070d6c3c77c8a16a500535ec3d3404d2b97d4a3c6f434f7940d51476c247
SSDEEP 96:stl/dhsR8O57b9JOkIo5h16ZZs7/x+6MhmuecmjebK+go28XM1C7K:stZgG9o+sV+FijNGG6K
TLSH
T1A0C1B8025E28787B4CCBE109BA397B03D2F9A03275D52E68EBF9462C08DB5DC531790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8295dd5-ad9b-4b99-9829-2f8bf0f5cffa.tmp

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Default\f8295dd5-ad9b-4b99-9829-2f8bf0f5cffa.tmp
Size 5KB
SHA256 0323d3a4b342c153fe0667ef7741e6f1832c2a3000e0dc385222c2c161cf5787
MD5 b82a72a92e1665bbab8117188506c213
SHA1 80044107a618b19c01f835b5956e2773ce587427
SHA512 8461616581780453cb655c5803ad9f06daf89f41773dfb206d641723227190f9ae9926ca386c17e019b342a08e434415b85cffbc75e149c870463d3e3555cbc2
SSDEEP 96:rl/dhsR8O57b9JOkydo616ZZs7/x+6MhmuecmjebK+gm28XM1C7K:rZgGbojsV+FijN0G6K
TLSH
T1EFC1AA025E28797B4CCAF509BA397B03D2F9903275D52E68E7F9562C08DB5CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Local State
Size 3KB
SHA256 34b7ce53dd7a32dff32d02517b11a1fc3e34d908694489512fc94fbc8818c3f0
MD5 4ebb5dd9a9d1d185949cddbdbfd0b686
SHA1 e1805d22594a9c37375bed35095b66d4a55cd678
SHA512 8b1a204331e49bc0af98da4b1fbd81f0314f9234da116b7c8ed23414066462925090c38338247bca42dfc6f64b85f4d7114d6e71766570385f408bb303ac0172
TLSH
T11771982369746A374DF7DA05BD8A3B17AB695027E4853FA4CAED1F0C01E72881342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Local State
Size 2KB
SHA256 da417f0f002072cfbaf8a3be9e2832f9e2ace36506a1bf9a1906c75628881d24
MD5 130c994e36dbda66e6522fdf51d1b6b1
SHA1 d75632b62863682109d0c627d807cc6d1fe6b0f9
SHA512 d87035c6598f36c6aa9bcb08b1f90b16047a156ed35e29eff4babd60d535be93fce2c750af3fc1f8d3b482ca1788951135fc368483cab341866079932fcf6a37
TLSH
T17F51647368246B7789F69708794E3B23CE3D9066E9512F209ADE2B1C01E754C5342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Local State
Size 3KB
SHA256 a40dfcb310d7f718097a265f6e38a4c26200adf7fcc3ea6ba33c52848b936eb6
MD5 db9cda88f965e6f6812ddd1c4fc24777
SHA1 7c534ef2bbed53b930271ff6d71e7e67df0b8986
SHA512 294ca6993a2245b414228b8c2702decc2051ca54e32204a8e32b58957c8cf19359f91bf3432c529d55f096ff48775e1a1c4bbc646f1a3ad3166565f008caa604
TLSH
T1906196736974AA374DF7DB05B98A3B16EB699027E9813F64C6ED1E1C01E72881342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Local State
Size 16KB
SHA256 d1ffe9582c6d5a39b9b1f8417f99ba0fcc1bee76c663c7b8fe298bbdd01261d1
MD5 5d20ad0f14c8d9b821b65142ac44fa0f
SHA1 3bce65e60ad802f7aa3eae3199d79282ddf8bed3
SHA512 e76d2c07c9ecbe8d6c66df62472efcb95a6ec773a24c168ac90aeb764f047f94e7559fc6a0905ee62f42a0e0a6c6b8d9cf6cd931291fdae30843cc0b925cbf50
SSDEEP 384:D+aQikB+z/xvxjg/qhEwNBSuAJcDz91WHAVdp8R9zW:i/UxvxjgC+ZI1WHUoFW
TLSH
T1F4729F36D465AE23A8F7E7457A4E678BCAB8406255C16DE48DED6F0D03C72DD0342C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a4334.TMP

Path C:\Users\Admin\AppData\Local\LingoPlayer\WebView2\EBWebView\Local State~RFe5a4334.TMP
Size 1KB
SHA256 71a7c902fddea50a7b3eb9da5f09b6bcf4b319b476c8f57597d589cc095e3a2d
MD5 afbd3ec4bff95e3938706a371991df72
SHA1 7edd7bb25f9fe325190c95160f6729c1d1c3492f
SHA512 38b80d0e18387a5d1ace3c229a6ef29c67f2f3f8ce31497e86a3b376c222ac00621a7c831492bf932a35e623a30a94e1501cdb3162dc33cadec5432ed66fa654
TLSH
T1482165B3E4B81B739CE6630A724A7B178E29506BD1015F1096DE5A2C02F714DD7ABC36
MD5 SHA1 SHA512 TLSH

Submit Download

LingoPlayer-Windows.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1E8RIEK0Z0.tmp\LingoPlayer-Windows.tmp
Size 4.2MB
SHA256 24a428ecb348c8aa866cf2ba984da59f1ce28fcbace77c40e274d65c6739c175
MD5 bce678f0714ea63833546de994d6d22c
SHA1 b50bc2af85f336ac90e8ae52ba6c5553aefed721
SHA512 f1f9c16caf709dc8b9dd101bf8cf7e35bf6382335121c05732b183557ad0c61f42fb80b2ad334aae2b32d139048565688f66e201300ac01ede704a8e91da538a
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Pp:7xuHjWfZIzep
TLSH
T16F268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-310-0x0000016BC1B20000-0x0000016BC1BC9000-memory.dmp

Download

memory/1008-233-0x00007FFFB69F0000-0x00007FFFB69F1000-memory.dmp

Download

memory/1008-358-0x0000016BC1B20000-0x0000016BC1BC9000-memory.dmp

Download

memory/1008-323-0x0000016BC1B20000-0x0000016BC1BC9000-memory.dmp

Download

memory/1008-295-0x0000016BC1B20000-0x0000016BC1BC9000-memory.dmp

Download

memory/1904-361-0x00007FFFB7220000-0x00007FFFB7221000-memory.dmp

Download

memory/1904-362-0x00007FFFB78A0000-0x00007FFFB78A1000-memory.dmp

Download

memory/3352-118-0x0000000000DA0000-0x0000000000E89000-memory.dmp

Download

memory/3352-8-0x0000000000DA0000-0x0000000000E89000-memory.dmp

Download

memory/3352-1-0x0000000000DA0000-0x0000000000E89000-memory.dmp

Download

memory/4648-115-0x0000013F72E40000-0x0000013F73721000-memory.dmp

Download

memory/4648-119-0x00007FFF924B0000-0x00007FFF945B8000-memory.dmp

Download

memory/4648-113-0x0000013F72E40000-0x0000013F73721000-memory.dmp

Download

memory/4648-121-0x0000013F72D80000-0x0000013F72E00000-memory.dmp

Download

memory/4648-112-0x0000013F72D30000-0x0000013F72D31000-memory.dmp

Download

memory/4648-122-0x0000013F72D80000-0x0000013F72E00000-memory.dmp

Download

memory/4648-114-0x0000013F72E40000-0x0000013F73721000-memory.dmp

Download

memory/4648-116-0x0000013F72D40000-0x0000013F72D41000-memory.dmp

Download

memory/4808-294-0x0000020D4A440000-0x0000020D4A4E9000-memory.dmp

Download

memory/4808-309-0x0000020D4A440000-0x0000020D4A4E9000-memory.dmp

Download

memory/4808-154-0x00007FFFB69F0000-0x00007FFFB69F1000-memory.dmp

Download

memory/5736-107-0x0000000000D70000-0x00000000011BB000-memory.dmp

Download

memory/5736-110-0x0000000000D70000-0x00000000011BB000-memory.dmp

Download

memory/5736-9-0x0000000000D70000-0x00000000011BB000-memory.dmp

Download

memory/5736-6-0x0000000001990000-0x0000000001991000-memory.dmp

Download

memory/5736-12-0x0000000000D70000-0x00000000011BB000-memory.dmp

Download

memory/5736-10-0x0000000001990000-0x0000000001991000-memory.dmp

Download