hxxps://www[.]ldplayer[.]net/games/devastate-on-pc[.]html

Analysis

user interaction
yes
max time kernel
899s
max time network
898s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.ldplayer.net/games/devastate-on-pc.html
Sample260929-asc4wsys4j

Score

8^/10

adware discovery execution exploit persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 4 IoCs

flow	pid	Process
97	792	LDPlayer9_ens_2026-06-16_3040_ld.exe
48	4392	chrome.exe
95	792	LDPlayer9_ens_2026-06-16_3040_ld.exe
96	792	LDPlayer9_ens_2026-06-16_3040_ld.exe

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2009\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000\FuncName = "WVTAsn1SpcSpAgencyInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2223\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.30\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2003\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPCreateIndirectData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubCheckCert"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223\FuncName = "WVTAsn1CatMemberInfo2Encode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{DE351A42-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$Function = "SoftpubLoadMessage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubAuthenticode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverFinalPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2221\FuncName = "WVTAsn1CatNameValueDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverFinalPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26\FuncName = "WVTAsn1SpcMinimalCriteriaInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.27\FuncName = "WVTAsn1SpcFinancialCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2130\Dll = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.1\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "HTTPSCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2008\FuncName = "WVTAsn1SpcLinkDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{189A3842-3041-11D1-85E1-00C04FC295EE}\$Function = "SoftpubDefCertInit"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{189A3842-3041-11D1-85E1-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.5.5.7.3.2\CallbackAllocFunction = "SoftpubLoadDefUsageCallData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCertPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$Function = "SoftpubCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2002\FuncName = "WVTAsn1SpcFinancialCriteriaInfoEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "SoftpubInitialize"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2011\FuncName = "WVTAsn1SealingSignatureAttributeEncode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15\FuncName = "WVTAsn1SpcPeImageDataDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2007\FuncName = "WVTAsn1SpcSpOpusInfoDecode"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$Function = "WintrustCertificateTrust"	regsvr32.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
4996	icacls.exe
5156	takeown.exe
3752	icacls.exe
2848	takeown.exe
5472	icacls.exe
3264	takeown.exe
4300	icacls.exe
1096	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 15 IoCs

pid	Process
792	LDPlayer9_ens_2026-06-16_3040_ld.exe
4736	LDPlayer_0900053700.exe
2768	dnrepairer.exe
616	Ld9BoxSVC.exe
2108	driverconfig.exe
5408	dnplayer.exe
1144	Ld9BoxSVC.exe
4732	vbox-img.exe
696	vbox-img.exe
1308	vbox-img.exe
5488	Ld9BoxHeadless.exe
1368	Ld9BoxHeadless.exe
4040	Ld9BoxHeadless.exe
4012	Ld9BoxHeadless.exe
3300	Ld9BoxHeadless.exe

Loads dropped DLL 64 IoCs

pid	Process
2768	dnrepairer.exe
2768	dnrepairer.exe
2768	dnrepairer.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
616	Ld9BoxSVC.exe
5408	regsvr32.exe
5408	regsvr32.exe
5408	regsvr32.exe
5408	regsvr32.exe
5408	regsvr32.exe
5408	regsvr32.exe
5408	regsvr32.exe
5408	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1472	regsvr32.exe
1120	regsvr32.exe
1120	regsvr32.exe
1120	regsvr32.exe
1120	regsvr32.exe
1120	regsvr32.exe
1120	regsvr32.exe
1120	regsvr32.exe
1120	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
2108	driverconfig.exe
2108	driverconfig.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe
5408	dnplayer.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4996	icacls.exe
5156	takeown.exe
3752	icacls.exe
2848	takeown.exe
5472	icacls.exe
3264	takeown.exe
4300	icacls.exe
1096	takeown.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:\	LDPlayer9_ens_2026-06-16_3040_ld.exe
File opened (read-only)	\??\F:	LDPlayer_0900053700.exe
	\??\f:\	LDPlayer_0900053700.exe
	\??\F:\	takeown.exe
File opened (read-only)	\??\F:	takeown.exe
File opened (read-only)	\??\F:\	LDPlayer_0900053700.exe
	\??\f:\	LDPlayer9_ens_2026-06-16_3040_ld.exe
File opened (read-only)	\??\F:	takeown.exe
	\??\F:\	takeown.exe
	\??\F:\	LDPlayer9_ens_2026-06-16_3040_ld.exe
File opened (read-only)	\??\F:	LDPlayer9_ens_2026-06-16_3040_ld.exe
File opened (read-only)	\??\F:	takeown.exe
	\??\F:\	LDPlayer_0900053700.exe
	\??\F:\	takeown.exe
	\??\F:\	dnplayer.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4552	powercfg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-sysinfo-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SDL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxCpuReport.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPLoggerCtl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxBalloonCtrl.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-debug-l1-1-0.dll	dnrepairer.exe
File opened for modification	C:\Program Files\ldplayer9box\msvcp140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_V2_utils2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.interposer.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcp120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-libraryloader-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-private-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ucrtbase.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf-PreW10.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\load.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qminimal.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxTestOGL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-localization-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-crt-runtime-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5Core.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxNetFltNobj.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-synch-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-util-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup.sys	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\bldRTIsoMaker.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\ossltest.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxCAPI.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxHostChannel.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSharedClipboard.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\EGL.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\GLES_CM.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstPDMAsyncCompletion.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\USBUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDD2.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-heap-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\host_manager.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\spirv-cross-c-shared.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\libssl-1_1-x64.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxRes.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-crt-conio-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\libcrypto-1_1.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\nvngx_vsr.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxNetLwf.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSVC.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\NetFltUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\tstSSLCertDownloads.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxSDL.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\api-ms-win-core-file-l1-2-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcp140.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-processthreads-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\comregister.cmd	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\UICommon.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\platforms\qoffscreen.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Qt5WinExtras.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\ossltest.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\VBoxRT-x86.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\shaderc_shared.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\VBoxDD.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\x86\msvcr120.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\api-ms-win-core-memory-l1-1-0.dll	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\Ld9BoxSup-PreW10.cat	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\SUPUninstall.exe	dnrepairer.exe
File created	C:\Program Files\ldplayer9box\sl.dlss_g.dll	dnrepairer.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1473069934\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1387941201\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_172379341\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1297544917\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1913626422\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_651050488\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_626935624\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1617964508\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1297544917\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_745509016\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1387941201\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1387941201\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1297544917\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_235531432\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1347472757\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1387941201\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1347472757\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_172379341\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_235531432\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1668297784\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1297544917\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_745509016\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1913626422\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1617964508\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_235531432\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_235531432\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_626935624\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_745509016\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1913626422\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1722401982\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1722401982\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1722401982\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1297544917\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_745509016\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_287060239\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_626935624\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1387941201\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1722401982\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1297544917\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1913626422\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_651050488\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1668297784\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_287060239\manifest.json	msedge.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
624	sc.exe
2560	sc.exe
2052	sc.exe
3960	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LDPlayer_0900053700.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Ld9BoxSVC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Ld9BoxSVC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LDPlayer9_ens_2026-06-16_3040_ld.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LDPlayer9_ens_2026-06-16_3040_ld.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LDPlayer_0900053700.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_2026-06-16_3040_ld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer_0900053700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnrepairer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	chrome.exe
1784	msedge.exe
6892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dnplayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dnplayer.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5292	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ldnews.exe = "11001"	dnplayer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\dnplayer.exe = "11001"	dnplayer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E4B1-486A-8F2E-747AE346C3E9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CB8D-4382-90BA-B7DA78A74573}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-799A-4489-86CD-FE8E45B2FF8E}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E4B1-486A-8F2E-747AE346C3E9}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-1207-4179-94CF-CA250036308F}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E87-11E9-8AF2-576E84223953}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4BA3-7903-2AA4-43988BA11554}\TypeLib	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-416b-4181-8c4a-45ec95177aef}	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-6E0B-492A-A8D0-968472A94DC7}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1F8B-4692-ABB4-462429FAE5E9}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-26F1-4EDB-8DD2-6BDDD0912368}\NumMethods\ = "16"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-FEBE-4049-B476-1292A8E45B09}\ProxyStubClsid32	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-73A5-46CC-8227-93FE57D006A6}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4A9B-1727-BEE2-5585105B9EED}\NumMethods\ = "61"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-F1F8-4590-941A-CDB66075C5BF}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-1C58-440C-BB7B-3A1397284C7B}\ = "IStorageControllerChangedEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-C9D6-4742-957C-A6FD52E8C4AE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E9BB-49B3-BFC7-C5171E93EF38}\ = "IGuestProcessIOEvent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7556-4CBC-8C04-043096B02D82}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-00B1-4E9D-0000-11FA00F9D583}\NumMethods\ = "13"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D612-47D3-89D4-DB3992533948}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CF37-453B-9289-3B0F521CAF27}\NumMethods\ = "13"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7E72-4F34-B8F6-682785620C57}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-34B8-42D3-ACFB-7E96DAF77C22}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3346-49D6-8F1C-41B0C4784FF2}\NumMethods	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-58D9-43AE-8B03-C1FD7088EF15}\ = "IDataStream"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E621-4F70-A77E-15F0E3C714D5}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-81A9-4005-9D52-FC45A78BF3F5}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-93AF-42A7-7F13-79AD6EF1A18D}\NumMethods\ = "45"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-26F1-4EDB-8DD2-6BDDD0912368}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-23D0-430A-A7FF-7ED7F05534BC}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-08A2-41AF-A05F-D7C661ABAEBE}\ = "IVRDEServer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4BA3-7903-2AA4-43988BA11554}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7193-426C-A41F-522E8F537FA0}\ = "IUnattended"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-7E72-4F34-B8F6-682785620C57}\ = "IExtPackFile"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-CC87-4F6E-A0E9-47BB7F2D4BE5}\NumMethods\ = "28"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-61D9-4940-A084-E6BB29AF3D83}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20191216-47b9-4a1e-82b2-07ccd5323c3f}\ProgId	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-AEDF-461C-BE2C-99E91BDAD8A1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-C9D6-4742-957C-A6FD52E8C4AE}\ = "IBandwidthControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E9BB-49B3-BFC7-C5171E93EF38}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-8690-11E9-B83D-5719E53CF1DE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4430-499F-92C8-8BED814A567A}\ = "IGuestProcessStateChangedEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-30E8-447E-99CB-E31BECAE6AE4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-799A-4489-86CD-FE8E45B2FF8E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-2F05-4D28-855F-488F96BAD2B2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-34B8-42D3-ACFB-7E96DAF77C22}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-0002-4b81-0077-1dcb004571ba}	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-E254-4E5B-A1F2-011CF991C38D}\ProxyStubClsid32\ = "{20191216-1807-4249-5BA5-EA42D66AF0BF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-30E8-447E-99CB-E31BECAE6AE4}\NumMethods\ = "48"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-0C65-11EA-AD23-0FF257C71A7F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4289-EF4E-8E6A-E5B07816B631}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-762E-4120-871C-A2014234A607}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-D8ED-44CF-85AC-C83A26C95A4D}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-7193-426C-A41F-522E8F537FA0}\ProxyStubClsid32	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-3E78-11E9-B25E-7768F80C0E07}\TypeLib\ = "{20191216-1750-46f0-936e-bd127d5bc264}"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-4022-DC80-5535-6FB116815604}\TypeLib\Version = "1.3"	Ld9BoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4974-A19C-4DC6-CC98C2269626}\NumMethods\ = "24"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-4BA3-7903-2AA4-43988BA11554}\ = "IDnDTarget"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-D8ED-44CF-85AC-C83A26C95A4D}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20191216-26c0-4fe1-bf6f-67f633265bba}\VersionIndependentProgID	Ld9BoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20191216-08A7-4C8F-910D-47AABD67253A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-E9BB-49B3-BFC7-C5171E93EF38}\ = "IGuestProcessIOEvent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20191216-DAD4-4496-85CF-3F76BCB3B5FA}\NumMethods	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
2364	chrome.exe
2364	chrome.exe
2768	dnrepairer.exe
2768	dnrepairer.exe
4736	LDPlayer_0900053700.exe
4736	LDPlayer_0900053700.exe
3620	msedge.exe
3620	msedge.exe
5500	msedge.exe
5500	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5408	dnplayer.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
5408	dnplayer.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
5408	dnplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 3480	4228	chrome.exe	88
PID 4228 wrote to memory of 1548	4228	chrome.exe	90
PID 4228 wrote to memory of 1548	4228	chrome.exe	90
PID 4228 wrote to memory of 4392	4228	chrome.exe	91
PID 4228 wrote to memory of 4464	4228	chrome.exe	93
PID 4228 wrote to memory of 4464	4228	chrome.exe	93
PID 4228 wrote to memory of 5900	4228	chrome.exe	95
PID 4228 wrote to memory of 4888	4228	chrome.exe	94
PID 4228 wrote to memory of 5900	4228	chrome.exe	95
PID 4228 wrote to memory of 4888	4228	chrome.exe	94
PID 4228 wrote to memory of 4076	4228	chrome.exe	96
PID 4228 wrote to memory of 4076	4228	chrome.exe	96
PID 4228 wrote to memory of 1328	4228	chrome.exe	97
PID 4228 wrote to memory of 5348	4228	chrome.exe	98
PID 4228 wrote to memory of 4168	4228	chrome.exe	100
PID 4228 wrote to memory of 4168	4228	chrome.exe	100
PID 4228 wrote to memory of 4376	4228	chrome.exe	101
PID 4228 wrote to memory of 4376	4228	chrome.exe	101
PID 4228 wrote to memory of 792	4228	chrome.exe	104
PID 4228 wrote to memory of 2700	4228	chrome.exe	105
PID 4228 wrote to memory of 5948	4228	chrome.exe	106
PID 4228 wrote to memory of 2700	4228	chrome.exe	105
PID 4228 wrote to memory of 5948	4228	chrome.exe	106
PID 4228 wrote to memory of 4948	4228	chrome.exe	107
PID 4228 wrote to memory of 4948	4228	chrome.exe	107
PID 4228 wrote to memory of 3372	4228	chrome.exe	108
PID 4228 wrote to memory of 3372	4228	chrome.exe	108
PID 4228 wrote to memory of 4756	4228	chrome.exe	110
PID 4228 wrote to memory of 1140	4228	chrome.exe	109
PID 4228 wrote to memory of 4756	4228	chrome.exe	110
PID 4228 wrote to memory of 1140	4228	chrome.exe	109
PID 4228 wrote to memory of 3416	4228	chrome.exe	139
PID 4228 wrote to memory of 5156	4228	chrome.exe	136
PID 4228 wrote to memory of 2000	4228	chrome.exe	113
PID 792 wrote to memory of 4736	792	LDPlayer9_ens_2026-06-16_3040_ld.exe	115
PID 4736 wrote to memory of 2768	4736	LDPlayer_0900053700.exe	116
PID 2768 wrote to memory of 2160	2768	dnrepairer.exe	117
PID 2160 wrote to memory of 1584	2160	net.exe	119
PID 2768 wrote to memory of 6000	2768	dnrepairer.exe	120
PID 2768 wrote to memory of 1784	2768	dnrepairer.exe	121
PID 2768 wrote to memory of 456	2768	dnrepairer.exe	122
PID 2768 wrote to memory of 2492	2768	dnrepairer.exe	123
PID 2768 wrote to memory of 5004	2768	dnrepairer.exe	124
PID 2768 wrote to memory of 4628	2768	dnrepairer.exe	125
PID 2768 wrote to memory of 5828	2768	dnrepairer.exe	126
PID 4228 wrote to memory of 2364	4228	chrome.exe	127
PID 2768 wrote to memory of 3264	2768	dnrepairer.exe	128
PID 2768 wrote to memory of 4300	2768	dnrepairer.exe	130
PID 2768 wrote to memory of 1096	2768	dnrepairer.exe	132
PID 2768 wrote to memory of 4996	2768	dnrepairer.exe	134
PID 2768 wrote to memory of 5156	2768	dnrepairer.exe	136
PID 2768 wrote to memory of 3752	2768	dnrepairer.exe	138
PID 2768 wrote to memory of 616	2768	dnrepairer.exe	140
PID 2768 wrote to memory of 5408	2768	dnrepairer.exe	141
PID 2768 wrote to memory of 1472	2768	dnrepairer.exe	142
PID 2768 wrote to memory of 1120	2768	dnrepairer.exe	143
PID 2768 wrote to memory of 4780	2768	dnrepairer.exe	144
PID 2768 wrote to memory of 624	2768	dnrepairer.exe	145
PID 2768 wrote to memory of 2560	2768	dnrepairer.exe	147
PID 4736 wrote to memory of 2108	4736	LDPlayer_0900053700.exe	149
PID 4736 wrote to memory of 4552	4736	LDPlayer_0900053700.exe	150
PID 4736 wrote to memory of 2848	4736	LDPlayer_0900053700.exe	151
PID 4736 wrote to memory of 5472	4736	LDPlayer_0900053700.exe	155
PID 792 wrote to memory of 5408	792	LDPlayer9_ens_2026-06-16_3040_ld.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.ldplayer.net/games/devastate-on-pc.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc0eedc728,0x7ffc0eedc734,0x7ffc0eedc740
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,1145230747200107286,2308725659396392362,262144 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,345624287508721200,16487197275730521625,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,5363190843993503865,11964530213270891233,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,18142498542190176338,15301777797686831236,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,10977206754443095540,9391789296252140801,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4744,i,9815721026498097961,1053766267703556702,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3400,i,10003260000328550473,17368445567519430286,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,14852068714612497130,3714441006245416549,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4676,i,3804860542077758511,703769059600615914,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5956,i,16671520885234548080,2010387308394663825,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4376
- C:\Users\Admin\Downloads\LDPlayer9_ens_2026-06-16_3040_ld.exe
  "C:\Users\Admin\Downloads\LDPlayer9_ens_2026-06-16_3040_ld.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:792
- - F:\LDPlayer\LDPlayer9\LDPlayer_0900053700.exe
    "F:\LDPlayer\LDPlayer9\\LDPlayer_0900053700.exe" -silence -downloader -openid=3040 -language=en -path="F:\LDPlayer\LDPlayer9\"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - F:\LDPlayer\LDPlayer9\dnrepairer.exe
      "F:\LDPlayer\LDPlayer9\dnrepairer.exe" cmd=install|listener=786988
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Windows\SysWOW64\net.exe
        
        "net" start cryptsvc
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2160
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start cryptsvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1584
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" Softpub.dll /s
        5⤵
        Manipulates Digital Signatures
        System Location Discovery: System Language Discovery
        
        PID:6000
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" Wintrust.dll /s
        5⤵
        Manipulates Digital Signatures
        System Location Discovery: System Language Discovery
        
        PID:1784
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" Initpki.dll /s
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:456
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32" Initpki.dll /s
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" dssenh.dll /s
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" rsaenh.dll /s
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" cryptdlg.dll /s
        5⤵
        Manipulates Digital Signatures
        System Location Discovery: System Language Discovery
        
        PID:5828
    - - C:\Windows\SysWOW64\takeown.exe
        
        "takeown" /f "F:\LDPlayer\LDPlayer9\vms" /r /d y
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:3264
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls" "F:\LDPlayer\LDPlayer9\vms" /grant everyone:F /t
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:4300
    - - C:\Windows\SysWOW64\takeown.exe
        
        "takeown" /f "F:\LDPlayer\LDPlayer9\\system.vmdk"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        
        PID:1096
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls" "F:\LDPlayer\LDPlayer9\\system.vmdk" /grant everyone:F /t
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:4996
    - - C:\Windows\SysWOW64\takeown.exe
        
        "takeown" /f "C:\Users\Admin\.Ld9VirtualBox" /r /d y
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:5156
    - - C:\Windows\SysWOW64\icacls.exe
        
        "icacls" "C:\Users\Admin\.Ld9VirtualBox" /grant everyone:F /t
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3752
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3416
    - - C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
        
        "C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" /RegServer
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:616
    - - C:\Windows\SYSTEM32\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\VBoxC.dll" /s
        5⤵
        Loads dropped DLL
        
        PID:5408
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxClient-x86.dll" /s
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1472
    - - C:\Windows\SYSTEM32\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\VBoxProxyStub.dll" /s
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1120
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32" "C:\Program Files\ldplayer9box\x86\VBoxProxyStub-x86.dll" /s
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4780
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\system32\sc" create Ld9BoxSup binPath= "C:\Program Files\ldplayer9box\Ld9BoxSup.sys" type= kernel start= auto
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:624
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\system32\sc" start Ld9BoxSup
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2560
  - - F:\LDPlayer\LDPlayer9\driverconfig.exe
      "F:\LDPlayer\LDPlayer9\driverconfig.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2108
  - - C:\Windows\SysWOW64\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /powerthrottling disable /path "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe"
      4⤵
      Power Settings
      PID:4552
  - - C:\Windows\SysWOW64\takeown.exe
      "takeown" /f F:\LDPlayer\ldmutiplayer\ /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:2848
  - - C:\Windows\SysWOW64\icacls.exe
      "icacls" F:\LDPlayer\ldmutiplayer\ /grant everyone:F /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5472
- - F:\LDPlayer\LDPlayer9\dnplayer.exe
    "F:\LDPlayer\LDPlayer9\dnplayer.exe" downloadpackage=2026-06-16|package=2026-06-16
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5408
  - - C:\Windows\SysWOW64\sc.exe
      sc query HvHost
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2052
  - - C:\Windows\SysWOW64\sc.exe
      sc query vmms
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3960
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c systeminfo
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3856
    - - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        5⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:5292
  - - C:\Program Files\ldplayer9box\vbox-img.exe
      "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "F:\LDPlayer\LDPlayer9\vms\..\system.vmdk" --uuid 20160302-bbbb-bbbb-54d7-bbbb00000000
      4⤵
      Executes dropped EXE
      PID:4732
  - - C:\Program Files\ldplayer9box\vbox-img.exe
      "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "F:\LDPlayer\LDPlayer9\vms\leidian0\data.vmdk" --uuid 20160302-cccc-cccc-54d7-000000000000
      4⤵
      Executes dropped EXE
      PID:696
  - - C:\Program Files\ldplayer9box\vbox-img.exe
      "C:\Program Files\ldplayer9box\vbox-img.exe" setuuid --filename "F:\LDPlayer\LDPlayer9\vms\leidian0\sdcard.vmdk" --uuid 20160302-dddd-dddd-54d7-000000000000
      4⤵
      Executes dropped EXE
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.ldplayer.net/blog/how-to-enable-vt.html
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x320,0x7ffc0bd0c188,0x7ffc0bd0c194,0x7ffc0bd0c1a0
        5⤵
        
        PID:3460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,14422259435850881525,3595251579622340746,262144 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
        5⤵
        
        PID:2372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,9104969196740124581,6891256216278841915,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,5373481569064337068,13725203781885951641,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
        5⤵
        
        PID:1004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,7324639339837552593,8733138675179506712,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        5⤵
        
        PID:1300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,7666537018502107995,2737475089642439511,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,15047487350927800411,16526567199485191495,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,11281032022631019592,16586959216829872374,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
        5⤵
        
        PID:1236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,10592659755949529341,1846597433732389589,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
        5⤵
        
        PID:3980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3740,i,2907337662500766503,1452063706741204924,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
        5⤵
        
        PID:2856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,5765511080133625776,15938983327340197024,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8768441179717329143,10857813245506233944,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
        5⤵
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,669165262599416319,6466973618816134744,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
        5⤵
        
        PID:3508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,669165262599416319,6466973618816134744,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
        5⤵
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6928,i,2506292133900475131,13073763741124903785,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
        5⤵
        
        PID:1148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6956,i,17847091932183092166,11642866497278489377,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7164,i,13653514832554041280,17186537123072008312,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
        5⤵
        
        PID:4504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7328,i,6307931466778364313,1927795417317326267,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
        5⤵
        
        PID:1576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7348,i,12235843302546485484,14737530876529866191,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
        5⤵
        
        PID:2192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7628,i,6868314620327582808,4051417424806021040,2097152 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
        5⤵
        
        PID:4372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7864,i,16264545896175422733,3339713486924889637,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:14
        5⤵
        
        PID:6264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,6624382197297168999,8415387833106332246,524288 --field-trial-handle=2044,i,4889617291086007554,8028456603256114977,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
        5⤵
        
        PID:6552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2bc,0x7ffc0bd0c188,0x7ffc0bd0c194,0x7ffc0bd0c1a0
        6⤵
        
        PID:4624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2096,i,8036025380749808086,15111963955062057152,262144 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
        6⤵
        
        PID:6896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,12004066282406426450,2331594406826381753,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:6892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,3349513223917270872,17600758162159067319,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13
        6⤵
        
        PID:6520
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,14997917991141952138,13880150965543778766,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
        6⤵
        
        PID:6232
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,14997917991141952138,13880150965543778766,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
        6⤵
        
        PID:6272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,888818484056627634,6963162704599915696,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=1252 /prefetch:14
        6⤵
        
        PID:1312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,12216874221326448093,793061976255519625,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
        6⤵
        
        PID:5944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,2848609556303711147,14826066812120597692,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
        6⤵
        
        PID:3700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,3006281182054264430,1904718751563748992,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:14
        6⤵
        
        PID:6436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,7385167705318949952,820625670827701572,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
        6⤵
        
        PID:6560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,3722022711901866814,3390249558292307201,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        6⤵
        
        PID:6264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,580962639230751988,17188868875587297836,262144 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,733162140000388997,606773638035219389,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:14
        6⤵
        
        PID:2872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,6288684333720588375,1098646717600324023,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
        6⤵
        
        PID:4456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,10585602432173983738,6662017692196277349,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
        6⤵
        
        PID:1076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4040,i,2968278607439091482,6625634448567379187,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        6⤵
        
        PID:1168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,12276739143613992126,6497959393158920972,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
        6⤵
        
        PID:3516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,14457558821526258748,4633866771829900191,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
        6⤵
        
        PID:6352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,925596713411466973,13593336529500313185,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
        6⤵
        
        PID:5500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,7974978370129123806,16359816256336658702,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
        6⤵
        
        PID:3292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,17267461277621749974,2154621375515883066,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
        6⤵
        
        PID:4528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,12198340953377851686,13711006738799889863,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
        6⤵
        
        PID:5888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,3565810723220725560,13355468186447464330,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
        6⤵
        
        PID:4064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4874331406166778241,17771776460049153144,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        6⤵
        
        PID:2408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,12870490447541316102,4381948955563940087,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
        6⤵
        
        PID:3988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,1949495091975625742,6883896418965767317,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
        6⤵
        
        PID:4124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,8410917684018373421,3721762120596425087,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
        6⤵
        
        PID:708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14446116599276186356,12881001738207760657,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
        6⤵
        
        PID:6048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,5555685786895580004,12547413116282675145,524288 --field-trial-handle=2508,i,11271483379812903116,16204369276847952157,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
        6⤵
        
        PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5968,i,13315875033166383687,8692478497204631318,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6440,i,5363594517787831264,14723293488665793525,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6604,i,15380596034177196207,15114688028989932296,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6032,i,1833279814229580273,11145525670190493563,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6724,i,12201902372212035365,6530555178512037026,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3376,i,944873174156536071,16902740426967562979,2097152 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1124,i,539918463454660762,7029506244669787995,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,212176386321062494,9291374097864114559,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,6417674089561248757,12243981645576812310,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4972,i,12734095427883754808,9651100550905433008,262144 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,1748473699679324107,3584900840443746608,524288 --field-trial-handle=1896,i,3143607378356830854,11844989639471575302,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:3276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3220

C:\Program Files\ldplayer9box\Ld9BoxSVC.exe
"C:\Program Files\ldplayer9box\Ld9BoxSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
PID:1144
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe
  "C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe" --comment leidian0 --startvm 20160302-aaaa-aaaa-54d7-000000000000 --vrde config
  2⤵
  - Executes dropped EXE
  PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1928

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 8a28345844163cdb8cd124dea94dac6871bcce0dc0bdc17d8c72879d6d9e65cd
MD5 9e876c38eb54c78f689fbff2daf6f450
SHA1 84e915c8217c23e9de249660b4b838e015d2e089
SHA512 3a1b26ff10b2834ab5bb65db4a429a874d27f2e0a649eadd5fa3e4939e7c844c170e8cb04aa4816e9fef8538e0b1368326b57a8ce9a673d5eef2e550debacf53
TLSH
T196F0DC4118B124B65E050F84BDF10B3C3028652EFDF68069BD9E0AC7976A7642B49894
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 471B
SHA256 a44f7b4a49344e0b46d863f3b761cb2e8299b28ccbab3db99a4661be6cf51d33
MD5 6191bd051922eec2544cefc966b0ee9a
SHA1 4babfba6cb588da5d8ce359e1b2e61d2f41513c1
SHA512 2283f6fe7b9d74af6583fe52dd09c9f37ce904165c82a3170fea8a1967ed511f006b52283a60fa3f7fe17e8eaf7ba276377f069061bc2946c70da12a976a449b
TLSH
T128F0DC134B39B1F17B4248CE51D8C63D7131E2BA00E2C686B42C49B552E72FA8869879
MD5 SHA1 SHA512 TLSH

Submit Download

F634406855CF2C9907455518D4F0AB3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F634406855CF2C9907455518D4F0AB3E
Size 471B
SHA256 478453ac71793af72687c20c2ed8d2f445d5cc7da8c65f891e41f5d555d5cc13
MD5 ea9beabfa9e6d16b2dc3eb20f30fd4c5
SHA1 51643186471815e43683aff3d155180de6909c58
SHA512 aa82dd24af4b6e0dfbd4de3246e88cd1cd97a970aaa7d1f0bdd03a8470ab04cd4d2e730b7d3462207b564d26125031b048f6e789a5c8f2084ce93981dafd040e
TLSH
T142F0D4800575D000AE3D95902CFD65B0FC7572480CDC801DD07C52E2F809BEE484DC68
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 d2ea8a9813160a5541dcad0b5c2dbb0529f94cab475baa0343240b8fc786557e
MD5 24bb01a9afd60417397173018d864cb7
SHA1 67cb4c2e05971efbb6886f67e33afbdca1b2dc96
SHA512 af56e7de2c86e4d2f51911837938356841aecd5187ef3b483ffcccb6fe264af035ec249a303cfc32f8f004199bd4c332535502fa4715290a688d0c4fa3510c3b
TLSH
T137E0203459FA527CF1B1EA741BC65961446BF1016D14D3A95BD44709FB07500DD71C35
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_F24AE254AC712022CD7275ECC89876F9
Size 416B
SHA256 b5ed09cee694756a3ab9c22564b15c2c5f14a2c5321374ed443398154bd91797
MD5 9bfd251833f4c44d79e89ff7273d4a5b
SHA1 83d89ad933e50ffa86196cc6c99a1111c87b5c12
SHA512 36e1e68e086ec7d1a44b51812a7e7d8df67d015fad6a8fd96e77e372d93ea117647032377bdc487d234f97de1a59144197914ecc72ff58e0d9333d2d93f1ef37
TLSH
T153E0203815FA413CF1E4D8344FC57521599EF2260555F2751BC45B48FA06A00BD16E35
MD5 SHA1 SHA512 TLSH

Submit Download

F634406855CF2C9907455518D4F0AB3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F634406855CF2C9907455518D4F0AB3E
Size 412B
SHA256 94a030a2cf4af8419801f3a4c45c466425d3941c5c794993f8369b44b1763758
MD5 c062ff19b79dd1b017c9d90bb5e5af14
SHA1 4a366ca004eb0ff1c2db504da71bd05995c8a983
SHA512 16d0bc92846fc1e6793989af4e2582dbb890ca4e535f151ca0bedfc62a48db8e2e948a581bf53e1de9f2f9be5d7d9b13de3a9d92828b3469f7f5088b593aab7b
TLSH
T1F8E0C01C21FA011CF550E570C6CE56B189A5F3371D00673539C04307F7055825D21A31
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0d2e842205db031cbad2deb128ec2d6ed1d090b5e4d7c5bcc4a5f3a3a9b2c595
MD5 9eceddf52fd250bc9e1161eb7d175dfc
SHA1 74324e62f9f35e27dfa7793d20b7938a0f378af2
SHA512 67dee0809afdb9091b0a1e841047dd56c018977a0f0a0c76496b1d4876914589840be39865203e8ab23c78fab5458c2bdb08ed3c570c9b444a484f1224a5b8e7
TLSH
T1BB41EA526489B931DB6E49F390D019DBFD70A22783271E6268E60EF0BEF63B5D050613
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 a7a6fdf62fd276c18d47a94c3cf7779698dc1dcdbb86f0a052eee01e789c860e
MD5 ee1aca664b131ede5561f462509d1854
SHA1 8d00bb1a1a0d2b33d3d69f2c2edfccc642a95605
SHA512 f6bc902bfa2876130cae1b7febd1b358a2a6d4e46ab1c59c4885ae0aea1da5310b9dcc95f40846b3985db2904fbfbcf11030242834cd3fe5a522458241925769
SSDEEP 192:D7YeV/geJceo4fHh3RBkqkOA7xpD52x0xo8RznFYRJBxKRRRnCxjKHsORglKK:D7YeV/gGceo4fHh3RBkqkOA7xpD52x0U
TLSH
T10222BDF7C3E8CA6DCD6152F1EA156F1BCE190A14425C3C6AC9D4AE4B93E6874F140A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a036ef7c4582cc527a867e2314f9ea03dabcb977d6be8615db3f04b7815b510e
MD5 1b40fb2ee17afae874e24c316df9c1ea
SHA1 8ece21d29252ae1fe89a939338aa0f2d45d21d34
SHA512 9e90d0b19e03b9223120b3caada49a8130f537f07c2fe42dea38c151c1a0a947225db17dcb737de021cbd223f76710006f12744661de00f6045d1118469e96cb
SSDEEP 192:D7YeV/geJceoHh3RBkqkOA7xpD52x0xo8RznFYRJBxKRRRnCxjKHOHORR:D7YeV/gGceoHh3RBkqkOA7xpD52x0xoc
TLSH
T1F912ADF7C3E8CA6D8D6152F1EA156F1FCE190A14425C3C6AC9D4AE4B93E68B4F140A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7b25c60662f810fc6b5971ade3b433391a1b50c48b6119fc8421876242426b8f
MD5 4219ebe3bbd447ae3ef0a4be036bc7f9
SHA1 9f01dc5a2046ea4ceec86a82c8a8da7ed44ce276
SHA512 22d9709623c690ec10315ea279b9c1d34e8e7e0c59cf6642887a9013d7c206dd46b164dc3a5f71203704121c7348dc5b6d514b41fc0851710cb0c34add3661ca
SSDEEP 192:DppxIORTJTem2fHh3RBkqkOACxCD5cx0xo8Rzn/YRJGxKRRRI4xqsHsORglIK:DppxIORlTem2fHh3RBkqkOACxCD5cx0h
TLSH
T11302BEF793E48A6E8E6152F1EA052F1FCE190914435C7C7AC9D0AE5B93E68B4F100A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 aa83199cc0f178b196482442b9d909704464eca78711f5f7c66b9a7140aeeac7
MD5 d00bc0aa79ebbefb7bf2b2d59a62b2d5
SHA1 37ce8ef1d70967c4980ce93faede01802e723ecb
SHA512 047fdcf8a696f24e570069e48c1c4559b38cbf437f5d9e3e82babf3dbd5cff78792a12f525422be86c4637b3dd2ed4f32701eed9ce6ebea6d04b814b63db820d
SSDEEP 192:DppxIORTJTe2wrkh3RBkqkOACxCD5cx0xo8Rzn/YRJGxKRRRI4xqsHsORmRkK:DppxIORlTe2wrkh3RBkqkOACxCD5cx0j
TLSH
T1CB029CF793E48A6E8E6152F1E6052F1FCE190914435C7C7AC9D0AE5B93E64B4F100A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f6cc9672786a2c419114c8517e7b94e18827933ba8d81d9121c5c70e04c9ed42
MD5 7d104881aed56dacacd1630550468f5b
SHA1 8398b2603bcf096ba388e3ed6a73420325a5daf1
SHA512 d0890e96e31af901645f7f87ad8d6705707e843c77e40c86e92155a62cb1bf07f6adc0d5affffcb62d59ed4bb93b691c2998bfd1a1332bb1db038f20bec16656
TLSH
T1CF317CF7C3D8967D891156F4A7196F2ACE290D18521D3C56C8E4AE1F53E18B1D61024E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ed79bc57-9b2a-4180-9066-05b4b53495f3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ed79bc57-9b2a-4180-9066-05b4b53495f3.tmp
Size 2KB
SHA256 2ec9b0283ce0056ac413f5cef53a2eb4ef9361c6f854a54a1b8f2a3944300dda
MD5 6a1f709cfdcc4c0654b5427ce76032e0
SHA1 ab7363dab821053d50b0754617757d07cfc7b79a
SHA512 d1d35dec067dd3976405c7f6f601cb784e97fcc8f5bb59d183edda725dd3b3411434ae18d091974a90532dc1ec82ef8593175b313a3cc4b0ff927bb72ef66608
TLSH
T19F51806BD6FE743B206949671D48F80659FDE8334143A8F4DA6742ACB0C75F70636493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 26908b882f1f61fe664a92042465797f7e5a3739c8d0c11b0a2e60cf7883159b
MD5 ef20c5ef3f644e34605aeb97cf7a5962
SHA1 8fc312e8871f8474afb9de4b8012b2f65bbf97e4
SHA512 7f0ad250b8cfd559c7c14f6e1f036885f52a05c91c48e0e197afb6b32301d502821fbe0a861bd76cda83571b066f4f79487aa28abbb068009aba814f4e5bb98e
SSDEEP 192:kRs2DoyOjD3v7Dv4PRpGrq9KHsb+WNnqgRpe2fvp2neIOuVyIsnAUgE:kRs2VcHCXrowt62fh2/E
TLSH
T12942A429EE14797B5CDBD26AF9667B53E3F4102220902E84EAFC8A3D25E75CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8ffaa025dac27e99be13a1b2a02d7b09633924b41f0813b2985abd2dfa032e6d
MD5 cb81ca96d2e5cf4baeda663aca62d777
SHA1 2fd84e222afb27a60ca2068db58b7cf953e4eed6
SHA512 40f3060c895a9fa768530cee2d1a391f3d1867cfe0a49d7050b45d2998d7d0f4fab77cfdb97a11bd2d18df36e3f68e93225159c19a05116d65ff8ad64ec33e26
SSDEEP 192:kRs2DoyOjD3v7DvAPRp2rq9KHsb+WNnqgRpe2f1p2neIVuVyIsnAUgR:kRs2VcH6X7owt62fP20R
TLSH
T183328229AA14647B5CDBD22AFA727757E3F5002221942E84EAFC8A3D25E75CC3227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 9d59b44ce4fb1284c9c8d2e25f00784ff25e4702a2f2cf36f15f90868e0a4fba
MD5 81192edb48a692598a1e3cf261001536
SHA1 fb7256566732cb985b00a0ad560d202c2db2a582
SHA512 9efdcff49411b61089ba59c2b731acd180f19f319fd0b12d4e3b02ad2d808ab02b8074d7171db8453ed76f86f93d2f1d23fcf094c65d31afbe0aee1bf5e13f3c
SSDEEP 192:edy4K6337KxkXqK4I40pUZNCgVLHrKHfFKslENVzXzKD/c7+ErUkKN9Fkw7v9e2l:IyjE37KxkXqKf/pUZNCgVLH2HfgslWzc
TLSH
T19A32D92B948D5E3F4FE8E51DCC126F8BACF4029672680D2852FB9D0503A57CA124A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ac12c8af4ea24898de55aeab63235795358485d551ed0162e1d3a362224d2c23
MD5 b2335b5c5a647a70cda1e276747a8cf6
SHA1 5b0a35456908d22697b6bee279e7155d8dd85ef6
SHA512 7888b4d888459c7cc5e581fe2fb1ef64908667fe637185dfea2187af82467b801b2ac90253d73800ef74f16542a1d3a59198a4c214b0d066453916b500561b07
TLSH
T15AA002548B505901D2490E72619107803751C91A2242634392D614D8FCB55D05D81501
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ddb9fcf157b8d1165f633495641ec5d1ca266c95789d29261a085a14b3d3a8a4
MD5 cadd1f5f48dce04d25a1bfffd39530f4
SHA1 b211486286fc43277daf1f5aa0d6cf8fca083ae8
SHA512 a3d04357d7feab183259fc25afbea783d809c283be29952ed215175fa7701204d345d3f51c1d9b9a27eabfb9697043751fc6e5a434b2fcd707edee34553dc774
SSDEEP 96:EbJ0d+ePqUvKD1H31Luf6NQi4DRPRnRSl8h4otop5n5DYB6fGGfvC7rCxwzk43re:Et0VPHKDFQvRPpiU2psyvSrCxPYrvNMj
TLSH
T1D5C10A71B8ADA8B31AF6A966F1063643CFF46167D550AF14DEDA4F1D02EB09C2382522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 cdb8ce510b5e635fd1ba63f106f451b1704d91da89fdf104ae94aaae4db9353e
MD5 f5f68bf4ebc40cf47efea7a96d20fe1e
SHA1 91c80136012abf4d68d08aa593a1bde817c3e37c
SHA512 9b9ff0ffa3bbc20853c450890f27624d8d8ab75be605c626d05c27a613be28e6fad49a09b940fb1e56f61678f743c7e1a279653d457a24ab63a1c6aad98353f4
SSDEEP 96:mC0d+ePqUvKD1H31Luf6NQi4DpniRDotok5nCDYB6bdGyvC74MMjb2Hv4a:mC0VPHKDFQvSDUDksUwl4MMjb2D
TLSH
T1F7A11931B8A898B759B6D986F4413A43CFB4A277E561AF44C9DD4F1C11FB0EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 940185f852d601ee966782d45b855c3feaf63f7f1a94abfe055ee45faf6258b0
MD5 52a8f173c2792b821eb458f025c90d1c
SHA1 1e9e065c64b5a9cd3afdb04fd1f640420fb02b88
SHA512 68123595a0a1ea66a94472704c11173ac822bb2e263a4b4b0b2c27acceb47cae16ea4cbccd100811be7024fd0ee4990efb42a5aa227d593f422541a6efddfee4
SSDEEP 96:EC0d+ePqUvKD1H31Luf6NQi4DRPRnRSl8h4otop5n5DYB6fGGfvC7rCxwzk43wvm:EC0VPHKDFQvRPpiU2psyvSrCxPYwvNMj
TLSH
T14CC10A71B8ADA8B31AF7A956F0063643CFF46177D560AF14DEDA4F1D02EB09C2382526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 58KB
SHA256 e7d4f8663da782715ad9abbd014cb5b780f90b35b18c048e2988b3161887d10c
MD5 e7568c11554ae678bb3eb46cf2e4f2ae
SHA1 c3e31ebfb76709dc42b1c17474de3fdaceead327
SHA512 896b6dd4699ad93aa93a7175e9eefe8bad4c717b714931bfa053e24e2f4328095b2fba253424595899dc618d5e4cfecb7a9c44cd3227d7ac9d282f66c4daeeb4
SSDEEP 1536:JWQF39dpYznpIm8VP631lBKx/TIbfT0Av2ByefPRMUMqq1:8QF3VVPy1/K5Tabjo73MqS
TLSH
T12A4302506C397593C5AE94522293FEC6EA987A531EE6AB53ACDEAF1501E30CC530302F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 6b6553a9de62388c21fb2061f7bad3c70e6e4abda5763d234246646d601e5b4a
MD5 a4a709212349bde152347b28f0476bb2
SHA1 ecdeb0b434c634b9d4b669766497e574488e4c99
SHA512 893c727fadfe747551a7fa1fa3510473bf9f15c08ef3d034a0c0e3c0db96b42a11489ab68a92f5ae8f75bb0b63a5dada4943fa9d281384dbd2a1d665b517e4cf
SSDEEP 96:EbJod+ePqUvKD1H31Luf6NQi4DRPRnRSl8h4otop5n5DYB6fGGfvC7rnBNMLRNC2:EtoVPHKDFQvRPpiU2psyvSrnBNMLu8bl
TLSH
T147C1FA70A8AD58BB5DF2B456B0033D47CEB8616BA960BE18DDE94F1C01EB0DC1382637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d7b588fb254770b0b0ec616faf8db1bc0252788278f95a268d8e177ae208c90a
MD5 79eba3ba16d4254a8327ed340840536c
SHA1 491c69731ca2bd69758983c46a5ec3f77d7d6875
SHA512 e6e08e7e53375019ca1c1edcabec9593a41c11ea57326714d141a97af25bed1875b366d11aeeeff4cfa05a1d31f86433a10c5b147224a90fce867d19598bfd0e
TLSH
T123D080155CE95FF5D02D753D42751101779C5681FB122105906015554D5D28345D1FFD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d81f7f3d17e274bdeb94befbcb8d14dbae1c924e03d74c0ac23e0036a94d2409
MD5 ceabfbe0c4c22c645e2d736d47d693e1
SHA1 9bc0c9d93dffab5e9802e8a593ffddcc22a5310b
SHA512 dfef66b54f4ec8b73d56c586bd61bca4557e0734f058489bc234227a0f38c50a80bda12d821c2e0d1d5192c6d9178959cd1c1057166c97e3841027b74c68c84c
TLSH
T181D08CA8A8E80E68D41EA97C51266202B7C8A744FD13B045E06222A92A5E3A252D12F9
MD5 SHA1 SHA512 TLSH

Submit Download

9c82be84-ab6d-4315-9f8f-75827f2f914b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c82be84-ab6d-4315-9f8f-75827f2f914b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6557fb7e0d953882d635b777aa8641d0ffcab1763e9a3d2d70b71840f9aa890f
MD5 3e1f0ec27498c14c1eda596b53711908
SHA1 a30de427ac7c8d45093e22a77f93844e9be50bcc
SHA512 e709921f71c03d95bfcca610abd9ffa82440507f30ef772fee9b0b943e0248996ffd9a03a1a366a07e0d38813fba7665421580d288a5b353e9246d1a684ae5fc
TLSH
T1A5E0208D08C5C25D6200B5474764E70CC2F0374BA3CCAB462718858A704554462D77E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 78c2b89929d9e531f49f3dcc0ffeaaa14404fd1c9d72cf225a5c10b017e07dcc
MD5 4961b8ea03dee83240f2c7a9ae512f85
SHA1 c7567d553a83cb0a7a5bb848c074771013a1a07f
SHA512 dc2db85c3f69a5fbe63f142899675ece61bc30ceb98eb9c45bc3d05bc9b00722f4a075fc23487a8459ebff41d4a83ca46a40dca9a9158157ead01cb3a92f36be
TLSH
T167E0D8CD15CFD22D5108B5874364670D82C1371AA3C8AA05170488497445950A6DF961
MD5 SHA1 SHA512 TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 191KB
SHA256 7c7229fda47c908439b5d87631fa99d1315b1684eff0fdf583151a3a3e3856dd
MD5 4daeb7b75e084c135efe31741afa3354
SHA1 89bd83e7c492fcc32c9648e47fc9660432f43ca9
SHA512 b90e620e07d13fad2b98a029c278ffbc6c0c279321aa3764d9befac00ef28e634a5afd7ebbb35d751175efdb8b92a59ce2d43cc4e315076e98db54b5bcaf8744
SSDEEP 3072:BGeLhaWhchmWN3ila8gaN0Lwzj+/S1frcCzA1YQXlQIPYTsXCp7FdabUuBfh5:BPdaWhcbJchXf1zxQX/NXmnaYa5
TLSH
T12B14137231630D0BA84F064376CB3D05FE4F389B15ACAA6B9D0B10EFA4E55BC351E552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 181KB
SHA256 4c1462dd9822e8014382665d8be65d414fe337c87a68f8edb3c4ef3b948d4053
MD5 6ceb9cfa9664cb694f799c9f36204a92
SHA1 5f8c31abdb02f94fa0f4c1c7696e7b578b0ac1f2
SHA512 400cd4f6374349eff6d720331c5ae0517515ce10784824ca969a5be65107fe6988c6b18e759f8ab1451a19a1b1714533e1bae88af1a1aa1fbe96829689acf0b2
SSDEEP 3072:EE+P9ES02E1QGvZ0wtVgJcCHHDYvTCtRuz1X+8rBWlznOlYohsxKVD0Ei7lf2AeT:EE+PmSNqrtVocCnUvTYRQXXW1Vo+xE1T
TLSH
T13B0412F60BC76EBE36F631A96B4AFCD5C041AF190AE13572BD4318B60B9091652E31CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 87KB
SHA256 72c6f3763b5c82b92b804da1b25e6d65c272399aca06e4e6a9967260c1161a8f
MD5 743153fb03dc9cfc72c78c92908e4fd4
SHA1 9763c45123a5e5d5dc95334aaa87a47e2d469f83
SHA512 00d50e4bc7725bbcf2663f740f81c68ba67311bd8a921dfcea9015f874b07d5036429b04a19c2ed1b7cdfc616a652f3adca415c593e70a22024cae6a1db488bf
SSDEEP 1536:SutVsNlVRQKxAeV/OxQDXJPhsS4nYBlP6ocKzm7HwHUEYlDB3888yNDTg1vaXJ:RElV1/Oq7JupnYBALoyQHI5RPfXJ
TLSH
T10693123C2A644BF2626003AE1907FE3EBF0A5A4A43E76B85D91D0464C1E5BEF0897D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 87KB
SHA256 cbbd603dfc54dc3246a5fa0322c7a0f0132ab18da169a655b9cff233e7f0a293
MD5 aa53a55db6c4f9bd74f036c63211b56c
SHA1 82052d3b122dec1ad6c9c83c6542429c1716dd40
SHA512 5dec2c3a7a2575177d99901f8faee524cfe3d913de7de78116b47543fbe5ebaaa9553860e7e6f7f30dd175353a2354336c85610bbd536a990353e65e14e8c1aa
SSDEEP 1536:5l7YZ5plpY5QT0KmWXW9Hcg8LJQ7V9pCh5HTE2Yhk71epd6JHF53zZewMK/Sfhwr:5Zy7lO5QQKm2UHcg8C2hxChkhVHF5DZt
TLSH
T1D1931219A3BF187B137D75CEE02CEC5A15C9391848A1D760DF10DDA890EA6DD52CC78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 36KB
SHA256 2ffa9ede6c4ae14f4eec3e6ea75a8223bf98715444b49fcf2bca08814ba87ce8
MD5 0edc8dfe9656738edc4b051ce5dd367d
SHA1 8e2304a12c6e823ac043e9d0caa289be33733eb4
SHA512 684826f5126b9bec9fccb5cfb1e3a3c7b36168370881ce99d94e3c0bc2a09784c52ef59b5bd481f6a06cc530e1bcfafb15d239e3a08163acc3a51003581e6f6e
SSDEEP 768:wvBdW0HW9wm5W/xZr3gwtEbxjW8HLJADWR7l0WneLP0XmVPmefpBHu+D4NG:wZll/xZr3gwtujzKDWR7l0WCEmVPNf9
TLSH
T12EF2F1B203A4407E3B4535E13D34DC1917D006FAA1DEB2A098FD4E836AF9D15A6F93E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5309713b222ffbd32fc5b5bfca3fcc9b4ff0ff84120003ba4a48c9ec58d39cc7
MD5 aa1d0644672bfd3a7f82465a3ba3a6af
SHA1 7840c82e9c70ef6597e65a8a16fa15b1d1ca4cce
SHA512 311671219ca03d6ab6dc0aaffc57c0f0a435fed12cacc89a934037a0e52ac1b18a1fe040becd4d14a9c72e9417e2c8d87ebb2280e3b389ff8b67733faebdf691
SSDEEP 96:MhAVCQhZQ1gaFkCBqY1ajKWIQuzjfWPHoSbaD5VsTvj+up7aCZDxseSOLeSuLyd6:B6j4kuC6+/wI
TLSH
T13791749BD3E28065F71914B0A6E83C8B3D3895945BFB0E9B02C8CA783C467756389373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5c5962.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c5962.TMP
Size 3KB
SHA256 68ae17c0136f3d2f1531d97ef4e1a699248809579b196e05b2efcf5f75687402
MD5 1a8b9368d51c204eda74991a46d992dc
SHA1 7f87802408491ee8cbb5378c135b4c53906091f4
SHA512 15ee4dc516da8261aa71646455016eccd3c5eb4747f4b4c25a391fa8269ff9c701673f103f8df7ca01d8f0511ef2616a34d2dba371f9a319839efee12c8e2edd
TLSH
T1FC51088F83E48079F79810B4A2E83C8B396885D16AFB1EDB0395D6B8580236573C9723
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 0136f6baf186446cc52c86587eaabf1e8d44802c5282fb0f7bca65c9f1b5fc5e
MD5 ae2a0cbf3d3760b90086af6df46b4374
SHA1 9fb7e7e97865b7e592ba01384ce4915e9435148a
SHA512 9b3dc5e7584413899c56341c849431c8bf33ac60b2c7ac481a637bb2040b84058c97597bfb1a8935d4c07ccd40129649d45c207b9caa3d8a3e3c0dcaa7dbea5f
SSDEEP 384:DZJOh4FlcJ6bgSJ1e/e4D2GeTEJn9oaeDi7J6aha7Gyoo2xYQY2GJRzURJIrj8R7:slhHa08P9MlJ
TLSH
T1C082BCE7C3E8CA2E8D6151F1AB142F2BCE190925435C3C6AC9D4AE4B93F6875F14198F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c7e94969adeae45c29a9263258adecfca655471e78d98fb39564516d5a980841
MD5 a9a575b399014885cde1fdfd222c0df1
SHA1 0a550af2f67e8f61dea5f21534cc6183614e35ad
SHA512 df831d858b1780109db760a954ac5892c393e35d2cf84d09732c912d4c54d291a5190bf300a9d4bae677927a4c213cb43533665c874ace57e8109c34c0910a05
SSDEEP 192:sxRURrCg/fWseEfB6zoA8p4x/g6+WNNpu/ftdI9SEhsBITcIN5pV54iYUtwq2KFR:sxRUkg/fWseWB3M/5+/PdBV2W0rMs
TLSH
T10C62B692F97469BB0CCAA129F554FB36E2F5042294D05E8DA7FD891C04D76ED7202C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5b9936bbe8107a078e927d119b6a697bab4c18e54a1855e5b646fac4356ed3b2
MD5 3988428fdae93b8130d02a0460b8299a
SHA1 ea799d5cac295dc57df146eb67efa0cee94c2bed
SHA512 8956910b7ccfe7a17b0620ce8a94f8e15658992c72d6057e9d1a07ef19c3fe0028fb82e12eded2c9cbb06bfc783e2174978f5966cc1290724d261797c7796c48
SSDEEP 384:sxRngg/fWs6Wv+6dSsM/58XPdBV2W0rZtd:sbgg/fgY+j/5ilh0FD
TLSH
T1E872B592F83459BB0CC6E129F554FB26E6F5042294D06E89ABFC892C05D76ED7203C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4eb16016fcf4dd6e425c35f08e3d4359f4f29843cbe48d23488c8c046db54679
MD5 eb623496ec6ea5a8a9b941d424aeeef9
SHA1 a5ecdaa9c0163e6cad25d0cbc12c4f698b4d6eaa
SHA512 23f83e4c9b58a29050cd80f6f5dbad9b4daec0ad14edd68bf7385d2d8abd286a041b6770a76f744ca872a9b17b1a25a52c9954267ec9730f70c3543b6c11a644
SSDEEP 384:sxRngg/fWskWvy6dSkIzM/58XPdBV2W0rZWd:sbgg/fCYyK/5ilh0FC
TLSH
T18D72C696F83459BB0CC6E129F554BB36E6F5042294D06E8DABFC891C05DB6ED7203C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3ec5b0cb0f5556cd0b026e1d09e6ea671c1e37427658580d022c730423411091
MD5 4b4aad1466245f0288a0d3f7d95e74fc
SHA1 a9a03244b310262f100f14c4d1f4b55386d7ec40
SHA512 f20d91ab7a410e1c96ce780c303fd3bcd9ab19dd4bd724d7c60901015794e74383ca854fd0f9af6b10607fc699ec6dea36d36abb335d519abff5480a2434a586
SSDEEP 192:sxRnRrCg/fWseEZdShXTzoA8p4x/g6+WNNhJXftdI9SEhsBITcIN5pV54iYUtwqq:sxRnkg/fWse6dSCM/5dXPdBV2W0rAd
TLSH
T16962C592F87419BB0CCAE129F554FB27E6F5042294D05E8DABFC891C05D76ED7202C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 efd022fda0f02aaec12e88144a22cb00f3685499e93603fc43a082e6684ccdd1
MD5 44fac29e05669d199643fb2bad4468dc
SHA1 a447910fee2365faa931d375c97e364c00f940c6
SHA512 882d5a24e920bed5f1daa355d871b609a285a78a1156f32264c4288b4752fe1c958c737a45d91b3e4f447fc8ec88de0dcf730364113e8cde916587f3e9f8e6a2
SSDEEP 384:sxRngg/fWskWvc6dSkIzM/58XPdBV2W0rzWD9:sbgg/fCYcK/5ilh0nS
TLSH
T1B472C696F83459BB4CC6E129F554BB36E6F5002294D06E89ABFC891C05DB6ED7202C8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6e2a44925cb92f9ac4dfaf910df33269c30e8e5720a57c6782c52f843a5ccdfe
MD5 4bdfad9edd99471a17b43dc425c50022
SHA1 e521bb3763343544d980a1850c8ffec8ff5a1257
SHA512 7a17af52ae703a6257d9af28250dc3e410d8d9a92f79ed37bc69f868e360e84a10b0da58020b3498eb285522575da1dfdd1290eb6b04e41b98edff5195e242aa
SSDEEP 768:/jnh5H7pLuLbcJWg6cfCw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+RkPirosKeU1:/jnh5BEbcJWg6cfCwu1jaViP5veU1
TLSH
T15FC2E97B740CCB7F8F900ADD98197E9B6DA802CB96D8CD8047FE941C02C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 695d521c23ee6bf226690788884f9cb70992ff8262b45f2bcf3c989f72027ef4
MD5 1a44d51d8a9702bfc6a016147811836a
SHA1 b40c00877d494e5e8fd2b189c5d7a552790d4e02
SHA512 6e375f70a7accf03c21b2aeedbd6537a19509ba4d81c304b739b899de040605d00bc77224f4c9c61652c0f411ad3fd735999ac54522520b905cc36eaa6c7d1c1
SSDEEP 96:KIdOKecS5Gj6WYkogEMlzeegKW1eQgqueVwmtiGgKPqj:ktNBP8
TLSH
T1D691751171BA4620383D7C1C9394AE9E464233633498EA7BB7E924614F6BF482DFD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\ed5a38b0-872d-4364-867d-4b336c69651c\index-dir\the-real-index
Size 72B
SHA256 9519f3de84fffb80c9d333ccfbd64799bd503e579cb2d0b07bc7b2c9d00262db
MD5 b6cfe9dd5c1ec8447b5a066ae4f50ffa
SHA1 6550e280e86cdde55f8af4f89875b34749136d5f
SHA512 d6501fe34ddaebbdfd8a37d80d2b96ce9e978cd4d4d1da6138c28195f11212a11d29a98890ff5a610756a6a80d578a314e8a08ffef71e7e68547f8ae7b1674cd
TLSH
T151A0022C42A81244C40401712547026976754950E9048346D6D07184D8D18965183278
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c5972.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\ed5a38b0-872d-4364-867d-4b336c69651c\index-dir\the-real-index~RFe5c5972.TMP
Size 48B
SHA256 b7bc274bc4d0f083c450fdfae0c837bfd10c5c82ab4f5bcef413477cf7517feb
MD5 bdad706433b2f143814f79c034a798f1
SHA1 2934fc3afda8d73c8ece49e52945b630b034b551
SHA512 3906866b63eb0ff265bf1616ddc83d969c2a7ca650fde328fb81bd81301e9abd0661ccc2a41ab23db1cf1669e0e51e281c9372526770289a99d76100dbaf0840
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 236B
SHA256 2225009cde275201c59e2397565857e603f092244f754915d7823133e1974bb7
MD5 6b765c0fb75c56c4ef58448587f34adb
SHA1 806c7f2a11afb58374f77fe9e97fbb03ec617418
SHA512 fbc3d21c762172f6b09d6b65d0975d5c63cd506a6b6ceeca2464567678554ec09467e801db1b6faac7725d96c26132b7353eb62fc5a7f36969ca7e8e27822958
TLSH
T1CDD0A7D70931E5C517719FC43114721ED12E6E0EDCD1ADE8E942744A10FCA07A4636B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 152B
SHA256 013c4aae4c762b684ea45d18fdb0ca5c02c95628b8ef06360b6b5bdcd3c27e3c
MD5 4a80e529989de1bc05a484bc61650d26
SHA1 1f5b1ca81ffed2a80a9962d16efc2355b5055e89
SHA512 b98837fb5f3cc211ede2a22814dc0ad7411dbb05abe50ff645e4ea493fa1f3af07ca005c23df0973465a048dc2870dbac10821f9fe84dbffb64507b0f81f94e3
TLSH
T1D2C08CE30810D28A0772AAC83014B31ED12BA34C8CD1CEF8E104544A107891B64537B4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 153B
SHA256 cea13fc213b828cb8a90c86c6ac04aa83ebdeaf28f5e5b00a46f35871643232d
MD5 fe8c588866038202d50ec16bf9884788
SHA1 3d8067672e51ed45d69e666de144f8d37c9d9703
SHA512 3dcd4e8f16d8d32e44aff5c47e3637ee3e057ed7962a2247ab0c7e38e802140a8e9d032b841a8ba4f3494c702e4aa6ffc7cab94ee727cc3e5a9f9843e81d98bd
TLSH
T111C08CE30810D28A0B72AAC83114B71ED02BA34C9CD1CEF8E104944A10BC91B54637B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c1a94.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5c1a94.TMP
Size 159B
SHA256 933b1941ee691ae70ed07030bbe417687a078a06af47d60eddf5d89df16bed0a
MD5 c92d273b3e36ea4e0e69fb9a94872427
SHA1 3831ecd51c60c8b0633757d2e85e1f4277b5e3b3
SHA512 4dcbdd0f29bbb3bd258414447cc295bd5ea29f167980bbf83d18406519dee294ac69ad310e6b251a90fdd47a5ae40e0ea2f6d956dcef849ec875c1a8fe663b62
TLSH
T1C8C08CE30830D28A077369C43020B30ED02BAE4D8CC1CEF8E106744A217892B90527B4
MD5 SHA1 SHA512 TLSH

Submit Download

c6c33ef3-9110-42e3-a031-b9f8a3121f75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6c33ef3-9110-42e3-a031-b9f8a3121f75.tmp
Size 414B
SHA256 b66f4f0d0abee408c0670bbdb08fcc0101733c65da0954c6bfe258a7324f3a37
MD5 c8fd2df3ce6b293253373d3660f818a3
SHA1 710244521a00eada7127d6bdbce855e0c3d3a766
SHA512 b140303b7e49b3568e831a54b6dad42b6c45f80a55f6191a1881528849bb79e26948d2abd830d948940e8ad1cf49f7c11fa6bb9d69eea58a0880a25ed4af35be
TLSH
T1D3E02BA9CC31DD6708FE0B2861500706FB69030A2A90895F7A3C850E8F72626028185C
MD5 SHA1 SHA512 TLSH

Submit Download

a5ff7b05-382a-4054-a347-dff519860d0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a5ff7b05-382a-4054-a347-dff519860d0b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 510a7b4410aeedf67fd1fd8a1127d564de1991ff2a4fa2b2fa789212954fa68f
MD5 c1d445acb7801bdb90951fe85a89956b
SHA1 19c580fd60e39b6bab3ae4cd3f54695a83db1f69
SHA512 6f6e0660c7e9e9d1aedfcee39ed43b5c12bc51bfb1e952345dd956b56b3cacd78c8b4ac202bb59f30372dffe81fd71f3166f6717cc166a32681b83a66f2b6706
SSDEEP 768:S/3+UA9rO5faDMIYNa8S5oYklnAdkPl9VEs8X:S/3+yATWRdAGP1Es8X
TLSH
T17303AF3ADDA49DB78CFE7780B20B77437EE41237D0A45998C6E90B4D45636AE7303822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 1a5a565e461db7db2981a97af3a410d34af6e9f0f821574fd741dfdaf2e4f7d1
MD5 7b4d97b326f54f8dedbbc08039dfae36
SHA1 4f46d7192c93226de891df685c55152f9b9532dc
SHA512 b821aff81a5c403988ebcd098089f14261b549e5eb6ff95c483c2361f4a998aac63807a9a6fdd90e3628b2801a6e48849b1a677f8962151436062eff1cfa28b9
SSDEEP 768:UFL/3Nwgc70iMIYNa8S5oYklnAzfJKI06ROl7ZFpJ6zaDYiaMkPl9VAs8X:+/3IxTWRdAbSuOIiarP1As8X
TLSH
T10D537CFA88D3997AD8AE5783933D6E06AEBCC123B5685498F7D40E4CCC525BFD302854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d2196f9f2b40ee44cc4b216543f2d5e7ca36fdb33db2d097e0d9959222b13f3a
MD5 25cab9a7473d28d6144750fa58d41916
SHA1 52da33edd2eaf65120d7c8d0d8b37d566a969ae1
SHA512 63fc904fa72f385fb2e6a16b33e3fb0f0bbc7a35222f148f281ab297744b3d02c8a98ef3777a261b25972c28cdc2b8e7290b3caadae37c3bfcba917fd8b5c491
SSDEEP 768:F4/3u8eSO5faXmMIYNa8S5oYklnA+OvKgB232s1F:a/3uxdTWRdA/vK6232s1F
TLSH
T179039E3D9DA09D7F88FEB784B20EA6166EA41233D0B45998C7D91B4EC17366EF303851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 11a68488afaaab9928e3a09521f2bd6eecfa42318e71b49a4f9811eb7baa0847
MD5 dd2ac58059f05d899b02a0eac5748957
SHA1 0d6a033965fae97d7082111aa1afa52718cac3f2
SHA512 74c6b089a80f6ca102f52ef9273005cca9c0ebe64192093e81a3c0a42cbb7cce553881b1996dfc6a7c079a86c805f11222544cd5fa0ca8f7ec142714ae4f4f9e
SSDEEP 768:do/UxvxjgC+23WfySO5faNJMIYNa8S5oYklnAa5SH8L4:nZj3+234+sHTWRdAKS04
TLSH
T1CD03C03AAC94A973CCF663C4B20A9397AEE55263D1C169F889EC1F0E17C77AD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e7dca00ccf9798d061f4e977808789ba80eef6fccd57698748ab8bf2871d00ca
MD5 9f6daf59e7f30d2f98c5c4fd33570d78
SHA1 49d213ba6ec03a135fe1994a2a92d06e032ee4f4
SHA512 27f49de6a07e116b165bd3dbf4c187ef0a2fee301fd70d61e35f65605f8f1d796c85e035c164f2e2901ea1315735d99904ed7ea868c64255c531721384b6b93d
SSDEEP 768:FR/UxvxjgC+23ufeSO5faX/MIYNa8S5oYklnA+Boyd:aZj3+23uS6TWRdAWoyd
TLSH
T1F803BF36A9A5AC738CF6A284B20A67C7BFE41173D0C45DEC89E94F0E06C77AE1707855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1420362cf701e11eb96d08d75c73fd555a288903620e5bb5c1ccf5dff6fc5263
MD5 7a40d4dc635fb572d3eea64030c35834
SHA1 9fe87374509946d38c5f57d49333b79813b8ad45
SHA512 5c04ca06d4e5d60022ae611046446099f1385325ab9fab465951d25e90dbb1c00a5a1c3f5a08719e39c34407c4d1f440462adb77a7b5e31f7b35207561394af0
SSDEEP 768:M/3+UeSO5faXjMIYNa8S5oYklnAdZ2s8X:M/3+pMTWRdA32s8X
TLSH
T1E8F2BF35A9A5DDB39CEA92C0F207A3837FE01123D4C89ED8D8E95B4E05836AF1707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9814ed3bddd770536013db3d1e0681e891ccf809bc9510ee25cad48a1d959900
MD5 b1e3d0ea5c2defc524ab4b80a31e5858
SHA1 c20ec7d83e38eab6752bf979b1f7f9a410cb25bb
SHA512 f2fdeea55e71cf32e92d398bd96b51f79f68e149fe40a04ded69251829bac0e84de732fc65c19299e72f62c66e2889ca3266fa63219b6ca3bcd2ad1e99ebcfee
SSDEEP 768:F9/3uHeSO5faXmMIYNa8S5oYklnA+B2s1F:7/3uadTWRdAW2s1F
TLSH
T153F2BE35A9A5DDB39CEA9384F247A3837FE41173D0C85ED8C8E95B4E05836AF1707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 cf9cf01069bde58cd752fb6f8612a369dd2ee5b4f232c18c8a48aeb10ec92e6c
MD5 cb4a77918079111207b3dd1c6e5ab53a
SHA1 ce6f4c8246d9ad90bd2e009150e5816cad820fb3
SHA512 70c8936f63e5173618d2b49beee51e9e3a4dc438d29afeb0c351fa91d30e61c15bb70254e0996e0ff0c47907dfd404bdb0da3b235889322b14eb9ab1a13feb34
SSDEEP 3:MsEllllkEthXllkl2zEflbp:/M/xT02z
TLSH
T16E4404147FC01507C540133040D1C3515370D41405315FC334D544335CC77C00C0400C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 cf404f57ae1cd10fc2d112c68e9243f163cdc859ab2c645341f98a4fea67c9ab
MD5 b71e0902fa37e797e75cd9ae37891e41
SHA1 9915a40d83ec4f7d955ff1097bbde76edf972bd3
SHA512 3abe7f3cb00ee13203c18fe3497199f55f5d73b1d5bb250af8266ac6f6ec245061230f754dd275cfbad5dd02fb9644bc0eef06ad6c083edfc3ec82a925cc7186
TLSH
T19221FDA15C3D1AC6C1BD0DAFB0872AEC50E8A612F8D83478289CFD68913E52E2150C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4ec183e8e2c7d8401830c76f9b6b1bbf74760a37e81203f273b25742aa04a50
MD5 cd7968feba1cd21c19231f4768eb5a28
SHA1 543c5b69d023340065d48d0a766ad613477a20bb
SHA512 b0105ebd3120d6532149e04c929066d182f52782e0651d27909b1579defc7f01fa56873f0f000d1db0f0a792a13d3b0e00336b039720918034e88e5ea88d311e
TLSH
T186310FE15C3D19C2C1BD0DAFB0972AEC54E89612F8983438289CE9A8953E51D3450C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ed6f13af4d23eb0fae3eeb6f116875b98baea8b85c64671cdcb9622373de239
MD5 ef02f4b8cd75b185f45eca8ccea2e6fc
SHA1 15c05c3e162dd5e4da0616bb9c33ace719a7b1a6
SHA512 794c5119bb048ed811133aa6b357649cf402d2e897d76c3a2224020d86989827d8c9c9115ca19e84f4607ff121078128ad4e6611b2b3c65515894873a07322ca
TLSH
T1643120E05C3D19C2C1BD0DBFB0972AEC44E89212F8A87439289CE858963E51E205083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c31842e1664b35fa3a50acd71fb36d96fa20f2ea288b8cd56a946618bd5815c
MD5 6cd9e80afd2cfb003133ab8ba52d8f8e
SHA1 55176120c51d857711f8ce144b9e263ee8f9712f
SHA512 a1038323843eadbcabe5fcbe34b80c98df3e538b4caade8865fdcfb3303ff5cf2d86299c7e28e448241a172d8df8e3ec4e400fb6f7d10d2beb32bce06a1d7f85
TLSH
T11811EFE15D391EC6C6BE0EAEA4873BED44E8A616B8E87078188CE958913951E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9fb67212c8d86125f0c94498aacf0f20821354ee3d03a0e114e5c46587a59c4c
MD5 1e21f924e7b00cb8559ed5e1197dbe12
SHA1 7eabd14180e23c963b722ef6600f25e618badf4a
SHA512 e570cd20d4a9b640ed1467b60f24ba28615552a9074bb4e94b82b8a8f28de23f040ce7b259b5bb7376d5d06c861e96b2171b99e4ab6d7e7414b3175a31b2088c
TLSH
T1EA21FEE11D3A0EC6C5BD0EAFA0832AEC54E8A616B8D83074188CFD58913E41E2051C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 921cc7b5c26303e027efc6fd174b105d3cc06d9150c8681d8c479cd5794bed7d
MD5 8d72017ed091e59e7ff5dcb779a6ed0d
SHA1 1879ad34d675d41498ad12886d68b401b1764783
SHA512 7e9a099e82cc434f1f02142277083df17afab6a4e8a5aee3558069616c134641a071ba866aa70b01f644c3fca175c74e5b78e5c8cf5141c74b1f183cd8b2b730
TLSH
T11A3102E15C3C1AD1C1BD0DBFB09739EC54E89212B8A87439689DE868963E51E245087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d1133029d0132ce3a37ab6f27e6878d1abdd9e2b5ea297e825514069cb6eba7d
MD5 d18be69773896cbf4e9e2c2a79a5bd5a
SHA1 e40e1920b8ecb2567cdbe8c198ff56a09109f220
SHA512 2be78429bfd984829ae4eab100dd17e1ab57da32f5b41408089476ee54e4bb33a5e8cd1f9b154c0c6c07b0d279d3d9d1c5fe40acca2a9ec3e481e3e2112076e9
TLSH
T1753103E15C3D1AD1C5BD0DBFB09B39FC94E89212B8E474796858ED68963E51E211083F
MD5 SHA1 SHA512 TLSH

Submit Download

595cdf44-b9bb-4dfd-bbe7-3b5b23956dfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\595cdf44-b9bb-4dfd-bbe7-3b5b23956dfe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5920_1342784083\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roboto-Regular.otf

Path C:\Users\Admin\AppData\Roaming\XuanZhi\fonts\Roboto-Regular.otf
Size 103KB
SHA256 72336333d602f1c3506e642e0d0393926c0ec91225bf2e4d216fcebd82bb6cb5
MD5 4acd5f0e312730f1d8b8805f3699c184
SHA1 67c957e102bf2b2a86c5708257bc32f91c006739
SHA512 9982c1c53cee1b44fd0c3df6806b8cbf6b441d3ed97aeb466dba568adce1144373ce7833d8f44ac3fa58d01d8cdb7e8621b4bb125c4d02092c355444651a4837
SSDEEP 1536:q7X4iaSDjVwCxXBbK0kLTedzLzuKQrbNU0AmgffG06skaa0YeHlg/Ec:zO/VwyUeVLzGrbNBAmgffdkajYeFg/r
TLSH
T188A35C4A7753AB49C5126A78C695C3A83B79BD69BB03A21FB1BEFF3211030605DD81DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 286488.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 286488.crdownload
Size 1.2MB
SHA256 e76e6696685037da3f115cf182877bf5901fef1db0b0a5aeafb810e9b0766440
MD5 612bcb3e8e577be68fd17d69c75ee58e
SHA1 9e01e7cc397a450dd0e9f4e3510e31ab96ee4927
SHA512 0df44ffe0d8f44d13d042887d5d7387a4aa093ddf838b81c7cd044e55cfa0215910e8be0cf97d53c545f2f37c225651f0ee4c5c2861a46317697dc13ba42cef1
SSDEEP 24576:5WSlOC3Na4R8sfORscaINBNGQb6lq3VkUE:XlOsNa/RsublC4kU
TLSH
T14A55BE2179509033E2730075A9BDB766547EBDB40B2189CFA3C43B3E1962AC17B36B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_1608286513\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3620_745509016\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCP120.dll

Path F:\LDPlayer\LDPlayer9\MSVCP120.dll
Size 449KB
SHA256 9cb478e41026982a4366d567377e3a9880e7ce8477a5ea1fd1ddd1fa96bc1084
MD5 cdfd3c9f6a972a1b3bbc0b0fabbbe39f
SHA1 d137f3a75eb9dcd7390992525dca637f9b678707
SHA512 e89a232471cddef647f990e76e0a04d0f74f81391c342e69395f3fb5de471b3f3064c335526e619d73c0b4961f2635321476c9d5451c11ead0c4ca1b7af65779
SSDEEP 12288:pZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77E:z/8wVwHZFTwFOOos3Ooc8DHkC2e77E
TLSH
T13EA45B237B864CF1D29E53B231C9532557FAFC2441B1F343ABEEE1692FA5282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path F:\LDPlayer\LDPlayer9\MSVCR120.dll
Size 952KB
SHA256 76770d93afb655c882fade5c0909bfdd263cde0ba1762a881c69bb57dda2ccb7
MD5 b46ba3349d9b716a30e617ee8e966707
SHA1 f0a4724e9061c032b0b0cbaaec1f1d13f0de8384
SHA512 ebca95f5b431be8a0eb5b74735cadc5c175328067c091576eb01dadb53ec39fc65b22aa2cca85306320f2cae4747ff5478b232108bd4a60389cd5557f83eba4e
SSDEEP 12288:1BmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJD:bmFyjLF847eiWWcoGZVOIxh/WxIAIbt
TLSH
T19425BF12B582C0B2C57202B1152DA73219BFB971443599B7BBD98F0E1EB45C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreport.dll

Path F:\LDPlayer\LDPlayer9\crashreport.dll
Size 50KB
SHA256 e269811316cba3527ca1f1ff54b1bf2ca0a435349d57ff350387ad464da87617
MD5 073553b6d3b92599db810e152541b7ea
SHA1 734beaf96d0b3ff0d6b9d016c085960b3e9b9f42
SHA512 1cf9132a973070e55507cd74570c195c1e3e66a68ab1f5c61dc47a89b5faba0ca49262ad250e99eb26e65cd02ffc6fff4204a7906ccd108518be3d2679a2de06
SSDEEP 768:5Q+agNztWyGOiprkvcocNcb0H/GEM8Jf3c4sbG7nQL44SYiDLk5XkvYijjK5AL:5PGyMprkvxXb0HOafsYQM4S7ekv7P
TLSH
T12D339E929540482ADD560870B9F86B3AADFDB1610BE1C2C7F388C26967507C13F791BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnmultiplayer.exe

Path F:\LDPlayer\LDPlayer9\dnmultiplayer.exe
Size 1.3MB
SHA256 b05b079bf2ee13a250088b4548eaed2abb618e2741f7725e9544eb3b1f5fcc93
MD5 9765614ed80f2fff1718d2bd9dbda6e4
SHA1 e7a4c4c7badcae466121736b86befcc75a05e2b0
SHA512 ebf1ee78f562937026219dea57ca43dad456f044d424a5a7bfd28449e2e3e8efd05022ea02942139e9f15bdd3f88978010fff4bd9f7cc3675628d5f0ae99525b
SSDEEP 24576:5Ivz2VsLcZ4PtO8VoYbmSR/hBrxM0DRkxPPQk:5nc24PtO8VoYbmSR/h2Yk
TLSH
T11E557E207A938235E7B201B0BDBEAA5D402D7D650B2140CBE3D5391F1972EC26E7776B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnplayer.exe

Path F:\LDPlayer\LDPlayer9\dnplayer.exe
Size 4.3MB
SHA256 4d785a837e258d6bd38a9ca4f1ff2f40f15dddfcc7d43e51fc6a63856a97a6fc
MD5 66997bd8578a410760e4ea9db063d526
SHA1 c74e7cfad6f0daf5946c8e36321a6cf81b6c3e2e
SHA512 6c85d9b400a880dcacfa9e5b0bbdd91638bf33cf2b38a7a50864db27ee3a9749ebf403fa4da2d3066994abbbde26436aeaed6fc58eb738975b0b2917f6c622e0
SSDEEP 98304:HmzlxU+zaqWVOakiopEINyZvXqr+fzgVpa1E6Pi:HmzlxN30kEIN8+Ii
TLSH
T1A5266D10BB49C226EAA202B5D97D6F5E0438BD701B2A95CFE3D43F1D19716C25E3362B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnrepairer.exe

Path F:\LDPlayer\LDPlayer9\dnrepairer.exe
Size 41.9MB
SHA256 673e7aaab430a3d39f60a4546a503d2729aec3fc81eb47dfce5dd9b96252ebce
MD5 fe42e0cf4df61f56056c3c4ed8bfa0cb
SHA1 129c59782fabbf58a9ee5786cd3b1e103f8f1369
SHA512 123cc5e632bf521b47b2dcedf3dcc26c90fbf01171fa6f9b8fa0c885114cdb76527b0f892cd3a1acf6c067468a6fa1c1728d0ec2223c0462e482d1341c387388
SSDEEP 786432:YOF2JBoQ9Nay3CiQFcn0VPgS4ZPmp7qaKZLrhtY291eIzsIn6p:YBoQ9LyW+P94ZU7qaMXblPpf
TLSH
T126A7333039BAC232F1A30774AD79A71694247D74072992DFA1C43D1D9E7CAC22D36B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnresource.rcc

Path F:\LDPlayer\LDPlayer9\dnresource.rcc
Size 5.7MB
SHA256 d97adf651e616298e6283e5458aba62f0b259620bd4307d9031af868e5bb4ecc
MD5 78b825d9b101dc5a44f5e7c51e541597
SHA1 98966fc6614a361740985118e5574465f7781c4f
SHA512 42115e31534fe7d715944f90bd23a73f38302a0739ba1a95a493fc514f6ee4e80fe7fbc184a53869b7cffc4d97a00a1c14a9c8315efe645c6286bd3f8e7c56cf
SSDEEP 98304:F33vArUICir4rYhcqyc8FIiWiZrqqLp9I+Vfl5h8H7WdzlpCbOcX1T:FHBIRkkLycWvWP9+z07WdzlkXt
TLSH
T1985633732F5CE7E487581372ABE51ECEE100936C3E0E04445FB134E999D8B6867A927B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 0dd2878a9aad0d1a64848db4a1b4e3851fd5bf049c4ba5b726d114ff45fd947a
MD5 3c89c64d591ab2eaf01fbd2253b3a623
SHA1 99b595ed628983c88eb09c484777eea666f631b9
SHA512 bb370bd639c4b2d25c44d153a7de6dff7fcb8f8af644b6b37243fab1bff282d8d3f13770e6862cf0b348ff83e6d7f73b3aef61e575660debce5664ced50be715
SSDEEP 192:WfAwWOhWrpT71ojDBQABJwqnajLQvTP+8jIrerl:WfVWOhWrSDBRJwlvQyUIrerl
TLSH
T12B422CC34EE85442E956AD7002ACE9437D3DBBC51820955522ABF69E2CD33D6DB04B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 289ea86da94de73f0f0de4812caf7eda170ee612c72a713b3036b2669813d15a
MD5 6dbcafa7fd0b183040b73e7e1d97674b
SHA1 4a6f7d5ceca5dd225532d95b743fa7b7b724621d
SHA512 e7c4dbf91c27c2d1570529e33c47e0e2b77c636a22f32f2956c9a59b5acae8b2721ea5802d85bbd179c7931d1542ca20b526487297be729698027ffd97d4ac44
SSDEEP 192:FWOhWOUT71ojDBQABJwY1UqnajMHxxBNT06YeO7BN:FWOhW+DBRJwHlI66YeO9N
TLSH
T118322BC28BBC5443EDA7AD7013ACEA837D3D77D61960841A05AAF1D92C837C2DB14B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 9487da37a92b40720ea2ad64ea0c9adc8b3c7bc4fe1f63a0e03e9c7a18943565
MD5 d9e02887a85903ee3a4fa7f197865274
SHA1 f68904fef682461068ea782f1ed911b124793732
SHA512 43fbb849a9a6e41e3b20813ebbe29e9fc233f6c1a7c00f8798f15f5c896bca7f6906a9a65fbc5569b3d5f901d70ab9a6132f8a9f71193f2d7f5559a607d5cf84
SSDEEP 192:4WOhWqT71ojDBQABJTwvveqnajsl/cqtm4t:4WOhWrDBRJTw3elPqr
TLSH
T1DF323CC28BBC5043E8A7ADB052ACE6877C3DA3C618704956059EF5D92D873C6EF14B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 9cc0615a94b0a320f4b675eccbc3f7b8c279d9f692165afc6ce0c877f3981b08
MD5 fcc2e13d7db99b2f3725046ca7d392d0
SHA1 14d31bc9070a47cc58342aedd17b4ead672da6ea
SHA512 bd9c7f3d97413f14abfe75cd2c5cfcb5aa39de05c8f69a2f6bfac554fdcf0eb0e41a32c34a5e7fe78a2bee2ad9d4be2895a33f138f7f0cb9f02dd3725b1893bd
SSDEEP 192:GyfmxD3TWOhW0T71ojDBQABJ2ZqnajxcRGlPHSm:GyfYWOhWZDBRJ2Zll7PHSm
TLSH
T1E8322B828BAC5043E9E36D7022E8EA437D3D67C618304556169EF6DA2CD33C6DF04B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 4b2dc152f33cd7d88beba8696a57cd0383f05c50d2fb63672664717766762a1d
MD5 d613baa29afa3db1faa991876dd382f1
SHA1 795ad1269848846294563480750c91abf6bf33af
SHA512 a7113a430d39a71af764ddddda81f37f280f795ae88f5ab829523b278f82c1487401316c24700be4451a162567c282bcf08390a583ccd18b1baf96cd86ab54b3
SSDEEP 192:zYPvVX8rFTsBWOhWwT71ojDBQABJ9t6qnaj9RlSIFspC:EPvVXbWOhW1DBRJ9t6lBRAIFsI
TLSH
T17E621A83D9A0F64BFC8F9E701196D84368394386043454C61BD9E79E7CE738BE788A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 568d7f8551d8b4199db3359d5145bc4cb01d6d2f1347547f47967eb06a45c3b5
MD5 00d8b4bed48a1bb8a0451b967a902977
SHA1 f10ef17bda66d7cab2840d7f89c6de022a7b3ff2
SHA512 e248cbc06fc610f315d7efcadb39b5cb85dfe5d40858768d5aea8d41b3b4b23eafe0db2b38cce362fd8ba8bc5eb26e9b2dddc00e2e8615395bca818ecfe0decc
SSDEEP 192:HWOhW7T71ojDBQABJ76qnajMHxxBNT06YeOg:HWOhWIDBRJulI66YeOg
TLSH
T11D322B828BB85043D9A76D7023ACEA437D3D77D61820859505AAF5DE2C837C6EF00B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 c1bca1bb524c5ae3d877a099f469b6fc34288bab26ae7a7f4fc47cd869f4958d
MD5 534483b0f4a1924b1ae6d7e66b4a4926
SHA1 4e954316acd216007f4a0225b138e0c0a04fbbed
SHA512 cfad2ddf8a9ad67e36e978726d8a12ca26b180f73122b2e8d19a83f73028a050d9f418e7525f576cc3a9601b3369d4494dddbde620b4011b7ca8a7ec4b0d1b12
SSDEEP 192:tWOhWzT71ojDBQABJUrkqnaj9RlSIFxKV:tWOhWwDBRJ4klBRAIFw
TLSH
T15A323AC15BA89442FDA7AD7012A8E6473E3DA7C20860844605A6F79D2C973C7EF14BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 85546a616d5594b884146aa4e13cdbfe841c9d956e648c6ee4840e6f4428bdcd
MD5 2bd9500ab908c0e02ca40f19ef647288
SHA1 de8cd89fba64fa131fa842619b10d7d2d8a681d1
SHA512 1a3c5e306b6bedc87c250f8cb1b82e2c736a2c0a8e37c67e287914ff49da88af21722effad8cc4918d06b303989b09b35eb5d545a590be9fa8cdbf9028ef75a4
SSDEEP 192:bWOhWxT71ojDBQABJNf+Q2qnaj9RlSIFr:bWOhWqDBRJN2blBRAIFr
TLSH
T189323AC18BAC5443EDAB7E705298E6437D3DA3C61830859609A6F2D92C973C6EF14B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 8434510e84f5ade3453cfe086ed08260d309f761ed922bb8ff9ed436d8575d82
MD5 2bdca93251d247e98e0a907bf68ffc7b
SHA1 84bc13dda79a309b2fb06499eba090359dbe7cbc
SHA512 e86ec2cf9e964921a912c1992a01ceb8eab36f5d29d444d1c9b0b9b2f3fc4a831e4fe034c7676e52c01150ba037ca6f46f7de669a9aac5eb8bae2b848e65e7c3
SSDEEP 192:iS6lWWOhWDzT71ojDBQABJSWcqnajxcRGlPHi:OlWWOhWsDBRJ0ll7PHi
TLSH
T1EE422A898BA85043E8B7BD7012E4E9533D3D73C6087044560AEAF2DE2C933D6DB24B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 75b8eae29ab9acc906aafac2a198fe875d34c22b40acace1cd6c3486d67333ef
MD5 8a6c74b9a1db0d730af45be603d233c8
SHA1 a6a3e80afeefcc9b34703c6a8ea2c0a94fe998e6
SHA512 8f2e6be6a08e393acdb7e50687d6e6faefa9243855d92018bc9be5ffead022e4df96d2d51042a1e2d6d2eadcb88e27f7f4aea8a5314f8fb32c05cb9cededcd99
SSDEEP 192:ClYsFqWOhW+T71ojDBQABJsgqnajLQvTP+8jIrS:ClYsFqWOhWvDBRJsglvQyUIrS
TLSH
T155423BC58BF8A442F6A66E7003A8E6837D3D63C518204116079BF6ED2CDB7C6EB10B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-libraryloader-l1-1-0.dll
Size 11KB
SHA256 27078ba4e79087a5c1146f35da386ce043a3c2bbcaed04bd82645eddb6ed896d
MD5 a9116f560839df0c03be8ad704ab3351
SHA1 3339421f8cb623b244dda6e76ec5b6c7d987af64
SHA512 4bded31406e6de3823a72162ba72968047c48f8373b660a431415811052be622fbf5b4d2123086601440e714dabd703ff0c36ed962590c23144a2e2b00b13ffb
SSDEEP 192:BvuBL3B6WOhWryWT71ojDBQABJFvJCeqnajxcRGlPHZ:BvuBL3B6WOhWryXDBRJCell7PHZ
TLSH
T19F420BC68B685042E5FBAD7092A5D5477D3D63864830886905EEF2DD3CE33C2EB00B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-localization-l1-2-0.dll
Size 13KB
SHA256 13471eb84db95f8270398ef1deb29f0ea024db17e331497545c36eea7b2a3a7c
MD5 73483cbc229c62e129627adbf62b0ffe
SHA1 074ce67665c86355d3218b5e3ea4b1b335095af8
SHA512 92f06cb8971e29da7607c6b1d1377f21c7e6f0e4a169aaa08326038d5cdb09422b91f4f2d26a7978521e0edbb9cf1235e583f2910048c917ccef8d12c5e1166a
SSDEEP 384:5OMw3zdp3bwjGjue9/0jCRrndbZWOhWlDBRJIXlBRAIFn:5OMwBprwjGjue9/0jCRrndbvs1PIjRAW
TLSH
T132522BD29798E647F84EE9703167E5033C3D62850831989607E6FB653DE338AEB9076C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 d70eb06ed4f0c686dda93f35f065ec5e6249e5c737a24249738314c31f9d5202
MD5 d9e4e446dcccbfa822059dcd16edfc41
SHA1 cded5e8dbf7a00e080432257f95406f5728e739a
SHA512 11deace1b537fb770281468efb265d932a22b797ee268fb60d968f2f238cbbead6c60114572932732b1fd8d5682c1080e7e927a25f73ed2f5e85640b080a37a3
SSDEEP 192:oWFWOhW0T71ojDBQABJxAY1hXqnajL1dHx3tKCJAC:DFWOhWZDBRJOY1NlXBtpOC
TLSH
T106423AC14BB89447F4AA6D7053A8E747BC3E57C618A0401602BAF69A2CC33D6DB10B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-namedpipe-l1-1-0.dll
Size 11KB
SHA256 36c42192283f129ff5637a06b7c3d72e5ed8e1c77493623384f2bdac15118f29
MD5 bb05cdffc71ac2b0c0fb2cc35b409ec2
SHA1 b327ab67107235beb5fcd1b893a571e21e29f6ff
SHA512 b55cbf2aaa2f7685925c313d4ce73b8635666e5f2f30e2621fec88f3b526d296e5d1fb5c28bf3ea5e8621b298e01b75542085e9e3d1a966762173a3e53e4240d
SSDEEP 192:iWWOhWYT71ojDBQABJz0ymVqnajLQvTP+8jIrf:1WOhWNDBRJzxmVlvQyUIrf
TLSH
T1A2323CD187A89042F99B6DB013E8E6437D3D67C918208555129BFDDE3C933D6DB20B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-processenvironment-l1-1-0.dll
Size 12KB
SHA256 0d10d132cd28b57fb88135d5693ba2c1aace2fc059d85bde0318fb9b379b57b7
MD5 14e48e802a6690282ebde74fd5b78e6f
SHA1 8cb9adc2a99c6ca443c2ef0be6bb093f9059aeb2
SHA512 710356f5e6d4f6dd7754c72deff703b144f91b54e643017c05dc81ebd4150981651e6f3ff20eded5fcd7abe0327692e8d6bab00f454597fc36603bd8389601c3
SSDEEP 192:0vWOhWUT71ojDBQABJWTfqnajMHxxBNT06YeOXw:0vWOhW5DBRJGlI66YeOg
TLSH
T1B5425BC19AB85002E99BBD7012ACE5673C3C63A31C608059019AF79D3DD77C2EB44B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 28dd68501f527be6bc54f5f374bc33be983ea7ac640e66e3a56272cd3b9a5655
MD5 f2fa7c391d7671ab11028e85d29ab27f
SHA1 734ccf57cab781d367b62d216b6582f3bb89249d
SHA512 3286fd352fb4149151168babe4b1e44d22e914d950f41c099748e8d3b117ada86391fb4e0ef5863aac07b2a08372ccce0c470642ac8a7c7dbf97ea72af1d0583
SSDEEP 384:ok1JzNcKSI1WOhWzDBRJS/kPlI66YeO7EN:DcKSmS1P1q66MoN
TLSH
T15C520AC58AAC9183E89EAC703259E9533D3B93450D25846106E9F6DE3EEB3C6D72463C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 b5f815d0a41add7fd9593036a8e6843fcc221298fefd61808f960eed3cc19830
MD5 7016bf365a155d29f01a000942a017ef
SHA1 47e25b97af56edbdd20ca72bba994c6bcf1b81e6
SHA512 2cd7e88717a2d81811ce03990737888b8a1e9e351dcdad401ffe5924bdf97be086bd766a1a5b25411b760cbf81b68bebd94d915100b6bc1310360813af11f827
SSDEEP 192:79DfIeNWOhWVT71ojDBQABJUqdqnajLQvTP+8jIrnN:79DfIeNWOhWuDBRJhdlvQyUIrN
TLSH
T12C422CC186BC5483E9976E705298F6433D3EA7C61834446505ABF7AD2DD73C6EB00B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-profile-l1-1-0.dll
Size 10KB
SHA256 3902aff11857535698367d4db2dfccde6168429defac82c15a535b4a07f7cdda
MD5 5b222e79ed442685e509bb3f16e93482
SHA1 fd9de440d03d9b57319c49871b15b8468ab961d3
SHA512 1d057f6990f9999b82f086cb4c0547d638504ca0ec3e801240fdeb1a20f84cf2b812d9cca64786186f6158954ef5677208eb4f0265e300525b8528cdbdf305b0
SSDEEP 192:+oJnWOhWbT71ojDBQABJhvz3xHqnajxcRGlPHen:+oJnWOhWoDBRJhvdll7PHen
TLSH
T1EE322BC28B685043E9A3BD7052E8E5437E3D67C65930455A05AAF5EE2C933C6EF00B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 10KB
SHA256 db1622a0b0013991d759c7955454a8006aa27f81a8b9b5c37cf2595b15b1b217
MD5 308aedd0dd83acfb5aec8c60782a4aed
SHA1 e5027f0828aaf4b24eb6c6396fbf0b15e49355f1
SHA512 281c9b854b958426d3c23dda7116af17a95e4bec3eb7e4fa85cd1216bb8a2b999a764866e831d1022590dada7e720d5d930417888f174fc91a3fce78f3393c1c
SSDEEP 192:1IG5WOhWwT71ojDBQABJpqnaj9RlSIFOwbF:1IG5WOhW1DBRJplBRAIFOw5
TLSH
T1E03229C15BB85443F8A36E7013E8EA437D3DA7C60860955615A6F6A92CC33C6EF10A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-string-l1-1-0.dll
Size 11KB
SHA256 7bf7ff35fbcbfc1cb57597acfb23d2fb13e04e14906f4a626e4e92d689f19cbc
MD5 749b5c0031e0726fa45a3bb9b48b3802
SHA1 551c7adf6233b66d9271f5b705ab45d69cb590aa
SHA512 b7e7d59307aa2432b978484cfca8e5ea61216c1240bdbd733d4c697609ec371e6f13aef2a654de64711371b35dda2c5c6ae2b13b52e5951b51161d42b2d6ecaa
SSDEEP 192:yMyMvNWOhWPT71ojDBQABJoUqnajsl/cqta:nyMvNWOhWMDBRJFlPq8
TLSH
T1333219829BB89043E8A76DB012ADF6877D3CA3C71870856501A9F6A93D833C5DF14B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 1ff0d9ceff0f982b7a78ef34c45980b88099067f4468f11fcdd46dbac00f6dd6
MD5 2bbc9cf572b18123a0f27f04492c6ea6
SHA1 216404ed615263be2271a8db7c64daa5d54d9412
SHA512 f59cf115e6fd8f82f5d2b3c871ab0cfe3bd1c8c5493aca196da185a3f6e85e6390bcba1bb32d409ba17c3c032c43308f609db14180027fad564daa0d5f570309
SSDEEP 192:Gdv3V0dfpkXc2MAvVaoKZWOhWpT71ojDBQABJdBqnajsl/cqtV:Gdv3V0dfpkXc0vVabWOhWSDBRJblPqH
TLSH
T1C3523B42D7E4A593F85FED7052DAD1836D3853860830882211DAF6AD3EE33C5DF14A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 e1a87d7d01e2376dde81a16658915ccf2ecb692739fef09adfb962523756e22d
MD5 9efdffac1d337807b52356413b04b97b
SHA1 2590bd486abce24312066285fa1c1feaf8332fe0
SHA512 b3c164e50d48a78bd08cf365e02e263b97ec2dd3efcf04914c8677c838e10be23df5178a8618e3f2a6feb6faa2bb74eaf069e7e2db7c6e6fd9d0137dcffbcead
SSDEEP 192:YttZ38WOhWJT71ojDBQABJFarAyTCqnajMHxxBNT06YeOpFWM:UtZ38WOhWyDBRJErDClI66YeOnT
TLSH
T1A5423BD29BA85543F9A7ACB053E9E5433C3D67C51820581605AFF29E2DA33C2DB04F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 b31a83c8cc984c2a7ed9d7c9964f8ba302c1051bc478a3a34b98f4f873a6c011
MD5 b697440bdbba2e896005de51943ee0db
SHA1 f4f7ab7a1d8e4fa43f83401585e6e83136cb16e6
SHA512 81270f3e9a91d001155fb9c7f80132d9611082a68c0f849ce95895dc9835223075531ce11a534dc076d75fb76cdeae9abeac23d371cc0de8428e8c177d7673d5
SSDEEP 192:XtqUKIMFQWOhWq7T71ojDBQABJONnxqnajMHxxBNT06YeOargRow:XtqUlWOhWBDBRJYlI66YeOaURx
TLSH
T174421BD29BB89103E89B6E7022D9D6433D3DA7921420C45901EAF39EBEE33C5DB14639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 f1667bbda1b58fc688b422fd2f9f7040919c4ababe00a4be78b258cae2dfc3d3
MD5 42c72d838c34e4e7164c578a930b8fc7
SHA1 82d02cb090eb6d81a1499189e4d3e6b82aa60061
SHA512 1020d6010dca512adbc18f44b6453a974a200766013c39f6cb1cd0a72234a241c73587c929f1d0fcadf90c3eb71264086167f05bd7ebceb5b944f4e4a0811d92
SSDEEP 192:jUWOhWiT71ojDBQABJj6nqnajLQvTP+8jIriNDG:wWOhWTDBRJWnlvQyUIrcG
TLSH
T172323CD2CB688442EC9B6E7002E9E6837D3D73961860455A05DBF59E3C973D6DB00B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 1573af23a9ba27b2f3703a718749b776aea67e654c8c9713f92e41a67ae37c79
MD5 c0b34d2146cd6f6cc2fe345029066ec8
SHA1 7ee74d35ade0bacb113cb9e81156083258edeb8e
SHA512 46e8caee15ac0be70a4b15e27967cd4464ab5dde0ff11e192f81e855ced99c8a83f8b5be5d1b92f6c8ac593090985736f19227f117a20a59f56416b11e3745b2
SSDEEP 192:bWOhWZT71ojDBQABJAqnajMHxxBNT06YeOy:bWOhWCDBRJAlI66YeOy
TLSH
T10E3229C28BB88043EDA7BD7012ECEA433C3D67D21870855A159AF6993D833D2DB14B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 147f86ff93d61fea256b3de9149e1b36b68a83762e62a3389466218e18359ffc
MD5 4296cf3a7180e10aaf6147f4aecd24e4
SHA1 f81e09af979a1146774d554783d1a22a03a61393
SHA512 60357edde6572c5e796f927c3e72c31a96ff700624b7366fdda64bcf51ee00bf1e9ab477a46d8d3ba7391ba10491e69f745efec3607f8f49b6e1a3a3de7a0648
SSDEEP 192:pj8PWOhWST71ojDBQABJphUzyqnaj9RlSIFK:pjAWOhWDDBRJpYylBRAIFK
TLSH
T15642188256EC5907E5575F30A2F8EB83BE3D5786287064660466F1A83CC63DAFF04A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 3aa0eb4c47ac94b911f1a440324d26eee8ddf99557a718f0905bfee3cf56255f
MD5 5c6fd1c6a5e69313a853a224e18a7fac
SHA1 10bae352f09b214edef2dc6adcb364c45fafdbec
SHA512 08c2b1150f6bf505d10085a515bbfab6c1e18663c6ef75ec988727e3d30210532d03bfbfbb048b1a843d4faa5d1060f9079e018a9e892bce03f899a5a85f6034
SSDEEP 192:fpdkKBcyxWOhWWT71ojDBQABJMIqnajsl/cqtt:JuyxWOhWXDBRJXlPqD
TLSH
T1A062B58366E43F66E99F177221FED7D72A38574114A043B4C207E59C3882782BEA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 16ba05a1fa928501ffaee2e9dce449d28e8fe538df5ec6d8d1080b610b15d466
MD5 6a3d5701446f6635faff87014a836eee
SHA1 7bbc9db1c9ce70e9fc7b7348a2c96681e5d8265b
SHA512 839a1277b6dbb9f2d6e572e1b50b0ad08c93256a1367f36997db07285aa7b251346499a643a985a22d9a7618635c11964e414073aa7e1bf60d36368829de8fb3
SSDEEP 192:kWOhWaT71ojDBQABJIvqnajxcRGlPH6WE5:kWOhWbDBRJIvll7PHC5
TLSH
T17F422B864BB81442F9E77E7052F9EA437D3D63861820452A06ABF59D2CC73C5EF11B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 56e0bdf91edb21f5f5041f052723025c059a11360bb745f965a9903de9c61756
MD5 4ec243792d382305db59dc78b72d0a1e
SHA1 63b7285646c72ee640d34cdc200bfc5863db3563
SHA512 88f648d45927db65ff8cead4bb1959b1297410bf3f5b3b2783a173d708649260a61470342694de8b93e9c1657de64db43db40ee71acc661b03786c0921d68d4b
SSDEEP 192:b7q6nWlC0i5C5WOhWWT71ojDBQABJHTTKJqnajLQvTP+8jIrF7:/q6nWm5C5WOhWXDBRJHTGJlvQyUIrF7
TLSH
T18852078347D86E12EAA71F7112FCEBDB3F3E2B85185246628007E15839D23C17F02A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 6501894e68a3871962731282a2e70614023ec3f63f600f933ec1785400716ce1
MD5 a51cfb8cf618571215eeba7095733b25
SHA1 db4215890757c7c105a8001b41ae19ce1a5d3558
SHA512 9ae11ab21486dea1aba607a4262f62678c5b0e9f62b6a63c76cfdc7698d872d8696ffb1aaae7aa2e2cf02c1c7eaa53d0ce503432960f4be6886fae0de2659535
SSDEEP 192:8Y17aFBRkWOhWXLT71ojDBQABJz5qqnajxcRGlPHisg:9RWOhWXYDBRJ9qll7PHip
TLSH
T129422BC38BA81443D5A3AF7066F4EB873E3E53C618204527459BF6E938823C5AF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 42c235914844ce5d1bb64002fca34a776ae25ee658fc2b7b9da3291e5def7d4d
MD5 8d097aa5bec8bdb5df8f39e0db30397c
SHA1 56f6da8703f8cdd4a8e4a170d1a6c0d3f2035158
SHA512 a891536e2a362fc73472fa7f5266ce29e8036959701bc0862f2b7ea5865dcd1505615edc8e064fb2f7aaa1b129e48422efe7b933b01faed9c2afadd8a64452dc
SSDEEP 192:iWOhW6UT71ojDBQABJmRqnajsl/cqt0AEV1:iWOhWQDBRJmRlPqubV1
TLSH
T130422A8287A81443E8976EB056BCE7477D3E63C61821485A049BF5E83D833CDEF15B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-math-l1-1-0.dll
Size 21KB
SHA256 0439703e47c8fce1f367f9e36248a738db6abcd9f2dd199cb190d5e59ed46978
MD5 ab87bdae2f62e32a533f89cd362d081c
SHA1 40311859dd042a7e392877364568aad892792ba9
SHA512 dbe0073da8979f3d32204680015b60435226840e732b5df964dbeeb7920c0bc5df92d866964f905518c97cc3539f628664503ffa64e50a2ef90c459b62555444
SSDEEP 384:n47isbM4Oe5grykfIgTmLOWOhWB9DBRJelXBtpObE:41Mq5grxfIn+c91PkKE
TLSH
T1D9A2848789E8BF63E5CF0BB701F48BCE66381BA154E175F4D887A1C834927843E5B958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 224f526871c961615de17b5d7f7bbef2f3a799055cab2c8e3447b43c10c25372
MD5 169e20a74258b182d2cdc76f1ae77fc5
SHA1 fce3f718e6de505ac910cb7333a03a2c6544f654
SHA512 0881c8704421a5f6e51abd22c55608dd7fb678491682ce86066e068b1973ebf11d6c2163be610a49f87e800c8563ebb41abfe36e1913d7d0b8485fd29ed81bf7
SSDEEP 384:iy+Kr6aLPmIHJI6/CpG3t2G3t4odXLlWOhWrDBRJ2pll7PHI:iZKrZPmIHJI6Bq1PUo
TLSH
T1AE922D6B8EA82E11D58FD7F3B5F2C7C62A350F8104C07379E66B95883845EE9BD42E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 bdd0cca431ee362bed4f2c1eccafb22aa8dd51d57014be8297789175e5c11f2e
MD5 682bf6b9c07a64929a4484db51d6c13d
SHA1 07672ce8f08db3b1d745b71e9db3e4729c70793c
SHA512 e4ae0fc24114a58baede8443cb9275811c12a321ac898cda89efbd07474b8e60a564c55bbd82e37f521bf46b05fc1ca876f9b33f6d4bbbaed9fe0f03c937fce1
SSDEEP 1536:KaYDe5c4bFAcvxXWpDid3334BkZnGPMwPn7+9:6De5c4bFAcvxXWpDid3334BkZnGPMwP2
TLSH
T12E5318DB49E63F22E58FF7B76BFB17C90B253A0418806174E9CB556B34853A9BC43A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 51862322ae3354f254045545b4ff64b7445bc99107b4526c3430de9ce5c60d88
MD5 3838dd55b0237af0fbac474abb6614cc
SHA1 0c47256f4a29bc3fa889b5fbe0b1f2d712acf4ed
SHA512 cca018899156601146c5c6aa747603a62d70e3dbbbbde377b06a78f3d0f2d83f11d7f3db71d239f4ad8ce2e38b92c93175d2af5af56905f87a755b8dd59b7836
SSDEEP 192:nRQqjd7xWOhW8T71ojDBQABJkoHqnajLQvTP+8jIrrNX:nKAWOhWRDBRJkMlvQyUIrrV
TLSH
T1EA420AC787F41996D6736F3042B8D7877F3B57C2581085668457F19E38823D6AF20A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 505d2bde0d4d7cd3900a9c795cb84ab9c05208d6e5132749ab7c554ccd3c0fcc
MD5 49363f3cf4671baa6be1abd03033542f
SHA1 e58902a82df86adf16f44ebdc558b92ad214a979
SHA512 98e78a607cfbb777237dc812f468ec7a1abcba9472e20a5780dfc526f7992da1841fcd9e2f76f20fa161240007f185c7fbdc120fb4c3c1f2b90fdad5913d65dd
SSDEEP 192:90CjfhrpIhhf4AN5/jivWOhWXT71ojDBQABJBkQgqnajxcRGlPHei8:9b7hrKMWOhWkDBRJBEll7PHQ
TLSH
T1EC7208439AE83E17E9972F7312F9D7CB2B3623421520457A9993F1D934C3785BE1720A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 fcd55331cc1f0ff4fb44c9590a9fb8f891b161147a6947ce48b88bf708786c21
MD5 be16965acc8b0ce3a8a7c42d09329577
SHA1 6ac0f1e759781c7e5342b20f2a200a6aab66535e
SHA512 7ba55fa204d43c15aca02031f584b3396bb175365dad88e4047b8a991f1f1ddd88d769e4d8cb93ee0ed45e060a1156e953df794f9cb8bb687c84c4a088da2edf
SSDEEP 192:5FbNpuWYFxEpahvWOhWQT71ojDBQABJ/EXqnajL1dHx3tKCJAfg7:LUFVhvWOhWVDBRJclXBtpOfm
TLSH
T14A82E68786EC3E42D28B87732AFAFBEB1735438328147579C107E99435CA399BE03559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 ce74bdc6999d084a1b44b2ecea42dd28849b2825d7779effdc4c18360308b79b
MD5 3eae6d370f2623b37ec39c521d1f1461
SHA1 86d43e2e69b2066333e4afa28a27c7a74ff89991
SHA512 30b2b6cf5cd1bbdf68de048e6d992133fe7ab0c847fa0d5eb8c681a9688d60794621a40178451a104036a0fff2e1bd66a18d9f96be6b28dbdc0bc1c8a535fc85
SSDEEP 384:2iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGl7WOhW0DBRJglI66YeOtOk:26S5yguNvZ5VQgx3SbwA71IkFid1P56x
TLSH
T18C82B34346F83F42CA8F5BB315FACBC72A394F4615401375D067A5CC38827A6BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 40d8bc312ac7bca072703e5f0852228cde418f89ba9ad69551aa7a80a2b30316
MD5 a440776e10098f3a8ef1c5eaca72958e
SHA1 7b8662714f6e44fb29a4224a038e4127964003e9
SHA512 b043cd020d184a239510b2607c94210dc5fdc5d2a2b9285836bdce8934cc86a1cc3f47a2f520b15db84f755ac2e7c67e0247099648d292bbd5fb76f683d928df
SSDEEP 192:uamDOWOhWKT71ojDBQABJUBXqnajL1dHx3tKCJAH:l/WOhWLDBRJUtlXBtpOH
TLSH
T1CE52088356E4BA07E9DB0B7112FDD7DB3B3817C119D061668127D8D83A86385FE13A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 9753ae83536767c73e340c36c5f1610bc76a3e67e033b07503ec31431cba7b90
MD5 a0a883e26be6800508162e2a898148d9
SHA1 4f79892e7766cb7831211864978575598c86a11b
SHA512 70904f2fd074073aebcf665178b34cf7f0f42ced7223ca296f7f202f6fa0175ace2832d9802f5bff4d67891ca09ae14fac47420d69107e72aa44b541a190f6c3
SSDEEP 192:jfHQduLWOhWnT71ojDBQABJcGqnajMHxxBNT06YeOh0:jf9WOhW0DBRJcGlI66YeOi
TLSH
T140421A934FA85543EAA76FB053FCEB833D3E678218208666046AF5893C437D1EF1162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\concrt140.dll
Size 242KB
SHA256 2423a2a62fe0369c610837e240d691da727d95a9c1d5add512d0d0c32e328836
MD5 cf1f7f3e7c30ed97113b667a414fd5d3
SHA1 be9f8fd21ec35cde4669b30bd241c1b74bd1475f
SHA512 9c9fddf00abee52dbb65f14b711e7496edf0a9d8a2d59ca299f40a30c79fd9edb010fa19dc632d3f0bb840a747d787a2616d18050de6376c4334d59f4cd1c8b7
SSDEEP 6144:fFSqgBLDeJkGOZAuaXE1TIh1MuyJ9eaJXUHKbOxA12z/W3NrrQ:fFRgMUlIh1ceLwOfz3
TLSH
T1D6346DA1754444FBE79B0336983CEA3F207FEB002BEA81D72F589A4D1E656C1EA31457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnmultiplayerex.exe

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\dnmultiplayerex.exe
Size 1.8MB
SHA256 689657e7be972d4986030670538c0d68e70a3732f241a86b391139958c8d21b0
MD5 104d7bc38f71da44ed206137ba3de6aa
SHA1 09bbb41f0cc30abb1ee2d9c1086a6cd6bc4d746c
SHA512 21ea4ea8d6ef0f87aff4ed810a78a71538d9b8c41193e48a8e0db7b00cd18ec9e92db6f66604ed69cbcf45320662e3a5136fae7f91caf2e1f4c03148c4001d5e
SSDEEP 24576:6Cg08yjxRGZfRQBMlsc0Ii4tUIBPznuLGQm9zUUOt4TKCCYHS1KOzfcIuKLf0DR5:l1RsywXUUOC2bDYRr1STi
TLSH
T184958E203645C13AF66701B5BD7E6A9A956DBD300BA594C7A3D0352E0D63BC23E33B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\msvcp140.dll
Size 446KB
SHA256 fa21058e50d0d6860da87d784f573670bf5d3efd65158145954ef96d0cd403cf
MD5 4835a9b8749970d0ad04f22a546042af
SHA1 f89d579c0b0c4afe2ca8283d222f44051d2e7c94
SHA512 7379678fd9454bac2042e69636718c0c568d61fba40cd0ca064baee044018f007625fb0acfb77d249768c0e36ba1353078167148825df4f4496ecf860e57ce00
SSDEEP 12288:Xtj8ci6gem4TxhFJedkhUgiW6QR7t5s03Ooc8dHkC2esDnit:dj8NX4T1Jep03Ooc8dHkC2eWni
TLSH
T185A43923BB460DF2D68E43B531C9832667F5FC6547A0B3C363DAE0696F682C26633651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vccorlib140.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\vccorlib140.dll
Size 267KB
SHA256 ad003c5fccf5655f1c0db97755e6e24cd0b6830c21eda6804171ac504f03fbda
MD5 96c0173b467bf4664df0e8a11cea30cc
SHA1 ae9fc9fe248e53c8c5a384daefcd8db61fcb1947
SHA512 c696a173dfdab41caef6247ad38ca646ed103bc774a4731735fc90f77727d952ddaec48f259b284c897806e9cd84bbc2dfec23537cf9ea81e9c0203c3409efda
SSDEEP 3072:OZBIUixXEeuIxyFVZff8I0s0/ISgrJCHB/H4z/3nPq8yoer:SBe2Nz0b/NoJCHBkaZH
TLSH
T1BE444C31369CB4B6D4BF2534DAA0A62811A7B4500FD1D3CBAE50DBCE2E653D14E34A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path F:\LDPlayer\LDPlayer9\ldmutiplayer\vcruntime140.dll
Size 84KB
SHA256 1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
MD5 ae96651cfbd18991d186a029cbecb30c
SHA1 18df8af1022b5cb188e3ee98ac5b4da24ac9c526
SHA512 42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7
SSDEEP 1536:RPwKQRaeU5QsPWFP/wPENm2eK7oJnoUSgpAY8ODcDcm7cIs+4ecbV6iVBoA2r:RwKQRbU5P4XwPENm2eK7mnoUSgpAY8Oa
TLSH
T17A837D11B1C040B1E15608B612E99B23FA7DA3734FD94DCF5FAA5C8C1AB93D2A73425B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phones.data

Path F:\LDPlayer\LDPlayer9\phones.data
Size 5KB
SHA256 657fec32d9ce7b96986513645a48ddd047a5968d897c589fbc0fc9adb8c670f4
MD5 fdee6e3ccf8b61db774884ccb810c66f
SHA1 7a6b13a61cd3ad252387d110d9c25ced9897994d
SHA512 f773f6fc22adadf048b9bfb03e4d6e119e8876412beb8517d999f4ed6a219e2ba50eded5308d361b6780792af9f699644e3a8b581a17d5a312f759d981f64512
SSDEEP 96:w45mX2mFm0r7sP9M95QTZEegefhm9uoHIKtiYcCCOyzZX/y0o0PPya8qj0+PlB/i:w45mXHFm0r7sPS95Q9Eegefhm9uoHIKl
TLSH
T163C1EE57BBEE4E571ADC7DCE3274C9973A0CC449C28D18F839082876DA8C9314375BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-console-l1-1-0.dll
Size 18KB
SHA256 4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131
MD5 cde2424d99db56dd0d1eaf34811738c1
SHA1 cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f
SHA512 d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2
SSDEEP 192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn
TLSH
T16A822892CEBC9583ED969D7017A8E9837D3DEBC71D10A15521AAF4D838C33D1EB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-datetime-l1-1-0.dll
Size 17KB
SHA256 69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725
MD5 acf4321ac8c8ff4d0442c799d621f8d9
SHA1 b12f87e6afc48697f1ce8b587715361e89b79cae
SHA512 7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde
SSDEEP 192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+
TLSH
T102823A929BBCD083ED979D3063A8E9837D3CDBC75D10416A05AAF5E82C833D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-debug-l1-1-0.dll
Size 17KB
SHA256 290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956
MD5 3c47c25b8141d20b2b4d576000000a61
SHA1 04543f9cdd847ff66389c9fd1e12b444dae6383a
SHA512 c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a
SSDEEP 384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI
TLSH
T12F8218918ABCD583FE979E3062A8EE837C3DA7C71D10556605A9F4E82CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-errorhandling-l1-1-0.dll
Size 18KB
SHA256 573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410
MD5 e05ce0232e64328c62c9da37698566bf
SHA1 50c25e6ecec2cd17ecf3117bb9a646ba107d2b84
SHA512 8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb
SSDEEP 192:MmxD3KXWuufhW+sivT16uDBks/nGfe4pBjSfhXa8WebtuVaVWQ42WyMsVqnaj87p:MVXW5hWyvT1Nq0GftpBjSZgkldri
TLSH
T1008218929ABCC083ED97AD7023E4EE837D3CABC35D10556909A9F5D828D33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-1-0.dll
Size 21KB
SHA256 74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830
MD5 a26c7ffcf18b62904dab7786de638ea6
SHA1 b28489bc38ee2f522ee83dcf49faeb96f39a77e3
SHA512 768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f
SSDEEP 192:sohaYPvVX8rFTscWuufhWrlFO0ruDBks/nGfe4pBjSb68WebtuVaVWQ4mWst1qnq:JTPvVXiW5hWB80aq0GftpBjQZplBLcQ
TLSH
T10EA20983D9B8E297ED8F9E3112A5D9836C3893C60820459616E9F39D3CD33C6E79895C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l1-2-0.dll
Size 18KB
SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
MD5 6a55a7e284b51b086b63cc6f2061ce8b
SHA1 46a48a1ccf5262038b71ed4be09cf625009d078d
SHA512 6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363
SSDEEP 192:ByWuufhWrRivT16uDBks/nGfe4pBjSb9bXe8WebtuVaVWQ4mWWrRHqnajjpxf9cS:ByW5hW0vT1Nq0GftpBjSbRZnlHlBLcYl
TLSH
T1998219928ABCD483ED979D7063A8E9837C3CDBC35920416905A9F4E82C833D1EF1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-file-l2-1-0.dll
Size 18KB
SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
MD5 6e38a6bed88e1c27155e4dc428188ef0
SHA1 8b47a1960ed157f7beeb80fa4a16a723279c4efa
SHA512 3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab
SSDEEP 192:HX6WuufhWr7FO0ruDBks/nGfe4pBjSbnUqs28WebtuVaVWQ4mWOYVqnaj87X/fA2:HX6W5hWX80aq0GftpBj2spZkldrps
TLSH
T1508219D19ABCC583ED8BAE7012E8EA837D3CABC75D10415616A9F1D82C833C1EB1496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-handle-l1-1-0.dll
Size 18KB
SHA256 d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4
MD5 9304209688e2a18d0b26997bc78fda7a
SHA1 5d4332cf1c5123418c6419d0291486c3939e8785
SHA512 5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960
SSDEEP 192:KKWuufhWr2ivT16uDBks/nGfe4pBjSbYA/8WebtuVaVWQ4mW7TqnajPf33PLlYoM:9W5hWHvT1Nq0GftpBj4UZAljZYsqTr
TLSH
T1AF8219D2CA7C8583F9979D3013A9EA837D3CDBC75C10916A05A9F4D828933D1EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-heap-l1-1-0.dll
Size 18KB
SHA256 f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234
MD5 f42a84d78a5a15ff1a4dbac591e95783
SHA1 1cd5b5e68fd729bdd340463b53728634d342b0cd
SHA512 89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0
SSDEEP 192:3liWuufhW3XUxQmLuDBks/nGfe4pBjS7LX28We8WebtuVaVWQ4eWmQQPqnajy3Ss:3liW5hWOQ7q0GftpBjkEZfQQPlGinjqZ
TLSH
T11B822985CABCD583ED979D7023A4EA837C3DE7C61D10555605AAF1E938C33D1EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-interlocked-l1-1-0.dll
Size 18KB
SHA256 f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970
MD5 9f286e57e5b1c1a347adf9eef059ad5d
SHA1 631aa1aa364234acc5ad20b27f926e9cb9ee4276
SHA512 6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197
SSDEEP 192:KWuufhWr3ivT16uDBks/nGfe4pBjSbKUs8WebtuVaVWQ4mWMoTqnajPf33PLlYoS:KW5hWmvT1Nq0GftpBjGzZv4ljZYsqHh
TLSH
T1E38209928EBC9583F9979D7013A8EA837C3CEBC75910515A05AAF4DC28C73C5EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-libraryloader-l1-1-0.dll
Size 18KB
SHA256 f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141
MD5 beaae8294db31afa04fa60795c6e02ae
SHA1 8a32ebd843e461864747fe0aebf4bbf83c4ec093
SHA512 dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135
SSDEEP 384:rvuBL3BEW5hWh3rq0GftpBjzkZalBLc2V:aBL3Brii2sV
TLSH
T1BF8218C2CBBCE583E99B9D7052A8D9833C3997C75920946A01EDF5D928D33D1FB14A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-localization-l1-2-0.dll
Size 20KB
SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
MD5 2ac1289e4dbab076b332869bef26d3ce
SHA1 60570ddd06b671e26c6a814b9c08cdfa0ef38aba
SHA512 e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a
SSDEEP 384:ptAuOMw3zdp3bwjGjue9/0jCRrndbAW5hWA80aq0GftpBjV+ZZrmlGinjQKKX:DAuOMwBprwjGjue9/0jCRrndbX4i3qdT
TLSH
T154922B92CAB8D283FC8EDD703266E9837C39D7C60D11955106E6FAA834D33D5E754A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-memory-l1-1-0.dll
Size 18KB
SHA256 dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd
MD5 a2661a468bb87ee9cc5dee968fd3805c
SHA1 9b17fbd552e34888f1453f9113ff4c42efaf6d6a
SHA512 b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3
SSDEEP 192:zQWuufhWrixf/0uDBks/nGfe4pBjSbl7Y88WebtuVaVWQ4mWyymqnajiG7AzTvfJ:zQW5hWS3rq0GftpBj9jZlymlO62vfGkb
TLSH
T18C822A8186BCD583E8D35D3063A8DA83BC3D9BC74D60955A11A9F1D928C33D5EB2492E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-namedpipe-l1-1-0.dll
Size 18KB
SHA256 b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e
MD5 acbfc011d5842ba60c372ba3d222ab70
SHA1 16b8014060a04bb03215f6ce4c118bae48653bd5
SHA512 dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3
SSDEEP 192:1cIWuufhW3bFO0ruDBks/nGfe4pBjS7irpMk8WebtuVaVWQ4eW5eqnajy3Snk0b7:CIW5hWL80aq0GftpBjNUZkelGinjn
TLSH
T173821791CA7CC583ED8B9D7013A8E9837D3DD7C71D10945515AAF8E928C33D0EB28A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processenvironment-l1-1-0.dll
Size 19KB
SHA256 1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae
MD5 19d14d348ac38737431a7ee2f82973e6
SHA1 11cd8f5dc5c08d133b9b006da5c84946f012cbb6
SHA512 b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc
SSDEEP 192:AlWuufhWrExQmLuDBks/nGfe4pBjSbYsqwZ+8WebtuVaVWQ4mWXqnajnp+MVQ/Tz:AlW5hWaQ7q0GftpBj5VghZoldBQ7Q8PX
TLSH
T1B79229C19ABCE143FADB6D7012E8E9937C3997D71C1040A55169F6E828C33D1EB48A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-0.dll
Size 20KB
SHA256 2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0
MD5 ea0e13feac13dc18c79eb682bef4676e
SHA1 b9db47624345c68cf07bd2677df537e0f975caf9
SHA512 540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7
SSDEEP 384:ik1JzNcKSIUW5hWP80aq0GftpBjMJZCZslGinjI:9cKSupiEgZ40
TLSH
T1569219D1CABCD2C3E88A9D306394EE837D3AD7C61D25456105A9F6E93DD73C2D62882C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-processthreads-l1-1-1.dll
Size 18KB
SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
MD5 1af2a91dc0a4e48bab0ca123073adf30
SHA1 cf6625fd31b17d46dd31b16372840c74026d0ba2
SHA512 45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51
SSDEEP 384:vIDfIenW5hWsvT1Nq0GftpBjeOZLlGinjx:ve2N1vi/l9
TLSH
T11F822A81CABC8583E9D79E7063A4EE833D3DDBC71D20906508A9F5E828C73D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-profile-l1-1-0.dll
Size 17KB
SHA256 cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786
MD5 9b9d1949b75df171884f6f8caba7ff59
SHA1 411adf413f53c56488d5cf68e9b4b692889f3c4b
SHA512 dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c
SSDEEP 384:yW5hWgR80aq0GftpBjHLzZgfhlg+ZmJy:dmi1LzWflu
TLSH
T18C820991CA7C8483E997AE3063E9EE83BD3DABC71D10556601A9F1D92CC33D1EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 18KB
SHA256 eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f
MD5 c6e268c877a9be5b43877308b1231120
SHA1 949105c826dee6a32fe1288285e3e41cb7d04821
SHA512 776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331
SSDEEP 384:HGeVxW5hWEvT1Nq0GftpBjvOZZljZYsqzN:HGeVcF1viJOYnzN
TLSH
T1008219D68ABC9483F9979D7013A9EA877C3CDBC75C60916604A9F5D928C33C0EB2492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-string-l1-1-0.dll
Size 18KB
SHA256 7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c
MD5 5122b8aa14a25c8567d9d0335036446f
SHA1 81961f2c8a331136f8156930779964a71e0badc4
SHA512 758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9
SSDEEP 384:1yMvIW5hWER4Zq0GftpBjpTuZV0lO62vfGU:1yMv/L47i7STVHGU
TLSH
T1398218928ABCD183ED975D7023A8EE837C3CABC71D10526951A9F0D82C833D5EB1492D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-1-0.dll
Size 20KB
SHA256 5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b
MD5 e1b30d56617709cf7dff5f464d7566d9
SHA1 e29646b1c90550cb86ed42782c764d41f2c70651
SHA512 e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511
SSDEEP 384:pvdv3V0dfpkXc0vVa/W5hWiR4Zq0GftpBjkYZjsdljZYsqmb:ldv3VqpkXc0vVau547iCY6Onc
TLSH
T180922982DAB8E583F89BDD7052A9D5837C3897C34820856611E9F5ED3CD33D0EB1892D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path F:\LDPlayer\LDPlayer9\vbox64\api-ms-win-core-synch-l1-2-0.dll
Size 18KB
SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
MD5 e4b64b2710725ec3332021bd8044d884
SHA1 2d7f8d87d0f395296ecdf277084d23cb9e0880e8
SHA512 ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2
SSDEEP 384:stZ3KW5hW4R4Zq0GftpBjsnTZWFlGinj6m:oX47iiTomm
TLSH
T1B2822896CBBC9583E9979C7063E4EA837C389BC61D20556115AAF1E92CD33D2EB04D2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leidian0.config

Path F:\LDPlayer\LDPlayer9\vms\config\leidian0.config
Size 636B
SHA256 519e0911e8d7232a2763e65d70b154cab6b6b4e997d2e746e1e3788c71bbf780
MD5 e1b3d42bfac888d1c28867e2bbb7e74d
SHA1 d95cfe3f67626b34730495b53e8b1192bfa84e98
SHA512 c96eae9199c8844880c0608c671503117c358b420e80bf2897dd1f34c8281d222582e3b393f8e9c11881529b9be59131d1c2d9c2a21d55d1364410a0aaff5b89
TLSH
T1E5F0C813FE099C5F05E828027D645B01F8209A0F1BA57223733E59199B29CFDB7C5C32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5408-1274-0x0000000070F40000-0x0000000070F67000-memory.dmp

Download

memory/5408-1278-0x00000000707C0000-0x00000000707F8000-memory.dmp

Download

memory/5408-1271-0x0000000071370000-0x000000007247E000-memory.dmp

Download

memory/5408-1281-0x000000006F310000-0x000000006F332000-memory.dmp

Download

memory/5408-1275-0x0000000070B80000-0x0000000070C1E000-memory.dmp

Download

memory/5408-1280-0x000000006F350000-0x0000000070783000-memory.dmp

Download

memory/5408-1276-0x0000000070850000-0x0000000070869000-memory.dmp

Download

memory/5408-1279-0x0000000070790000-0x000000007079C000-memory.dmp

Download

memory/5408-1277-0x0000000070800000-0x0000000070850000-memory.dmp

Download

memory/5408-1273-0x0000000071060000-0x000000007133E000-memory.dmp

Download

memory/5408-1272-0x0000000071340000-0x0000000071370000-memory.dmp

Download

memory/5408-1222-0x0000000036A10000-0x0000000036A20000-memory.dmp

Download