General Info

File name

LDPlayer_ens_3010_ld.exe

Full analysis
https://app.any.run/tasks/8d47aa32-b182-42cd-8e06-57d87df6c4fa
Verdict
Malicious activity
Analysis date
12/3/2019, 02:10:38
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

adware

installcore

pup

Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

1c9d03acc5ce4d1565e01418e2892087

SHA1

345be215d0017d06a3934150105389730038fa69

SHA256

bdb03d50cba10bbbaea2409521c515d15f3e674e6ccabbadfec319bdc08cd1ea

SSDEEP

49152:gnHn5pXUXb6c9YuoHjAbDiYFpIDckO4iNQxgei6HQR9sXafgkDFMVR9C1UhPJXMS:45pEXOc9AH8FpQrDgeJrBiCV2HXq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (75.0.3770.100)
  • Google Update Helper (1.3.34.7)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.7.2 (4.7.03062)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Access MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Groove MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Groove MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office IME (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office IME (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office InfoPath MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Language Pack 2010 - French/Français (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - German/Deutsch (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Italian/Italiano (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Japanese/日本語 (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Korean/한국어 (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Portuguese/Português (Brasil) (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Russian/русский (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Spanish/Español (14.0.4763.1000)
  • Microsoft Office Language Pack 2010 - Turkish/Türkçe (14.0.4763.1013)
  • Microsoft Office O MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office O MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Arabic) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Basque) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Catalan) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Dutch) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Galician) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (German) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Proof (Ukrainian) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (French) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (German) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office SharePoint Designer MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office SharePoint Designer MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Office X MUI (French) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (German) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Italian) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Japanese) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Korean) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Portuguese (Brazil)) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Russian) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office X MUI (Turkish) 2010 (14.0.4763.1013)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
  • Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
  • Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
  • Mozilla Firefox 68.0.1 (x86 en-US) (68.0.1)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB4019990
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
INSTALLCORE was detected
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Connects to CnC server
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Loads dropped or rewritten executable
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Executable content was dropped or overwritten
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Creates files in the program directory
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Creates files in the user directory
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Reads internet explorer settings
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Reads Internet Cache Settings
  • LDPlayer_ens_3010_ld.exe (PID: 1096)
Reads Environment values
  • LDPlayer_ens_3010_ld.exe (PID: 1096)

No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win64 Executable (generic) (76.4%)
.exe
|   Win32 Executable (generic) (12.4%)
.exe
|   Generic Win/DOS Executable (5.5%)
.exe
|   DOS Executable Generic (5.5%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2019:11:12 10:42:10+01:00
PEType:
PE32
LinkerVersion:
12
CodeSize:
842752
InitializedDataSize:
3240448
UninitializedDataSize:
null
EntryPoint:
0x98647
OSVersion:
6
ImageVersion:
null
SubsystemVersion:
6
Subsystem:
Windows GUI
FileVersionNumber:
1.0.0.0
ProductVersionNumber:
1.0.0.0
FileFlagsMask:
0x003f
FileFlags:
(none)
FileOS:
Windows NT 32-bit
ObjectFileType:
Executable application
FileSubtype:
null
LanguageCode:
Chinese (Traditional)
CharacterSet:
Unicode
CompanyName:
XUANZHI INTERNATIONAL CO., LIMITED
FileDescription:
LDPlayer
FileVersion:
1.0.0
InternalName:
ldplayerinst.exe
LegalCopyright:
Copyright (C) 2016
OriginalFileName:
ldplayerinst.exe
ProductName:
LDPlayer
ProductVersion:
1.0.0
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
12-Nov-2019 09:42:10
Detected languages
Chinese - PRC
Chinese - Taiwan
English - United States
Debug artifacts
D:\work\trunk\downloader\bin\ldplayerinst.pdb
CompanyName:
XUANZHI INTERNATIONAL CO., LIMITED
FileDescription:
LDPlayer
FileVersion:
1.0.0
InternalName:
ldplayerinst.exe
LegalCopyright:
Copyright (C) 2016
OriginalFilename:
ldplayerinst.exe
ProductName:
LDPlayer
ProductVersion:
1.0.0
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x00000128
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
5
Time date stamp:
12-Nov-2019 09:42:10
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x000CDB4C 0x000CDC00 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ 6.55281
.rdata 0x000CF000 0x0003538C 0x00035400 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 5.07718
.data 0x00105000 0x0000F108 0x00005600 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 5.0158
.rsrc 0x00115000 0x002C6B88 0x002C6C00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 7.17263
.reloc 0x003DC000 0x0000BE40 0x0000C000 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ 6.57598
Resources
1

2

3

4

5

6

7

8

9

10

11

12

13

130

131

132

133

134

135

136

137

138

139

Imports
    KERNEL32.dll

    USER32.dll

    GDI32.dll

    ADVAPI32.dll

    SHELL32.dll

    ole32.dll

    SHLWAPI.dll

    WS2_32.dll

    WININET.dll

    PSAPI.DLL

    IPHLPAPI.DLL

    COMCTL32.dll

    IMM32.dll

    OLEAUT32.dll

    gdiplus.dll

Exports

    No exports.

Screenshots

Processes

Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

+
start ldplayer_ens_3010_ld.exe no specs #INSTALLCORE ldplayer_ens_3010_ld.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2872
CMD
"C:\Users\admin\AppData\Local\Temp\LDPlayer_ens_3010_ld.exe"
Path
C:\Users\admin\AppData\Local\Temp\LDPlayer_ens_3010_ld.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
3221226540
Version:
Company
XUANZHI INTERNATIONAL CO., LIMITED
Description
LDPlayer
Version
1.0.0
Modules
Image
c:\users\admin\appdata\local\temp\ldplayer_ens_3010_ld.exe
c:\systemroot\system32\ntdll.dll

PID
1096
CMD
"C:\Users\admin\AppData\Local\Temp\LDPlayer_ens_3010_ld.exe"
Path
C:\Users\admin\AppData\Local\Temp\LDPlayer_ens_3010_ld.exe
Indicators
Parent process
––
User
admin
Integrity Level
HIGH
Version:
Company
XUANZHI INTERNATIONAL CO., LIMITED
Description
LDPlayer
Version
1.0.0
Modules
Image
c:\users\admin\appdata\local\temp\ldplayer_ens_3010_ld.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\psapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\msftedit.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\normaliz.dll
c:\users\admin\appdata\local\temp\fusion_ld\fusion.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\version.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\olepro32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\wintrust.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\sxs.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\winsta.dll
c:\windows\system32\propsys.dll
c:\windows\system32\mlang.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\jscript.dll
c:\windows\system32\rpcrtremote.dll

Registry activity

Total events
116
Read events
88
Write events
28
Delete events
0

Modification events

PID
Process
Operation
Key
Name
Value
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASAPI32
EnableFileTracing
0
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASAPI32
EnableConsoleTracing
0
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASAPI32
FileTracingMask
4294901760
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASAPI32
ConsoleTracingMask
4294901760
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASAPI32
MaxFileSize
1048576
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASAPI32
FileDirectory
%windir%\tracing
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASMANCS
EnableFileTracing
0
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASMANCS
EnableConsoleTracing
0
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASMANCS
FileTracingMask
4294901760
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASMANCS
ConsoleTracingMask
4294901760
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASMANCS
MaxFileSize
1048576
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\LDPlayer_ens_3010_ld_RASMANCS
FileDirectory
%windir%\tracing
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
1096
LDPlayer_ens_3010_ld.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
LanguageList
en-US

Files activity

Executable files
1
Suspicious files
0
Text files
77
Unknown types
0

Dropped files

PID
Process
Filename
Type
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\Fusion_ld\Fusion.dll
executable
MD5: 7d900a78879abc427d67533fea28a2bb
SHA256: b4eba257269060b9ee20c0c24d943d31d81a6da7b26c33c2ffac311a977d5404
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\KA.locale
text
MD5: 1a4abc33ce6e481942ecc7de68ca8d9c
SHA256: 70a39de6f6c425e362bafb70401e762fd724be0aa208748378d199ac4aab3072
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\003A1090.log
––
MD5:  ––
SHA256:  ––
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\ZU.locale
text
MD5: e0fe6b07557ceadb3cdee5cd6bf1553c
SHA256: 9a5f171619d63344771d0af667662cc3672222166fc7d5368724b818d4508b24
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\ZH.locale
text
MD5: f87a44df4ee66271fcb7cb8909be2c2e
SHA256: f212cbeb0355b860a19969bf9a685b6aae5e8cd1b50ca97ec59880bdbaac24ad
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\UZ.locale
text
MD5: d7bb18debd6ae4b95ca1128a01550970
SHA256: 816b2817affbeb1d634235c0d901bdf45504da18527b5cce6895b4cf8cf8e7ba
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\VI.locale
text
MD5: 1c68a0b054e91821a6ee5fcc95a8f370
SHA256: 949be3edb5994b200e83ca062b6badcffdac4c177ce1a77b2976ede622797399
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\YO.locale
text
MD5: 28cadcc5482ef94c3dd399966efce474
SHA256: 18350d0b95fea022fe7f65b2c21748423ad96ac9f4a87e833395873d45130dad
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\TL.locale
text
MD5: 4685406c7549ce5fcb79fae49c013dec
SHA256: 107c995c36d3412886613b05e62bf27c8941b106912c2ed9e9ac54b7240f7524
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\TR.locale
text
MD5: 9456c52aed7848fb1ff6d05de42e8391
SHA256: dd4e1cbeabc982697c1d4227f4c8cd18413351a279962a40041cafe3e427b036
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\TE.locale
text
MD5: 4c04155e36f1c718a97bcf3f4ba20697
SHA256: a85fdcd0a5fbc7b09f1401a343f2c7d334caac8d7dfbd0d3bfca20a9fd76d7ec
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\TH.locale
text
MD5: 02b331449294adfdbbafa59074e4984c
SHA256: c53cf743d7169e2d17433d5f123ac45a672d415484fed6af4cbe0f8441b88515
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\UK.locale
text
MD5: 805b4a7d627d697d81889e90b5dc26f1
SHA256: 63148079e733a889e2531b21e0234c1ba7f1c981f9c1d025e539a5a3b420e065
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\UR.locale
text
MD5: f98806a6c51ad09ab464191f95320bba
SHA256: 5e7131784e1de61479c8dc8bfcf8de40ed07f4d0ffdd4a29c42be6f298ad169f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\SQ.locale
text
MD5: 393bf5a36c36bd97b7f206a13d602827
SHA256: a6b643c1d26d2a9d13c94c147ba35a520b749c40af3e729910fa99eb636fc63b
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\PT.locale
text
MD5: 49b6cd7b7b3df73b1de5bb76c4f22e2f
SHA256: bdb75d81031c2e2c588d4be0ad4c303141259dd88e19b3ae9d77580224037998
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\SV.locale
text
MD5: d9fd720403c7b8c786224b693c6331ad
SHA256: f7361ffcba975398338a814f1f061720064d58fd838d2b8879f1b3e6dc5138aa
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\RU.locale
text
MD5: 84c7cb5b39f47ab1cd80ce1f0c25921e
SHA256: 8012719a70324556c482dd3598ba2ed2f959d5dec8a6db44faa421ef672becca
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\SK.locale
text
MD5: 405b3c6f0e68d2db60d1585385896623
SHA256: ee1ce5e2bfe867f5600c4a15c47b9d319e23046de25bee4c21b1171bb21a9623
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\TA.locale
text
MD5: 0357e9121095334fb270b19d2e847368
SHA256: 009f1c6bfbb1f39d8a59e9a8fc589f4dc8a978b4150c283fb2f3f1dfca7a4b87
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\RO.locale
text
MD5: 44652248cbb99cea6dd8f5613b874cfa
SHA256: 57a1b5998c567221f90bfd66f42161273ddd60f52418de1fc939e9c86a51cef9
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\SL.locale
text
MD5: 84cc837239842449c8ff335b165c07e6
SHA256: bbe36fcc8d9404395a3e85f76479a6f4f4ec67106e53ad93a3d70747e5157a3d
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\SR.locale
text
MD5: af688f29d4745ac3d641017da91ef575
SHA256: bb47f7a85af70aedbb61c86c7ed7199aafb823350b185722468f7a6d492b2632
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\PA.locale
text
MD5: ab30b346b4c737c4a9c3ba9b49f2ba83
SHA256: f57cb5d5f9225c52dce26ef9ba742a36b5958f927eec5cd6c898f4f7ea3c3b9c
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\MR.locale
text
MD5: bbaf39e1500f3851ad4ea9a0f8d8e3fd
SHA256: 988c7d261cab45a65b09cb485405da216f34c75d228c7e934c309999d3fbf8dd
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\NL.locale
text
MD5: ade4560acaaf360f9dc5e590419abe83
SHA256: 23d3afc51acc6f786f6fcb46aeb0cf74af9f430a0aa539916f68c6be8a7add48
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\PS.locale
text
MD5: 06efce2d687d52bcb57a48e8b0b726b4
SHA256: 45a64d28eb92e02855f2ba2c1999cb217ff84f4bc9abc89e49c974cfc884a847
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\MS.locale
text
MD5: e333713949b150ee82345f922e0040ec
SHA256: 44d77861ff9fc61c13bc1408e2e8d43c32673844c7f0b04e17f075232e4ba7de
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\NE.locale
text
MD5: 5d79e5cec4f95a3ca6a202970ced6d6e
SHA256: 54f1ddd4b34f705ee10714210e71f59ee51b8931a07b190920bbba2e03950c09
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\PL.locale
text
MD5: fb48165b230ae752119d6f89bd7699ee
SHA256: 6c83b789070f2f9f193aaac52e6f610e6766007352bebb7ee9f6113439ccae48
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\NO.locale
text
MD5: 2febd73097d15772b1c90a4e12278018
SHA256: 8585251a7a33f40b2cebb310f57ac0f80dff863bffec69874eb20923eb98adbf
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\LO.locale
text
MD5: 08a83d5e6c8683249c5c3b195a33a007
SHA256: 7dd5d3b863ae1c4fce0a3342646639cc8dac2423b2addcc14bcc585a7b8dd83f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\LV.locale
text
MD5: 5db26fee22efa33110cdc356002e82ae
SHA256: a925bc583d473136f561fbc2893685ad0112cd578d7fec9ced53cab8a8bf4681
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\KO.locale
text
MD5: dbf7f7864e99ee24bee3a2acdb534766
SHA256: 9039e23765337dcfff2cf9eefbb33a6394c5fe402843209298ef0f31db3cb494
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\ML.locale
text
MD5: 119243b7f2c19e278e4684d266de18e6
SHA256: 5db2b398c16f0c95f1caa5d268be5b6fa2da37072bf3522b9d911a7cbe7e19d8
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\IT.locale
text
MD5: 5beb8094b02db5fe5acb113ea615b428
SHA256: 046a44dbd7f96007576ae6e193d308b16dd409f24b3434b2f97bc9e32d03ebec
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\KU.locale
text
MD5: 1b0984c7b45d39fb72f200c72c1d00bd
SHA256: 6ee56f9f35e3c11102221ea9fd6bb083e75826c9dad46fc9fd5705363b191e40
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\KK.locale
text
MD5: 27cadfd9aa0fe98538ea44e91c149070
SHA256: f4ba3b56a35e18371e059ba3b9e9711c3cd99d04295ba51ae826767c12aa38e9
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\MK.locale
text
MD5: 9766f19ce1168c26a4ba2ab95e177759
SHA256: a4968d3d8bed8e9ea59f980fc5b31b27bf81911036d70f9305956ede2d92f28f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\JA.locale
text
MD5: 6bc9980050aed56c2eab3b378bd2ca7c
SHA256: 330e2fcef32fdf2acc2e0ca307436926ffb03532af10bea54ea6c1d66ef9e32f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\LT.locale
text
MD5: ed29292834140f8500e4548bf3dffbf2
SHA256: 278889852149473c3f2795593f25a1e544e367a07297573f01e712dde175fee8
1096
LDPlayer_ens_3010_ld.exe
C:\Program Files\003A11F7.log
––
MD5:  ––
SHA256:  ––
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\GU.locale
text
MD5: d58f240e4f4d700b8523cd8ecb3a83e2
SHA256: 25f31b56585cc3a34b59b9e72e8eff6a654d911fe1c7fb18feeb8dc62d4e0331
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\HU.locale
text
MD5: 7cce69e942d9e14a1cf10280499a2667
SHA256: 83001fce7998f3de063073587f905a13c7649f45ffd3139e8f589978e8fdaf7f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\HY.locale
text
MD5: ab8b9b0e16b5ef75e0357a8b3f490e05
SHA256: 480570dada38e88b723aa39ac7d79eac7915eb72550b96157022ee0324406804
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\ID.locale
text
MD5: e871501287a24ef0d6802d62cd27b46c
SHA256: 0f2899ee236e8d53022ab9f18202114e1567e6c8c93a3fdd128f38bb80355931
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\FR.locale
text
MD5: 227c91a86f898c3b565180646141d680
SHA256: 5109297aaf2b41406b4b210c1da7cfe462c195af1b2bf1b60225477903919bc2
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\IS.locale
text
MD5: e43741977970f32159950e862a2e51ca
SHA256: f6706486f6928bc7f56e5ba9269cb57780a1a3db1cf08ccbf477418579e2b421
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\HT.locale
text
MD5: 642c180660f79cd3cc7d841614b57365
SHA256: 045aa565e48add4ccbeab74bf38248733e0c4d8becaefab19a6746213ba17762
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\HR.locale
text
MD5: 0df1fbe32d5c0037c39d94981f56e186
SHA256: 9078de8455c43a85408108abe2181be496897dc0bcbf533b15098fcddd4ebce1
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\FA.locale
text
MD5: 9dbb5724b5a1526b1bfad362d67854f2
SHA256: b154cb9b33a3f2d3390b201025a027c0dee848f98118d601a5710988e95e33b3
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\FI.locale
text
MD5: aa02a7f1269174618543687ea202f385
SHA256: b891b31e69071351a1669b93f35c434f094973931572dfe36b3c24e648a0d12b
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\HI.locale
text
MD5: 791e420383be8d190644640fe7a10ab6
SHA256: 38c96d6da4f0b00a61cfc0f3734b80a37cf79d92cb583428e23e8381746081ca
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\HE.locale
text
MD5: d1aea6c331c1db405a2a991346533477
SHA256: f71341df3639a6017693333d8bcce3131ca51f428adea6e940e21d2475342b79
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\ES.locale
text
MD5: 53755996be49144a3a83890c026b4049
SHA256: d8cd03140dc31d4d08b2c7cb8067a77ca46ad3c58347988e6625cf15c6c8a4e2
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\EL.locale
text
MD5: 71035ad0232f4d8dc0e837d5865e8834
SHA256: 3aea8bcfd2855028b3c77db0b53627e8884cd9c1d9481a8d83731a9d2b1e5d9f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\EU.locale
text
MD5: 49c617241f6bfd93bc5b4b0573bd8b26
SHA256: 6c7241993651cb8414a78afc817b4a40dbbe3a359e7a8ce1f5e31ac1c6f78171
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\DA.locale
text
MD5: 7b1312c0dea89488087e56d35651e472
SHA256: e2f6b6a141164fd442aeaa79a261f2e9799a0c7700c928df701702468b902a8c
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\DE.locale
text
MD5: ac99de234c1c7dff173e1be6507d2b50
SHA256: 5f5f05b25b6f44af38ae2fabb99b1bb3f4cc9413e2275b2998b0d3771286737f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\ET.locale
text
MD5: 31adb5d5e61e0a2e7fa200340df57102
SHA256: de026d2a590398259e6f34200aceb16ffca75c7b8479930b9c2d5524869cce15
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\EN.locale
text
MD5: 4459c311642a67b43941afcf798d7791
SHA256: d27e381c436210ac3d8c5ba9a2954cc050619b353c99c5978bb775759cd5f3b0
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\CS.locale
text
MD5: 0af631d42063eef22d6bfcf3b1780254
SHA256: 8290556e9ad37befee2ccff5b65aab1dd44ac7f45292220a33ab30282e6b9d3a
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\CA.locale
text
MD5: 18dd92b6bfcf4b2d04ec752f2bbed37e
SHA256: acd3d339fc4c4978bd6942e95f451da49d10e8861d8d89022c9edc62748039f3
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\images\progress-bg-corner.png
image
MD5: 608f1f20cd6ca9936eaa7e8c14f366be
SHA256: 86b6e6826bcde2955d64d4600a4e01693522c1fddf156ce31c4ba45b3653a7bd
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\images\progress-bg.png
image
MD5: e9f12f92a9eeb8ebe911080721446687
SHA256: c1cf449536bc2778e27348e45f0f53d04c284109199fb7a9af7a61016b91f8bc
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\images\Loader.gif
image
MD5: 57ca1a2085d82f0574e3ef740b9a5ead
SHA256: 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\BE.locale
text
MD5: 411748400cd72340bcf29e34f539340a
SHA256: 2c9e5a82c1edabe537c04c330a87332faa1188a4ba3394084e756e9ab2f0066a
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\AZ.locale
text
MD5: 90a482ef6f51d900b5f3fbbfdeeedd8b
SHA256: 254679039a064418809eb8c9187c0d6588a0f2e44c671b77f79c82806c900750
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\BS.locale
text
MD5: ff9188bbc0c3a5c14658db0627b28585
SHA256: add647d223c183f6d56a1aa9a22d2b0436f18c9f972da7bc8705cccf867d74dd
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\AF.locale
text
MD5: 85683d68fac960fd7887669059b18113
SHA256: 6578baf8fab1dce694229303df0bac1be2bca437d05f3391d9939d9610028fe1
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\images\progress-bg2.png
image
MD5: b582d9a67bfe77d523ba825fd0b9dae3
SHA256: ab4eeb3ea1eef4e84cb61eccb0ba0998b32108d70b3902df3619f4d9393f74c3
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\images\button-bg.png
image
MD5: 98b1de48dfa64dc2aa1e52facfbee3b0
SHA256: 2693930c474fe640e2fe8d6ef98abe2ecd303d2392c3d8b2e006e8942ba8f534
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\locale\BG.locale
text
MD5: c77a1f22bc00991db483daad060c21b9
SHA256: f3cfc4b300d6ac056cd21934c9a4cefbfde6531905323f08bf1985f9f3867da9
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\progress-bar.css
text
MD5: 5335f1c12201b5f7cf5f8b4f5692e3d1
SHA256: 974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\checkbox.css
text
MD5: 64773c6b0e3413c81aebc46cce8c9318
SHA256: b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\csshover3.htc
html
MD5: 52fa0da50bf4b27ee625c80d36c67941
SHA256: e37e99ddfc73ac7ba774e23736b2ef429d9a0cb8c906453c75b14c029bdd5493
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\main.css
text
MD5: 9b27e2a266fe15a3aabfe635c29e8923
SHA256: 166aa42bc5216c5791388847ae114ec0671a0d97b9952d14f29419b8be3fb23f
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\button.css
text
MD5: 37e1ff96e084ec201f0d95feef4d5e94
SHA256: 8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\sdk-ui\browse.css
text
MD5: 6009d6e864f60aea980a9df94c1f7e1c
SHA256: 5ef48a8c8c3771b4f233314d50dd3b5afdcd99dd4b74a9745c8fe7b22207056d
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\css\ie6_main.css
text
MD5: 74f08d5a243ae79f1de64dffdaf846cb
SHA256: 15590060bfd227f656e569031113a080e0d45621a5c944dfc352f869eadafef2
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\003A0F48.log
––
MD5:  ––
SHA256:  ––
1096
LDPlayer_ens_3010_ld.exe
C:\Users\admin\AppData\Local\Temp\nsd380500011030\bootstrap_37245.html
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
5
Threats
4

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
1096 LDPlayer_ens_3010_ld.exe GET –– 116.211.221.240:80 http://res.en.ldmnq.com/download/package/LDPlayer_3.76.3.exe CN
––
––
suspicious
1096 LDPlayer_ens_3010_ld.exe GET 200 52.51.217.55:80 http://portal.husarirogbev.com/ IE
––
––
malicious
1096 LDPlayer_ens_3010_ld.exe POST 200 52.51.217.55:80 http://portal.husarirogbev.com/ IE
binary
––
––
malicious
1096 LDPlayer_ens_3010_ld.exe POST 200 52.212.215.62:80 http://server.husarirogbev.com/ IE
binary
binary
malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID Process IP ASN CN Reputation
1096 LDPlayer_ens_3010_ld.exe 52.210.197.124:80 Amazon.com, Inc. IE malicious
1096 LDPlayer_ens_3010_ld.exe 216.58.207.78:80 Google Inc. US whitelisted
1096 LDPlayer_ens_3010_ld.exe 47.246.43.226:80 US unknown
1096 LDPlayer_ens_3010_ld.exe 116.211.221.240:80 CHINANET Hubei province network CN suspicious
1096 LDPlayer_ens_3010_ld.exe 52.51.217.55:80 Amazon.com, Inc. IE malicious
1096 LDPlayer_ens_3010_ld.exe 52.212.215.62:80 Amazon.com, Inc. IE malicious

DNS requests

Domain IP Reputation
encdn.ldmnq.com 47.246.43.226
47.246.43.225
47.246.43.227
47.246.43.230
47.246.43.228
47.246.43.224
47.246.43.229
47.246.43.223
suspicious
portal.husarirogbev.com 52.210.197.124
52.51.217.55
malicious
www.google-analytics.com 216.58.207.78
whitelisted
res.en.ldmnq.com 116.211.221.240
116.211.221.238
116.211.221.241
116.211.221.244
116.211.221.242
116.211.221.248
116.211.221.243
116.211.221.239
suspicious
server.husarirogbev.com 52.212.215.62
52.50.98.206
52.51.129.59
malicious

Threats

PID Process Class Message
1096 LDPlayer_ens_3010_ld.exe Potential Corporate Privacy Violation ET POLICY PE EXE or DLL Windows file download HTTP
1096 LDPlayer_ens_3010_ld.exe Misc activity ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M2
1096 LDPlayer_ens_3010_ld.exe Misc activity ADWARE [PTsecurity] PUP.Optional.InstallCore Artifact M1

1 ETPRO signatures available at the full report

Debug output strings

No debug info.