2e788cb99c13ae5c4af88902d86042d38b520ae446b87bc673c0665a70d855ff

Analysis

max time kernel
22s
max time network
20s
platform
windows7_x64
resource
win7v20201028
submitted
05-11-2020 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup-watch_9082033929.bin.exe
Size

12.6MB
MD5

866851d5c7a0536411545db4c89aaf00
SHA1

c6dcf8511d874a347f83ca324e2a6b36b69a8cc5
SHA256

aee2348118b903e5f5bcd90493f4de2eed7f2575edf2bccad25fb15391f1e7ee
SHA512

6a484075adb926209849ad39407402d10840fc1bff909c1fff4142ba1dadb00a0e0236fa2444a730fbdbe4b184898f8c67a6d024a7a4b0f13df5a3f372e8d725

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

setup-watch_9082033929.bin.tmpwmfdist.exeVideoConverter.exe

pid process

1948 setup-watch_9082033929.bin.tmp
2004 wmfdist.exe
1228 VideoConverter.exe

pid	process
1948	setup-watch_9082033929.bin.tmp
2004	wmfdist.exe
1228	VideoConverter.exe

Loads dropped DLL 7 IoCs

Processes:

setup-watch_9082033929.bin.exesetup-watch_9082033929.bin.tmpregsvr32.exeVideoConverter.exe

pid	process
1668	setup-watch_9082033929.bin.exe
1948	setup-watch_9082033929.bin.tmp
1948	setup-watch_9082033929.bin.tmp
2036	regsvr32.exe
1948	setup-watch_9082033929.bin.tmp
1948	setup-watch_9082033929.bin.tmp
1228	VideoConverter.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

setup-watch_9082033929.bin.tmp

description	ioc	process
File created	C:\Windows\SysWOW64\is-PCM28.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Windows\SysWOW64\is-H8BOO.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Windows\SysWOW64\is-LK27F.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Windows\SysWOW64\xvidcore.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Windows\SysWOW64\xvidvfw.dll	setup-watch_9082033929.bin.tmp

Drops file in Program Files directory 49 IoCs

Processes:

setup-watch_9082033929.bin.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\wmfdist.exe	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\swscale-0.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\SDL.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\ImageEx.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\avdevice-52.dll	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-UHBRM.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-60O7U.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-DU697.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\avformat-52.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\avfilter-0.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\MediaAssist.dll	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-17ECM.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-UTGC8.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-GV709.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-LLNJE.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\Log.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\xvidcore.dll	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-IR7LK.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-ORC87.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\SkinMagicU.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\SkinScroll.dll	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-UTM44.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-MBHKG.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-1L5QG.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-F7G45.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-L8L5M.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-LFMN9.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\Common.dll	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\unins000.dat	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-HE4BQ.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-C99L2.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-7P7LI.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-LVSLR.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\sqlite3.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\CrashReport.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\VideoConverter.exe	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-513VC.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-770I2.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-P1PQL.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-61HT9.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\unins000.dat	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\update.EXE	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\libffmpeg.dll	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-UDBEK.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-PVT4N.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-FH0QK.tmp	setup-watch_9082033929.bin.tmp
File created	C:\Program Files (x86)\Wisoft Free Video Converter\is-IAVTQ.tmp	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\libffplay.dll	setup-watch_9082033929.bin.tmp
File opened for modification	C:\Program Files (x86)\Wisoft Free Video Converter\avutil-49.dll	setup-watch_9082033929.bin.tmp

Modifies registry class 14 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\ = "Xvid MPEG-4 Video Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FriendlyName = "Xvid MPEG-4 Video Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ = "C:\\Windows\\SysWow64\\xvid.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\CLSID = "{64697678-0000-0010-8000-00AA00389B71}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FilterData = 020000000000800002000000000000003070693300000000000000000800000000000000000000003074793300000000d0000000e00000003174793300000000d0000000f00000003274793300000000d0000000000100003374793300000000d0000000100100003474793300000000d0000000200100003574793300000000d0000000300100003674793300000000d0000000400100003774793300000000d0000000500100003170693308000000000000000100000000000000000000003074793300000000d0000000600100007669647300001000800000aa00389b717876696400001000800000aa00389b715856494400001000800000aa00389b716469767800001000800000aa00389b714449565800001000800000aa00389b716478353000001000800000aa00389b714458353000001000800000aa00389b716d70347600001000800000aa00389b714d50345600001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32\ = "C:\\Windows\\SysWow64\\xvid.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\ = "Xvid MPEG-4 Video DecoderAbout"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

setup-watch_9082033929.bin.tmpVideoConverter.exe

pid process

1948 setup-watch_9082033929.bin.tmp
1948 setup-watch_9082033929.bin.tmp
1228 VideoConverter.exe
1228 VideoConverter.exe
1228 VideoConverter.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

setup-watch_9082033929.bin.tmp

pid process

1948 setup-watch_9082033929.bin.tmp

pid	process
1948	setup-watch_9082033929.bin.tmp
1948	setup-watch_9082033929.bin.tmp
1228	VideoConverter.exe
1228	VideoConverter.exe
1228	VideoConverter.exe

pid	process
1948	setup-watch_9082033929.bin.tmp

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

setup-watch_9082033929.bin.exesetup-watch_9082033929.bin.tmp

description	pid	process	target process
PID 1668 wrote to memory of 1948	1668	setup-watch_9082033929.bin.exe	setup-watch_9082033929.bin.tmp
PID 1668 wrote to memory of 1948	1668	setup-watch_9082033929.bin.exe	setup-watch_9082033929.bin.tmp
PID 1668 wrote to memory of 1948	1668	setup-watch_9082033929.bin.exe	setup-watch_9082033929.bin.tmp
PID 1668 wrote to memory of 1948	1668	setup-watch_9082033929.bin.exe	setup-watch_9082033929.bin.tmp
PID 1668 wrote to memory of 1948	1668	setup-watch_9082033929.bin.exe	setup-watch_9082033929.bin.tmp
PID 1668 wrote to memory of 1948	1668	setup-watch_9082033929.bin.exe	setup-watch_9082033929.bin.tmp
PID 1668 wrote to memory of 1948	1668	setup-watch_9082033929.bin.exe	setup-watch_9082033929.bin.tmp
PID 1948 wrote to memory of 2036	1948	setup-watch_9082033929.bin.tmp	regsvr32.exe
PID 1948 wrote to memory of 2036	1948	setup-watch_9082033929.bin.tmp	regsvr32.exe
PID 1948 wrote to memory of 2036	1948	setup-watch_9082033929.bin.tmp	regsvr32.exe
PID 1948 wrote to memory of 2036	1948	setup-watch_9082033929.bin.tmp	regsvr32.exe
PID 1948 wrote to memory of 2036	1948	setup-watch_9082033929.bin.tmp	regsvr32.exe
PID 1948 wrote to memory of 2036	1948	setup-watch_9082033929.bin.tmp	regsvr32.exe
PID 1948 wrote to memory of 2036	1948	setup-watch_9082033929.bin.tmp	regsvr32.exe
PID 1948 wrote to memory of 2004	1948	setup-watch_9082033929.bin.tmp	wmfdist.exe
PID 1948 wrote to memory of 2004	1948	setup-watch_9082033929.bin.tmp	wmfdist.exe
PID 1948 wrote to memory of 2004	1948	setup-watch_9082033929.bin.tmp	wmfdist.exe
PID 1948 wrote to memory of 2004	1948	setup-watch_9082033929.bin.tmp	wmfdist.exe
PID 1948 wrote to memory of 2004	1948	setup-watch_9082033929.bin.tmp	wmfdist.exe
PID 1948 wrote to memory of 2004	1948	setup-watch_9082033929.bin.tmp	wmfdist.exe
PID 1948 wrote to memory of 2004	1948	setup-watch_9082033929.bin.tmp	wmfdist.exe
PID 1948 wrote to memory of 1228	1948	setup-watch_9082033929.bin.tmp	VideoConverter.exe
PID 1948 wrote to memory of 1228	1948	setup-watch_9082033929.bin.tmp	VideoConverter.exe
PID 1948 wrote to memory of 1228	1948	setup-watch_9082033929.bin.tmp	VideoConverter.exe
PID 1948 wrote to memory of 1228	1948	setup-watch_9082033929.bin.tmp	VideoConverter.exe

C:\Users\Admin\AppData\Local\Temp\setup-watch_9082033929.bin.exe
"C:\Users\Admin\AppData\Local\Temp\setup-watch_9082033929.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\is-E2C8C.tmp\setup-watch_9082033929.bin.tmp
"C:\Users\Admin\AppData\Local\Temp\is-E2C8C.tmp\setup-watch_9082033929.bin.tmp" /SL5="$20156,12470195,777216,C:\Users\Admin\AppData\Local\Temp\setup-watch_9082033929.bin.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\xvid.ax"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:2036

C:\Program Files (x86)\Wisoft Free Video Converter\wmfdist.exe
"C:\Program Files (x86)\Wisoft Free Video Converter\wmfdist.exe" /Q:A /R:N
3⤵
- Executes dropped EXE
PID:2004

C:\Program Files (x86)\Wisoft Free Video Converter\VideoConverter.exe
"C:\Program Files (x86)\Wisoft Free Video Converter\VideoConverter.exe" setup-watch_9082033929.bin.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Wisoft Free Video Converter\VideoConverter.exe
MD5
d0c59b8b26c470aba063081b7f0131c0

SHA1
593d34f4e376534c079f48cb5ce64b43371082e2

SHA256
bb9c8ff96f41e58d770a77f7d858f7935b3f79b1f5067070a4ee2215bc9862b7

SHA512
abae72b5f43e171ee3bf7d2dd0d1941be2fcef956db6d65a4ff5b2259bc9fca0d6645b88813593ea1ce00c430f761bdb357bebd279a808395e3ca2fb6722f6fb

Download Submit
C:\Program Files (x86)\Wisoft Free Video Converter\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
C:\Program Files (x86)\Wisoft Free Video Converter\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
C:\Program Files (x86)\Wisoft Free Video Converter\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E2C8C.tmp\setup-watch_9082033929.bin.tmp
MD5
67b502b6730f1e4c337f733c17d491b1

SHA1
dc7f8a86903583c3ad3031098869c44a75246aba

SHA256
5065225ea82e1f4d851fe503bd7469a72229e7ef98b1e079904a2483af0d4dea

SHA512
896dd8166619140ce66c0075a5bdfe12090840e364623da7558ddb4d7206e9aaa46f6ee472f9336bb8681808b1c863328ddb193a125bd741754de5051eefff59

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E2C8C.tmp\setup-watch_9082033929.bin.tmp
MD5
67b502b6730f1e4c337f733c17d491b1

SHA1
dc7f8a86903583c3ad3031098869c44a75246aba

SHA256
5065225ea82e1f4d851fe503bd7469a72229e7ef98b1e079904a2483af0d4dea

SHA512
896dd8166619140ce66c0075a5bdfe12090840e364623da7558ddb4d7206e9aaa46f6ee472f9336bb8681808b1c863328ddb193a125bd741754de5051eefff59

Download Submit
C:\Windows\SysWOW64\xvid.ax
MD5
1dfc887cb243a525675ce04787dedf8b

SHA1
69163fbf6a40a34ae9f27e652b01b4cc8fb2cc5f

SHA256
0969d1f5501ad4be6f969ce45f44a739b2d61a50237f75ae7b77626d6a0aff11

SHA512
160a6df0774c359a3959088fe478d237b4fa597eaa0cf1b084b77ba8fcdb08137387fa3ce91bd40e3af6d2992be048e583368644fe6fa627918e8900833adde4

Download Submit
\Program Files (x86)\Wisoft Free Video Converter\VideoConverter.exe
MD5
d0c59b8b26c470aba063081b7f0131c0

SHA1
593d34f4e376534c079f48cb5ce64b43371082e2

SHA256
bb9c8ff96f41e58d770a77f7d858f7935b3f79b1f5067070a4ee2215bc9862b7

SHA512
abae72b5f43e171ee3bf7d2dd0d1941be2fcef956db6d65a4ff5b2259bc9fca0d6645b88813593ea1ce00c430f761bdb357bebd279a808395e3ca2fb6722f6fb

Download Submit
\Program Files (x86)\Wisoft Free Video Converter\VideoConverter.exe
MD5
d0c59b8b26c470aba063081b7f0131c0

SHA1
593d34f4e376534c079f48cb5ce64b43371082e2

SHA256
bb9c8ff96f41e58d770a77f7d858f7935b3f79b1f5067070a4ee2215bc9862b7

SHA512
abae72b5f43e171ee3bf7d2dd0d1941be2fcef956db6d65a4ff5b2259bc9fca0d6645b88813593ea1ce00c430f761bdb357bebd279a808395e3ca2fb6722f6fb

Download Submit
\Program Files (x86)\Wisoft Free Video Converter\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\Program Files (x86)\Wisoft Free Video Converter\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
\Users\Admin\AppData\Local\Temp\is-E2C8C.tmp\setup-watch_9082033929.bin.tmp
MD5
67b502b6730f1e4c337f733c17d491b1

SHA1
dc7f8a86903583c3ad3031098869c44a75246aba

SHA256
5065225ea82e1f4d851fe503bd7469a72229e7ef98b1e079904a2483af0d4dea

SHA512
896dd8166619140ce66c0075a5bdfe12090840e364623da7558ddb4d7206e9aaa46f6ee472f9336bb8681808b1c863328ddb193a125bd741754de5051eefff59

Download Submit
\Users\Admin\AppData\Local\Temp\is-S5KU3.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Windows\SysWOW64\xvid.ax
MD5
1dfc887cb243a525675ce04787dedf8b

SHA1
69163fbf6a40a34ae9f27e652b01b4cc8fb2cc5f

SHA256
0969d1f5501ad4be6f969ce45f44a739b2d61a50237f75ae7b77626d6a0aff11

SHA512
160a6df0774c359a3959088fe478d237b4fa597eaa0cf1b084b77ba8fcdb08137387fa3ce91bd40e3af6d2992be048e583368644fe6fa627918e8900833adde4

Download Submit
memory/1228-14-0x0000000000000000-mapping.dmp

Download
memory/1228-18-0x0000000004CB0000-0x0000000004CC1000-memory.dmp

Filesize
68KB

Download
memory/1228-19-0x00000000050C0000-0x00000000050D1000-memory.dmp

Filesize
68KB

Download
memory/1948-1-0x0000000000000000-mapping.dmp

Download
memory/2004-10-0x0000000000000000-mapping.dmp

Download
memory/2036-6-0x0000000000000000-mapping.dmp

Download