icedid | 8d5b572415a417017f3cac4151ee47381999a7826c09553160512310314aec68

Analysis

max time kernel
152s
max time network
127s
platform
windows10_x64
resource
win10-en-20210920
submitted
22-10-2021 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ade97ee2d8365bac817b0ce3c933cd8d.exe
Size

408KB
MD5

ade97ee2d8365bac817b0ce3c933cd8d
SHA1

3c01c46b6f14a5e752b78c7bd7916cfea7cb81ef
SHA256

8d5b572415a417017f3cac4151ee47381999a7826c09553160512310314aec68
SHA512

77e5d1c56ce91c9650b6c5aa70b7d887214aa4a5228fbc31a283ea6f2900dbdbfa4e84dcd5051f58023f4e369dbe0050c23970daf7ea284ae0d9d72910706d13

Score

10^/10

icedid smokeloader vidar 936 1875681804 backdoor banker discovery spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

icedid

Campaign

1875681804

enticationmetho.ink

Extracted

Family

vidar

Version

41.5

Botnet

936

https://mas.to/@xeroxxx

Attributes

profile_id
936

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Program Files\Common Files\System\symsrv.dll	acprotect

Vidar Stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3768-129-0x0000000000400000-0x00000000008F1000-memory.dmp	family_vidar

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

50CB.exe7ADA.exe27ED0C9WJKXMBE3I.exeWSHelper.exe

pid process

4388 50CB.exe
3768 7ADA.exe
68 27ED0C9WJKXMBE3I.exe
2772 WSHelper.exe

pid	process
4388	50CB.exe
3768	7ADA.exe
68	27ED0C9WJKXMBE3I.exe
2772	WSHelper.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Program Files\Common Files\System\symsrv.dll	upx

Deletes itself 1 IoCs

Processes:

pid process

3028

pid	process
3028

Loads dropped DLL 9 IoCs

Processes:

ade97ee2d8365bac817b0ce3c933cd8d.exe7ADA.exeWSHelper.exe

pid	process
3564	ade97ee2d8365bac817b0ce3c933cd8d.exe
3768	7ADA.exe
3768	7ADA.exe
2772	WSHelper.exe
2772	WSHelper.exe
2772	WSHelper.exe
2772	WSHelper.exe
2772	WSHelper.exe
2772	WSHelper.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

ade97ee2d8365bac817b0ce3c933cd8d.exe

description ioc process

File opened (read-only) \??\e: ade97ee2d8365bac817b0ce3c933cd8d.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Drops file in Program Files directory 1 IoCs

Processes:

ade97ee2d8365bac817b0ce3c933cd8d.exe

description ioc process

File created C:\Program Files\Common Files\System\symsrv.dll ade97ee2d8365bac817b0ce3c933cd8d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1296 2772 WerFault.exe WSHelper.exe

description	ioc	process
File opened (read-only)	\??\e:	ade97ee2d8365bac817b0ce3c933cd8d.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\symsrv.dll	ade97ee2d8365bac817b0ce3c933cd8d.exe

pid	pid_target	process	target process
1296	2772	WerFault.exe	WSHelper.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ade97ee2d8365bac817b0ce3c933cd8d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ade97ee2d8365bac817b0ce3c933cd8d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ade97ee2d8365bac817b0ce3c933cd8d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ade97ee2d8365bac817b0ce3c933cd8d.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7ADA.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7ADA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7ADA.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1772 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1216 taskkill.exe

pid	process
1772	timeout.exe

pid	process
1216	taskkill.exe

Modifies registry class 2 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance

NTFS ADS 2 IoCs

Processes:

7ADA.exe

description	ioc	process
File created	C:\ProgramData\27ED0C9WJKXMBE3I.exe:Zone.Identifier	7ADA.exe
File opened for modification	C:\ProgramData\27ED0C9WJKXMBE3I.exe:Zone.Identifier	7ADA.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ade97ee2d8365bac817b0ce3c933cd8d.exe

pid	process
3564	ade97ee2d8365bac817b0ce3c933cd8d.exe
3564	ade97ee2d8365bac817b0ce3c933cd8d.exe
3564	ade97ee2d8365bac817b0ce3c933cd8d.exe
3564	ade97ee2d8365bac817b0ce3c933cd8d.exe
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3028
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ade97ee2d8365bac817b0ce3c933cd8d.exe

pid process

3564 ade97ee2d8365bac817b0ce3c933cd8d.exe

pid	process
3028

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

ade97ee2d8365bac817b0ce3c933cd8d.exetaskkill.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3564	ade97ee2d8365bac817b0ce3c933cd8d.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeRestorePrivilege	1296	WerFault.exe
Token: SeBackupPrivilege	1296	WerFault.exe
Token: SeDebugPrivilege	1296	WerFault.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

7ADA.execmd.exe27ED0C9WJKXMBE3I.exe

description	pid	process	target process
PID 3028 wrote to memory of 4388	3028		50CB.exe
PID 3028 wrote to memory of 4388	3028		50CB.exe
PID 3028 wrote to memory of 3768	3028		7ADA.exe
PID 3028 wrote to memory of 3768	3028		7ADA.exe
PID 3028 wrote to memory of 3768	3028		7ADA.exe
PID 3768 wrote to memory of 68	3768	7ADA.exe	27ED0C9WJKXMBE3I.exe
PID 3768 wrote to memory of 68	3768	7ADA.exe	27ED0C9WJKXMBE3I.exe
PID 3768 wrote to memory of 68	3768	7ADA.exe	27ED0C9WJKXMBE3I.exe
PID 3768 wrote to memory of 868	3768	7ADA.exe	cmd.exe
PID 3768 wrote to memory of 868	3768	7ADA.exe	cmd.exe
PID 3768 wrote to memory of 868	3768	7ADA.exe	cmd.exe
PID 868 wrote to memory of 1216	868	cmd.exe	taskkill.exe
PID 868 wrote to memory of 1216	868	cmd.exe	taskkill.exe
PID 868 wrote to memory of 1216	868	cmd.exe	taskkill.exe
PID 868 wrote to memory of 1772	868	cmd.exe	timeout.exe
PID 868 wrote to memory of 1772	868	cmd.exe	timeout.exe
PID 868 wrote to memory of 1772	868	cmd.exe	timeout.exe
PID 68 wrote to memory of 2772	68	27ED0C9WJKXMBE3I.exe	WSHelper.exe
PID 68 wrote to memory of 2772	68	27ED0C9WJKXMBE3I.exe	WSHelper.exe
PID 68 wrote to memory of 2772	68	27ED0C9WJKXMBE3I.exe	WSHelper.exe

C:\Users\Admin\AppData\Local\Temp\ade97ee2d8365bac817b0ce3c933cd8d.exe
"C:\Users\Admin\AppData\Local\Temp\ade97ee2d8365bac817b0ce3c933cd8d.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Users\Admin\AppData\Local\Temp\50CB.exe
C:\Users\Admin\AppData\Local\Temp\50CB.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Users\Admin\AppData\Local\Temp\7ADA.exe
C:\Users\Admin\AppData\Local\Temp\7ADA.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3768

C:\ProgramData\27ED0C9WJKXMBE3I.exe
"C:\ProgramData\27ED0C9WJKXMBE3I.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:68

C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\WSHelper.exe
"C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\WSHelper.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 632
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 7ADA.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7ADA.exe" & del C:\ProgramData\*.dll & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 7ADA.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:1772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\27ED0C9WJKXMBE3I.exe
MD5
cc33deba6df53349fadbcc19a19e9668

SHA1
8b2cceae121d81bcb55bfe166c6e8e3c2b73456d

SHA256
14c5c5595ed66cfe27ca99d35f8097030e4e451dec3a379ea96c76bddae2adaa

SHA512
dba53223dd54602dc115bbe0624a20050bcf210b31cf174e25dcf6ab66f60d7b7582459fd1fa22f4067f86e45116eda521da930c29694aa6ad9390b72362ae4d

Download Submit
C:\ProgramData\27ED0C9WJKXMBE3I.exe
MD5
cc33deba6df53349fadbcc19a19e9668

SHA1
8b2cceae121d81bcb55bfe166c6e8e3c2b73456d

SHA256
14c5c5595ed66cfe27ca99d35f8097030e4e451dec3a379ea96c76bddae2adaa

SHA512
dba53223dd54602dc115bbe0624a20050bcf210b31cf174e25dcf6ab66f60d7b7582459fd1fa22f4067f86e45116eda521da930c29694aa6ad9390b72362ae4d

Download Submit
C:\ProgramData\freebl3.dll
MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\ProgramData\softokn3.dll
MD5
a2ee53de9167bf0d6c019303b7ca84e5

SHA1
2a3c737fa1157e8483815e98b666408a18c0db42

SHA256
43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

SHA512
45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

Download Submit
C:\ProgramData\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\50CB.exe
MD5
81fc38de5b6197c4db58eb506037e7cb

SHA1
c2258ab3204e6061d548df202c99aa361242d848

SHA256
2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

SHA512
4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\50CB.exe
MD5
81fc38de5b6197c4db58eb506037e7cb

SHA1
c2258ab3204e6061d548df202c99aa361242d848

SHA256
2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

SHA512
4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ADA.exe
MD5
7a99b1198664b17d37c0801c9b5dd2ee

SHA1
266308c64f6d0bb4b1a1d11ec34e606dd9237e55

SHA256
d24a8f3c0738184c66af7057f8d7d58b5fd38f7bd8ad758607cb090380f871bc

SHA512
b9937b80b15097b9be0ae66b869e37539948ec478fb4f65a459a3bcb938c6d914ced177bc9458fed24adfdaac7265ee69b8f0aa0a20ffb3d2efa6f9297f255c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ADA.exe
MD5
7a99b1198664b17d37c0801c9b5dd2ee

SHA1
266308c64f6d0bb4b1a1d11ec34e606dd9237e55

SHA256
d24a8f3c0738184c66af7057f8d7d58b5fd38f7bd8ad758607cb090380f871bc

SHA512
b9937b80b15097b9be0ae66b869e37539948ec478fb4f65a459a3bcb938c6d914ced177bc9458fed24adfdaac7265ee69b8f0aa0a20ffb3d2efa6f9297f255c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wondershare Studio\Wondershare Studio.lnk
MD5
665da9a31458832bcb356a5a658c8182

SHA1
e806eb0cbbd7c61a744d9eba7261f45a200af141

SHA256
a67afb718504f17eadf8a9c8130a29a0bb3f774b0d914236edde1f9678f1c334

SHA512
40b896eb772348f6cf49c8a9b4caa9979a688ec2c8c3a6d9830795a8f4712e5f34c0e23696be4ce81febbadf2e876b0f1f853bd36d9a4099ca0e006f7cb3bc96

Download Submit
C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\CBSCreateVC.dll
MD5
30ebdc01d3ab9fb3772445cb4a9ebbba

SHA1
f0eee5c8a4f416673ee5a0698075c124aefc5d14

SHA256
0ea512eac7298ed72e8d47da4db8d73557599cd2411f69657cc374cd0704e8e8

SHA512
4be686006d169dcd1f18dd85b0cbf0c13e1e6cfe6ec60f9cea32ba1afae811c0dd232de2d569de164a7c5a1108960551b04c28600f8959a51fc0bded78ca3fa9

Download Submit
C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\CBSProducstInfo.dll
MD5
9aa99bee15129f478d04af5db73febe7

SHA1
cc694e09e091d371603f45cba534b2cc41a7c1d9

SHA256
312d7bf79977d4e353c2ef20d2acf999c01549f5fc43c8ec319c924e4fa7b0dd

SHA512
a53477dade3cbd68c13e4a85bd2f9157b09e31ed77cb9a7f91ad7bb689732b790e1a7d6c29acfdabe8514a16eef9efe636e40d963b5afee26acfbc0ecc834e44

Download Submit
C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\DAQExp.dll
MD5
b16ad0dd6c69c0c117c9d3647517786c

SHA1
825a54040c8e8dfe9ffb243796df806ee5b05708

SHA256
e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f

SHA512
23512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632

Download Submit
C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\WSHelper.exe
MD5
db67e9196605d61d8278e5278777c71f

SHA1
6fe39b3ace96505269745ed2b81975abb5aea647

SHA256
9b5f85fb164d177a24a521df6a9515f1dfb502d1b83581d37dae8ac3f1ad9010

SHA512
d2a77d6c1c7771e714f5a19db82823a8a4dd0f0402aca0751d17e7b4d66219049aa33eab3f3841de251f7393f0d01e3c7664ef0aa17f5593ba0f569d2bfe7022

Download Submit
C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\WSHelper.exe
MD5
db67e9196605d61d8278e5278777c71f

SHA1
6fe39b3ace96505269745ed2b81975abb5aea647

SHA256
9b5f85fb164d177a24a521df6a9515f1dfb502d1b83581d37dae8ac3f1ad9010

SHA512
d2a77d6c1c7771e714f5a19db82823a8a4dd0f0402aca0751d17e7b4d66219049aa33eab3f3841de251f7393f0d01e3c7664ef0aa17f5593ba0f569d2bfe7022

Download Submit
C:\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\libfont-4.dll
MD5
6088088eaedb14fe8238b8a8cbf013d1

SHA1
302e6ed94fb85df2c7f253c401debd7636e3b2fd

SHA256
a4a55f114888d205a2b7ba42e2f5329f18e53181c0260b6159e17c87b45895c2

SHA512
a6061135cf43878b90b17b4cf62c5610c651e3e09660229a68ae563bc53aa73d3967fd0d036080d6ce9a00f3896a430483af9187c891fb485bfee23de8f51686

Download Submit
\Program Files\Common Files\System\symsrv.dll
MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\CBSCreateVC.dll
MD5
30ebdc01d3ab9fb3772445cb4a9ebbba

SHA1
f0eee5c8a4f416673ee5a0698075c124aefc5d14

SHA256
0ea512eac7298ed72e8d47da4db8d73557599cd2411f69657cc374cd0704e8e8

SHA512
4be686006d169dcd1f18dd85b0cbf0c13e1e6cfe6ec60f9cea32ba1afae811c0dd232de2d569de164a7c5a1108960551b04c28600f8959a51fc0bded78ca3fa9

Download Submit
\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\CBSProducstInfo.dll
MD5
9aa99bee15129f478d04af5db73febe7

SHA1
cc694e09e091d371603f45cba534b2cc41a7c1d9

SHA256
312d7bf79977d4e353c2ef20d2acf999c01549f5fc43c8ec319c924e4fa7b0dd

SHA512
a53477dade3cbd68c13e4a85bd2f9157b09e31ed77cb9a7f91ad7bb689732b790e1a7d6c29acfdabe8514a16eef9efe636e40d963b5afee26acfbc0ecc834e44

Download Submit
\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\CBSProducstInfo.dll
MD5
9aa99bee15129f478d04af5db73febe7

SHA1
cc694e09e091d371603f45cba534b2cc41a7c1d9

SHA256
312d7bf79977d4e353c2ef20d2acf999c01549f5fc43c8ec319c924e4fa7b0dd

SHA512
a53477dade3cbd68c13e4a85bd2f9157b09e31ed77cb9a7f91ad7bb689732b790e1a7d6c29acfdabe8514a16eef9efe636e40d963b5afee26acfbc0ecc834e44

Download Submit
\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\CBSProducstInfo.dll
MD5
9aa99bee15129f478d04af5db73febe7

SHA1
cc694e09e091d371603f45cba534b2cc41a7c1d9

SHA256
312d7bf79977d4e353c2ef20d2acf999c01549f5fc43c8ec319c924e4fa7b0dd

SHA512
a53477dade3cbd68c13e4a85bd2f9157b09e31ed77cb9a7f91ad7bb689732b790e1a7d6c29acfdabe8514a16eef9efe636e40d963b5afee26acfbc0ecc834e44

Download Submit
\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\DAQExp.dll
MD5
b16ad0dd6c69c0c117c9d3647517786c

SHA1
825a54040c8e8dfe9ffb243796df806ee5b05708

SHA256
e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f

SHA512
23512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632

Download Submit
\Users\Admin\AppData\Roaming\Wondershare\Wondershare Studio\libfont-4.dll
MD5
6088088eaedb14fe8238b8a8cbf013d1

SHA1
302e6ed94fb85df2c7f253c401debd7636e3b2fd

SHA256
a4a55f114888d205a2b7ba42e2f5329f18e53181c0260b6159e17c87b45895c2

SHA512
a6061135cf43878b90b17b4cf62c5610c651e3e09660229a68ae563bc53aa73d3967fd0d036080d6ce9a00f3896a430483af9187c891fb485bfee23de8f51686

Download Submit
memory/68-136-0x00000000006F0000-0x000000000079E000-memory.dmp

Filesize
696KB

Download
memory/68-132-0x0000000000000000-mapping.dmp

Download
memory/868-134-0x0000000000000000-mapping.dmp

Download
memory/1216-135-0x0000000000000000-mapping.dmp

Download
memory/1772-138-0x0000000000000000-mapping.dmp

Download
memory/2772-145-0x0000000000000000-mapping.dmp

Download
memory/2772-157-0x0000000000BD0000-0x0000000000C89000-memory.dmp

Filesize
740KB

Download
memory/3028-119-0x0000000000850000-0x0000000000866000-memory.dmp

Filesize
88KB

Download
memory/3564-117-0x0000000002ED0000-0x000000000301A000-memory.dmp

Filesize
1.3MB

Download
memory/3564-118-0x0000000000400000-0x0000000002DAA000-memory.dmp

Filesize
41.7MB

Download
memory/3768-128-0x0000000000A40000-0x0000000000B8A000-memory.dmp

Filesize
1.3MB

Download
memory/3768-129-0x0000000000400000-0x00000000008F1000-memory.dmp

Filesize
4.9MB

Download
memory/3768-127-0x0000000000C36000-0x0000000000CB2000-memory.dmp

Filesize
496KB

Download
memory/3768-124-0x0000000000000000-mapping.dmp

Download
memory/4388-123-0x0000000140000000-0x0000000140009000-memory.dmp

Filesize
36KB

Download
memory/4388-120-0x0000000000000000-mapping.dmp

Download