77b67cd492a8267668ccdb7b9ef15297153876f6dcdcf04d0fd7e22b57fb3307

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Size

428KB
MD5

c0bce7ecfebcaf6ae4d0767ebb79c5da
SHA1

b6c9f0653a086513679f743bb5b6001973956cf2
SHA256

77b67cd492a8267668ccdb7b9ef15297153876f6dcdcf04d0fd7e22b57fb3307
SHA512

375d7b9468cd41ed0699596bf86d3e468b64b8c89d357ce70e56958688f07ee19d367ab59d44f3a838fd47c4e1add8effe70e02c9ef9eed8616596832afc2c63
SSDEEP

12288:ZQVTzThv858payUIp803022g5NDwcJ2CrKBr3jr9HB:8uy30NgLDLGBrzrNB

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exeWnUmanlike.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WanNengSoftManager\ = "{4DC6C17B-7019-42CB-A602-90408C0282D4}"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WanNengSoftManager	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WanNengSoftManager	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WanNengSoftManager\ = "{4DC6C17B-7019-42CB-A602-90408C0282D4}"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WanNengSoftManager	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WanNengSoftManager\ = "{4DC6C17B-7019-42CB-A602-90408C0282D4}"	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WanNengSoftManager\ = "{4DC6C17B-7019-42CB-A602-90408C0282D4}"	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DragDropHandlers\WanNengSoftManager	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe

Executes dropped EXE 10 IoCs

Processes:

WNSoftSer.exeWnUmanlike.exeWnUmanlike.exeWnUmanlike.exeWnSoftManager.exeWnSoftManager.exeWnFSUpd.exeWnSvceous.exeWnSvceous.exeWnSvceous.exe

pid	process
1360	WNSoftSer.exe
1808	WnUmanlike.exe
1884	WnUmanlike.exe
1684	WnUmanlike.exe
596	WnSoftManager.exe
1488	WnSoftManager.exe
1012	WnFSUpd.exe
1916	WnSvceous.exe
1640	WnSvceous.exe
112	WnSvceous.exe

Registers COM server for autorun 1 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exeWnUmanlike.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\InprocServer32\ThreadingModel = "Apartment"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ = "C:\\Program Files (x86)\\WanNengSoftManager\\WnCosemism64.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ThreadingModel = "Apartment"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32\ThreadingModel = "Apartment"	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\InprocServer32	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\InprocServer32\ = "C:\\Windows\\system32\\WnAcelein64.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32\ = "C:\\Program Files (x86)\\WanNengSoftManager\\WnFerous64.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ = "C:\\Program Files (x86)\\WanNengSoftManager\\WnCosemism64.dll"	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ThreadingModel = "Apartment"	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32\ThreadingModel = "Apartment"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32\ = "C:\\Program Files (x86)\\WanNengSoftManager\\WnFerous64.dll"	WnUmanlike.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Restreful\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\Restreful\\WnSvdarme.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe

Loads dropped DLL 17 IoCs

Processes:

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exesvchost.exeWNSoftSer.exeWnSoftManager.exeWnSoftManager.exe

pid	process
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
940	svchost.exe
1360	WNSoftSer.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1360	WNSoftSer.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
596	WnSoftManager.exe
1488	WnSoftManager.exe
940	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeWnSoftManager.exe照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\	WnSoftManager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	WnSoftManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe

Drops file in System32 directory 11 IoCs

Processes:

svchost.exe照片查重去重软件(VisiPics) v1.31中文版_018_42122.exeWNSoftSer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\system32\WnAcelein64.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D	WNSoftSer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D	WNSoftSer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FFA6E45777C6CE08CA96D0E3CFF29477	WNSoftSer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7f70110c47e5[1].bae	WNSoftSer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\xst[1].abf	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	WNSoftSer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FFA6E45777C6CE08CA96D0E3CFF29477	WNSoftSer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\a30666352098[1].bae	svchost.exe
File created	C:\Windows\system32\WnAcelein.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe

Drops file in Program Files directory 64 IoCs

Processes:

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exeWnUmanlike.exe

description	ioc	process
File created	C:\Program Files (x86)\WanNengSoftManager\WnCosemism.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnPatemar.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnSvdarme.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WNSoftSer.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\Icon	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon\update.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnTen6.tff	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\wke.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\Wnhghshtol.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnMfgohsht.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\main.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnCosemism64.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WanNengSoftManager.ini	WnUmanlike.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WNSoftSer.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon\normal.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnSeve3.fes	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnTen6.tff	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnFerous64.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnPatemar.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\Common Files\WanNengSoftManager\WanNengSoftManager.ini	WnUmanlike.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\wngj	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon\normal.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\main.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnSeve6.tff	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnKernel.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnSvccen.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnUninst.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\wngj\Icon	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnSeve3.fes	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\Wnhghshtp.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\wke.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnUninst.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnMfgohsht.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnSvdarme.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\update.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnQdX.tsc	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnTen3.fes	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnFerous.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\Wnhghshtol.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnFerous.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\Wnfghshmndf.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\Wnhghshtp.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\Common Files\WanNengSoftManager\WanNengSoftManager.ini	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\Icon\main.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\normal.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnAcelein.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnCosemism64.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\wndr.cat	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnCosemism.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnKernel.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\Icon\AllIcon\update.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\update.ico	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnQdX.tsc	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnAcelein64.dll	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File opened for modification	C:\Program Files (x86)\WanNengSoftManager\WnTen3.fes	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
File created	C:\Program Files (x86)\WanNengSoftManager\WnSvceous.exe	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

WnSoftManager.exeWnSoftManager.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WnSoftManager.exe = "11000"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING \WnSoftManager.exe = "1"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM\WnSoftManager.exe = "1"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM\WnSoftManager.exe = "1"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\WnSoftManager.exe = "11000"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\WnSoftManager.exe = "1"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\WnSoftManager.exe = "0"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING \WnSoftManager.exe = "1"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI \WnSoftManager.exe = "0"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\WnSoftManager.exe = "0"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\WnSoftManager.exe = "0"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI \WnSoftManager.exe = "0"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\WnSoftManager.exe = "1"	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\WnSoftManager.exe = "1"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	WnSoftManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\WnSoftManager.exe = "1"	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	WnSoftManager.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	WnSoftManager.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

WNSoftSer.exesvchost.exeWnUmanlike.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WNSoftSer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadNetworkName = "Network 2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WanNengSoftManager\WNGJAppInfo\UsrPath = "C:\\Users\\Admin\\AppData\\LocalLow\\WanNengSoftManager.user\\"	WnUmanlike.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WNSoftSer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\66-33-80-44-1a-b1	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\66-33-80-44-1a-b1	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecision = "0"	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WNSoftSer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadDecisionTime = c09a77e33dffd801	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadNetworkName = "Network 2"	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WNSoftSer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WanNengSoftManager\WNGJAppInfo\CfgPath = "C:\\Users\\Admin\\AppData\\LocalLow\\WanNengSoftManager\\"	WnUmanlike.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecisionTime = c09a77e33dffd801	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WNSoftSer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WNSoftSer.exe

Modifies registry class 64 IoCs

Processes:

explorer.exe照片查重去重软件(VisiPics) v1.31中文版_018_42122.exeWnUmanlike.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\WanNengSoftManager\ = "{4DC6C17B-7019-42CB-A602-90408C0282D4}"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\HELPDIR	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\WanNengSoftManager\\"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\WanNengSoftManager	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\FLAGS	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\FLAGS\ = "0"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF513021-FF0F-40FD-8BF0-711EA843DD9F}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\WnAcelein64.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ThreadingModel = "Apartment"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\ = "CloudSoftManagershExt Class"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WanNengSoftManager\ = "{4DC6C17B-7019-42CB-A602-90408C0282D4}"	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\ = "CloudSoftManagershExt Class"	WnUmanlike.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\ProgID\ = "CloudSoftManagerOverlayIcon.MyCloudSoftManagerOverlayIcon.1"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WanNengSoftManager	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\WanNengSoftManager	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WanNengSoftManager	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\InprocServer32\ = "C:\\Windows\\SysWow64\\WnAcelein64.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\VersionIndependentProgID	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WanNengSoftManager	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\Version\ = "1.0"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\CloudSoftManagershExt\ = "{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\InprocServer32\ = "C:\\Windows\\system32\\WnAcelein64.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\TypeLib\ = "{163D4049-C925-40CE-A3D4-55CBCAF4065F}"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\0\win32	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32	WnUmanlike.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\InprocServer32\ThreadingModel = "Apartment"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF513021-FF0F-40FD-8BF0-711EA843DD9F}	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\TypeLib	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\TypeLib\ = "{163D4049-C925-40CE-A3D4-55CBCAF4065F}"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ = "C:\\Program Files (x86)\\WanNengSoftManager\\WnCosemism64.dll"	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\WanNengSoftManager	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF513021-FF0F-40FD-8BF0-711EA843DD9F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\WnAcelein.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\TypeLib\ = "{163D4049-C925-40CE-A3D4-55CBCAF4065F}"	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\Version	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\ProgID	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF513021-FF0F-40FD-8BF0-711EA843DD9F}\1.0\0	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\FLAGS\ = "0"	WnUmanlike.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF513021-FF0F-40FD-8BF0-711EA843DD9F}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ = "C:\\Program Files (x86)\\WanNengSoftManager\\WnCosemism64.dll"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\TypeLib	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\Programmable	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\0\win64	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WanNengSoftManager	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WanNengSoftManager	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\0\win64	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8DF47B6A-69EC-4A98-9ED0-5DA19732920F}\Programmable	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WanNengSoftManager	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\TypeLib	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\InprocServer32\ThreadingModel = "Apartment"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{163D4049-C925-40CE-A3D4-55CBCAF4065F}\1.0\FLAGS	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DC6C17B-7019-42CB-A602-90408C0282D4}\InprocServer32\ThreadingModel = "Apartment"	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\Programmable	WnUmanlike.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\Programmable	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{804AE2AA-FD89-46A5-B3F0-A4AD305D6E2F}\Version\ = "1.0"	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\DragDropHandlers\WanNengSoftManager\ = "{4DC6C17B-7019-42CB-A602-90408C0282D4}"	WnUmanlike.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

WNSoftSer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	WNSoftSer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	WNSoftSer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exepowershell.exeWNSoftSer.exesvchost.exe

pid	process
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1256	powershell.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1360	WNSoftSer.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
940	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1256 powershell.exe

pid	process
468

description	pid	process
Token: SeDebugPrivilege	1256	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

照片查重去重软件(VisiPics) v1.31中文版_018_42122.exeWNSoftSer.exesvchost.exeWnSvceous.exe

description	pid	process	target process
PID 1700 wrote to memory of 680	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	explorer.exe
PID 1700 wrote to memory of 680	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	explorer.exe
PID 1700 wrote to memory of 680	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	explorer.exe
PID 1700 wrote to memory of 680	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	explorer.exe
PID 1700 wrote to memory of 1256	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	powershell.exe
PID 1700 wrote to memory of 1256	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	powershell.exe
PID 1700 wrote to memory of 1256	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	powershell.exe
PID 1700 wrote to memory of 1256	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	powershell.exe
PID 1360 wrote to memory of 1808	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1808	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1808	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1808	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1884	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1884	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1884	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1884	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1684	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1684	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1684	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1360 wrote to memory of 1684	1360	WNSoftSer.exe	WnUmanlike.exe
PID 1700 wrote to memory of 596	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1700 wrote to memory of 596	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1700 wrote to memory of 596	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1700 wrote to memory of 596	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1700 wrote to memory of 1488	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1700 wrote to memory of 1488	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1700 wrote to memory of 1488	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1700 wrote to memory of 1488	1700	照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe	WnSoftManager.exe
PID 1360 wrote to memory of 1012	1360	WNSoftSer.exe	WnFSUpd.exe
PID 1360 wrote to memory of 1012	1360	WNSoftSer.exe	WnFSUpd.exe
PID 1360 wrote to memory of 1012	1360	WNSoftSer.exe	WnFSUpd.exe
PID 1360 wrote to memory of 1012	1360	WNSoftSer.exe	WnFSUpd.exe
PID 940 wrote to memory of 1916	940	svchost.exe	WnSvceous.exe
PID 940 wrote to memory of 1916	940	svchost.exe	WnSvceous.exe
PID 940 wrote to memory of 1916	940	svchost.exe	WnSvceous.exe
PID 940 wrote to memory of 1916	940	svchost.exe	WnSvceous.exe
PID 1916 wrote to memory of 1640	1916	WnSvceous.exe	WnSvceous.exe
PID 1916 wrote to memory of 1640	1916	WnSvceous.exe	WnSvceous.exe
PID 1916 wrote to memory of 1640	1916	WnSvceous.exe	WnSvceous.exe
PID 1916 wrote to memory of 1640	1916	WnSvceous.exe	WnSvceous.exe
PID 1916 wrote to memory of 112	1916	WnSvceous.exe	WnSvceous.exe
PID 1916 wrote to memory of 112	1916	WnSvceous.exe	WnSvceous.exe
PID 1916 wrote to memory of 112	1916	WnSvceous.exe	WnSvceous.exe
PID 1916 wrote to memory of 112	1916	WnSvceous.exe	WnSvceous.exe

C:\Users\Admin\AppData\Local\Temp\照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe
"C:\Users\Admin\AppData\Local\Temp\照片查重去重软件(VisiPics) v1.31中文版_018_42122.exe"
1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Sets DLL path for service in the registry
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" /e,/select, C:\Users\Admin\Desktop\????????(VisiPics).rar
2⤵
PID:680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -WindowStyle hidden -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WanNengSoftManager\'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
"C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe" 5d6c7
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Modifies Internet Explorer settings
PID:596

C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
"C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe" 5d6c7
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:1488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:560

C:\Program Files (x86)\WanNengSoftManager\WNSoftSer.exe
"C:\Program Files (x86)\WanNengSoftManager\WNSoftSer.exe" 05e
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360

C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
"C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe" 0b2 --9fa1=0
2⤵
- Executes dropped EXE
PID:1808

C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
"C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe" 133 --9fa1=0
2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1884

C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
"C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe" 535
2⤵
- Executes dropped EXE
PID:1684

C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe
"C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe" d1d
2⤵
- Executes dropped EXE
PID:1012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k Picnicter
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:940

C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
"C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe" a6b --9fa1=0
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916

C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
"C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe" 0f0
3⤵
- Executes dropped EXE
PID:112

C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
"C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe" 2fa --9fa1=0
3⤵
- Executes dropped EXE
PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\WanNengSoftManager\WanNengSoftManager.ini
Filesize
194B

MD5
8169df157e5aaa7814e19e4a312a8e6e

SHA1
9250c428993ae78da6f578af6ee968d632f14b32

SHA256
d6da1cdd18fb7b2ee0ea3674e24107b944619eb9e19a8c9b5d9316b3aa197812

SHA512
6d18b5048bd4f1d27fe6485af088bafea5bfdbe56b7cd68b5f8982e0b874601fe304b8f0f68c91a2e120c48c1267409e5bbc24a1020c7bf223fd1c6dce0f52f1

Download Submit
C:\Program Files (x86)\Common Files\WanNengSoftManager\WanNengSoftManager.ini
Filesize
194B

MD5
8169df157e5aaa7814e19e4a312a8e6e

SHA1
9250c428993ae78da6f578af6ee968d632f14b32

SHA256
d6da1cdd18fb7b2ee0ea3674e24107b944619eb9e19a8c9b5d9316b3aa197812

SHA512
6d18b5048bd4f1d27fe6485af088bafea5bfdbe56b7cd68b5f8982e0b874601fe304b8f0f68c91a2e120c48c1267409e5bbc24a1020c7bf223fd1c6dce0f52f1

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WNSoftSer.exe
Filesize
2.2MB

MD5
784478e4e492533304ff2eefc987bcce

SHA1
3747d2b39c787bfb2c99ed4eda8e0cb122313afe

SHA256
6f859580f5935d05905ced4a83ff6ad7d4f1708dc4844714f3d8e8937ec0c029

SHA512
86fcb8af920fe0b757dd96d8503b69c8cb8c543abfba374d404bf0dc6a95214d8f24be7d03cb00e1199c47e0f7981bdea511179d2a8c722c248747101091b830

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WanNengSoftManager.ini
Filesize
282B

MD5
527f888841a84509695e57600f94e0ae

SHA1
e200a5b6d4c535497336c0c36e5fe9a344225c3b

SHA256
27fa1728838273349b8aa6ef6370e4153807748831314966f71a7514bdda1b52

SHA512
4023feee5e3c487d4efa16a53c7c555ce04c375815677dda86d938aa0b7c4dc4c43ae65df3c02980fe0641fbd291bc58dc3d6eff42ffb3fb3465f4a3d244039d

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WanNengSoftManager.ini
Filesize
282B

MD5
527f888841a84509695e57600f94e0ae

SHA1
e200a5b6d4c535497336c0c36e5fe9a344225c3b

SHA256
27fa1728838273349b8aa6ef6370e4153807748831314966f71a7514bdda1b52

SHA512
4023feee5e3c487d4efa16a53c7c555ce04c375815677dda86d938aa0b7c4dc4c43ae65df3c02980fe0641fbd291bc58dc3d6eff42ffb3fb3465f4a3d244039d

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WanNengSoftManager.ini
Filesize
216B

MD5
4182fa12279f5352fae7439db4b7e5a8

SHA1
f2a42c5158fffba4b3730adb106316728b235e08

SHA256
37e119928f72dae52771037859595c3b0243b0d667ca2e1cdd8febabcc2d081c

SHA512
1b15b3a466f354feae140402abae15aa7a6171c57d1bb41d962fe2da5e7c133a397473cb433543dbab731faa4ef1fec01829979cdf3f72ae47bee5cddc1d5ea6

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe
Filesize
4.3MB

MD5
abcade080b90bfff8480d3c19299d6ef

SHA1
28ce4f0bc106ad7197c7347e5a3f4975f54c8843

SHA256
e707c901ee0898862445d3274a92e06c8b3558bd712a6c7a37fcfa436c8fee54

SHA512
cd328e0e8bf17972ae92a470553fce643fdd2312d45a044e80767831ce2433dff75e66c1318a7fc9b75f1cb7be07f4bb56ec87766ea04f50a89ccadba09c7a0b

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe
Filesize
4.3MB

MD5
abcade080b90bfff8480d3c19299d6ef

SHA1
28ce4f0bc106ad7197c7347e5a3f4975f54c8843

SHA256
e707c901ee0898862445d3274a92e06c8b3558bd712a6c7a37fcfa436c8fee54

SHA512
cd328e0e8bf17972ae92a470553fce643fdd2312d45a044e80767831ce2433dff75e66c1318a7fc9b75f1cb7be07f4bb56ec87766ea04f50a89ccadba09c7a0b

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
Filesize
2.6MB

MD5
81dc21c734602ca9b9e4e086f19d9ee0

SHA1
269a928d70022e5388efeb30c3cefb39b2f1ab52

SHA256
551537503f89d58ab32e991b128e4a323306f6df2462a31de833813f0a7ec614

SHA512
a56d9bc449f59752a938b42d7423d45b6811534e8a38dc177e46f578ba275e160918dcc5881f5a0633bc905f0e44752546f6fc277b88c120b779d060e5146862

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
Filesize
2.6MB

MD5
81dc21c734602ca9b9e4e086f19d9ee0

SHA1
269a928d70022e5388efeb30c3cefb39b2f1ab52

SHA256
551537503f89d58ab32e991b128e4a323306f6df2462a31de833813f0a7ec614

SHA512
a56d9bc449f59752a938b42d7423d45b6811534e8a38dc177e46f578ba275e160918dcc5881f5a0633bc905f0e44752546f6fc277b88c120b779d060e5146862

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
Filesize
2.6MB

MD5
81dc21c734602ca9b9e4e086f19d9ee0

SHA1
269a928d70022e5388efeb30c3cefb39b2f1ab52

SHA256
551537503f89d58ab32e991b128e4a323306f6df2462a31de833813f0a7ec614

SHA512
a56d9bc449f59752a938b42d7423d45b6811534e8a38dc177e46f578ba275e160918dcc5881f5a0633bc905f0e44752546f6fc277b88c120b779d060e5146862

Download Submit
C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
Filesize
2.6MB

MD5
81dc21c734602ca9b9e4e086f19d9ee0

SHA1
269a928d70022e5388efeb30c3cefb39b2f1ab52

SHA256
551537503f89d58ab32e991b128e4a323306f6df2462a31de833813f0a7ec614

SHA512
a56d9bc449f59752a938b42d7423d45b6811534e8a38dc177e46f578ba275e160918dcc5881f5a0633bc905f0e44752546f6fc277b88c120b779d060e5146862

Download Submit
C:\Program Files (x86)\WanNengSoftManager\wke.dll
Filesize
11.2MB

MD5
2f168e79442731d29813727c37277b73

SHA1
2e7ea5a3e50bb2439f2a332ee26e2c447ed0d56c

SHA256
53aa5fbe2464996f462592a9ba28af5952cb7a436e35932c005a11b75cde85c9

SHA512
51807548a73f2a0f99c94f6a5db17168ac8053bfe99a01e97f54ee2d21d366bd436ff8f6a2b641a849d348ae9ffead4f33c9f63a9ba683013c0a51bb1b7f2e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D
Filesize
471B

MD5
438d2b95bff76a4aca6e3c59eb6a5382

SHA1
33e970e4152550f3c222a57f782828fecaff5a0a

SHA256
6769b7b999e28b61e233371c8a0ed1f8e8520c6a02347124eb167c5c0a7b10a8

SHA512
e6666c54bce6c5f2e127884313a010a91230b2ebc86a47d994e83dc7ed276329d3783bda97f0e573f3de8c499dd407e231e955892c6a52790c4715975164a5e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FFA6E45777C6CE08CA96D0E3CFF29477
Filesize
471B

MD5
5ba190d7308ad2a6846536be7973d093

SHA1
e603159b2da20467f4576436bc7e0eea54ad4d92

SHA256
d5632e3b43673d4335791240538e5ae3b43daf1881dafcb59a5ae748061773b6

SHA512
f6a5526c76129bbe876a002abdffc28c755572f710885911d07fb1ffe65c8bcc5c1a43b53692bf92d708c2f88c97d2a1f6486a11d3fc5b309dc1b89279dcb38b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
79a3214e344db8ea6f714db44d287a5b

SHA1
ce2a1d6ce4f1a45a2f964aa24f8c4ad2305de360

SHA256
673ded0633390ddf2ad6f81d69e16afb6031f05f356f3190ea384ca369dbbb25

SHA512
ff1503315de461fca1745e1b83ce727ab392652b3b3741807d0d2621e9172222489f9d93615543a364fdcb09973505b32edbb0e8509ccea5c357e4dbd7585550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D
Filesize
434B

MD5
03a436adac7acc248efd4bfe1922ee58

SHA1
39bb092057f55047c0af37b6039cedd64246d58e

SHA256
1896dca11744bd5b7240d679822a2cdb9974b79ef46da41e83e8e4c90520d354

SHA512
940e6a20530b4aa437221c7de0ac214442c09460b01e946db9276d2be8102fea8f7c3aaf2236b974f7bacc033826c21637ba61da0094c7acbd5166e5e4758e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FFA6E45777C6CE08CA96D0E3CFF29477
Filesize
426B

MD5
0451cde324fcc3645683a93636cfeba8

SHA1
f7dbc5115710ba756dc9007c6dc08be791aa903e

SHA256
02793a030b25c325fddefc53ca05007acb8633b8c0084d633124cf9f0f0c9de7

SHA512
d7a708cfa2a19e9be9197e7d260c2e5621bfa8f6b9675d85d0d48a1e40f717b6c6ade5f6f8e8068a5b6e58040b5ba0cde0e4832a46c450b62b2693c96563c4c6

Download Submit
C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
Filesize
881B

MD5
bfd44bc9d6b52cb90bc92ddbfc679a51

SHA1
9f0b566761646328e3b39b4e7362ba7acd225d85

SHA256
55cd97811656cf24a5da8e1d8852646c4728b825afbed45eefcff2d83c95ec34

SHA512
c2e0f71d9d6adf1a440c8d214e42f3f41d9cf48c7575664c2935efcdf0d93db3d89252a36929875ae5eb673af5834b26d6b13dfc20df4e6fe9292fa464baae75

Download Submit
C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
Filesize
881B

MD5
bfd44bc9d6b52cb90bc92ddbfc679a51

SHA1
9f0b566761646328e3b39b4e7362ba7acd225d85

SHA256
55cd97811656cf24a5da8e1d8852646c4728b825afbed45eefcff2d83c95ec34

SHA512
c2e0f71d9d6adf1a440c8d214e42f3f41d9cf48c7575664c2935efcdf0d93db3d89252a36929875ae5eb673af5834b26d6b13dfc20df4e6fe9292fa464baae75

Download Submit
C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
Filesize
908B

MD5
f4f47d1d1d26d9ac8d1f355a8350dd74

SHA1
f9af1f8af3edb87578018c0b6f791b29fc357f90

SHA256
ebd80bdff78376fc1bc558dadbaf40faa8f61551d2f8d9e22ac42812c1e27889

SHA512
ada3a80d590fe956c2defa66df2deea6efe7e11c9ba406276707ba5f62481df988a57d2c710bd72e90dba212140498a7468f5cf7d90cf3657ae913a262c835ff

Download Submit
C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
Filesize
908B

MD5
9f946c61c0d71cec1f6dbb2928f04521

SHA1
64f6897fb830422aa6f8bc6417b18ab3111fb1b0

SHA256
9cb3768871174a41f47303986a66a1c44503eb5976b8e94ce6141978c88eb192

SHA512
344db56f6893123e033e409ea7c6150114b6cf5560a69f7e11ac168a9fa0af44cc9cbb00e2ac5c519824fe270fc2bbcccdfc26dee1c994f7ed25b60cf1aaec70

Download Submit
C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
Filesize
575B

MD5
0ddcd51c087c5ececac6e21e5663514f

SHA1
05e8666e61f21bda823ba8259911ed02fb3211d1

SHA256
238966d9f7ace06885afe1afc2a29370272d9605247ad435c3da3be761585c12

SHA512
d927638fb1da1049e6d7d3eb8e6eb6a16fefe5f65d376dacfb2fd0916c0602e77b5eaea2c67b2bc16e397871085931b86393062abfd4ee81ae7506c1cb994450

Download Submit
C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\UseCache.ini
Filesize
214B

MD5
905af71a6f513bec677b89c200b75558

SHA1
cddf29a7a5f36f1d0ca00ca4868a7083ccfda73a

SHA256
450c84e932e2db68b5c872a6a5488bc265a8d4758b3f9c0604f4ae30776e4c55

SHA512
bf32946c568ce9907a73d3df6979e208734760f771a2661365e0767f55ab20d3352a5b3e86f975073afdbcf294743fddaa39e62020eb83f1e612929ea78f8868

Download Submit
C:\Users\Admin\AppData\Roaming\Restreful\Eleglate.ini
Filesize
283B

MD5
403b53487efba671fcf214424c0820c1

SHA1
938ba091dbe3e1993995e49e92372705bbb8bf13

SHA256
f933b553f189d51d9ba84e751c97e4e89c22fce1c701b19be4eb226e558d4b54

SHA512
4da86555873c1bc0af869d648e8452214694674317a3cec2f7e13ecfe0750b26f2f65a0fd3fb5c3d25e2372f0ce18e33c852e782c427d41feb7dc8871f52b132

Download Submit
C:\Users\Admin\AppData\Roaming\Restreful\Eleglate.ini
Filesize
331B

MD5
4f15e7766aed94b7c71dd7be0689eba9

SHA1
6eda5e6713b912397cfde2618bdf8d5f9ee3faae

SHA256
f4e9f0f722021049aac7416958965d1920c168f3bef1ac8386f568023d863395

SHA512
a568fb2d509f3c66c022b93a9432d510829fec723be0320a89556720b9ef00a780ddcddd7232defb386d2c5f200aa7bf1bc2997cc343fa39f397f317bbe07653

Download Submit
C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
Filesize
2.0MB

MD5
04340835c59a7ed913b2e432a64fbc7b

SHA1
1572c0c40a9f4cb21834bf5cfeeba6139092126e

SHA256
b578edbd97db3d31db4717035c137c8f85cf0d7692e12bfea268e7741b322864

SHA512
7fa6af71a33f8f36c2027cf6dfb2efd779ed7649d532fe7f4508210d6add19a486ff95fb382add6cfabfd041f212105427c436d4bde03404c213000386b3a5ee

Download Submit
C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
Filesize
2.0MB

MD5
04340835c59a7ed913b2e432a64fbc7b

SHA1
1572c0c40a9f4cb21834bf5cfeeba6139092126e

SHA256
b578edbd97db3d31db4717035c137c8f85cf0d7692e12bfea268e7741b322864

SHA512
7fa6af71a33f8f36c2027cf6dfb2efd779ed7649d532fe7f4508210d6add19a486ff95fb382add6cfabfd041f212105427c436d4bde03404c213000386b3a5ee

Download Submit
C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
Filesize
2.0MB

MD5
04340835c59a7ed913b2e432a64fbc7b

SHA1
1572c0c40a9f4cb21834bf5cfeeba6139092126e

SHA256
b578edbd97db3d31db4717035c137c8f85cf0d7692e12bfea268e7741b322864

SHA512
7fa6af71a33f8f36c2027cf6dfb2efd779ed7649d532fe7f4508210d6add19a486ff95fb382add6cfabfd041f212105427c436d4bde03404c213000386b3a5ee

Download Submit
C:\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
Filesize
2.0MB

MD5
04340835c59a7ed913b2e432a64fbc7b

SHA1
1572c0c40a9f4cb21834bf5cfeeba6139092126e

SHA256
b578edbd97db3d31db4717035c137c8f85cf0d7692e12bfea268e7741b322864

SHA512
7fa6af71a33f8f36c2027cf6dfb2efd779ed7649d532fe7f4508210d6add19a486ff95fb382add6cfabfd041f212105427c436d4bde03404c213000386b3a5ee

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D
Filesize
471B

MD5
438d2b95bff76a4aca6e3c59eb6a5382

SHA1
33e970e4152550f3c222a57f782828fecaff5a0a

SHA256
6769b7b999e28b61e233371c8a0ed1f8e8520c6a02347124eb167c5c0a7b10a8

SHA512
e6666c54bce6c5f2e127884313a010a91230b2ebc86a47d994e83dc7ed276329d3783bda97f0e573f3de8c499dd407e231e955892c6a52790c4715975164a5e7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FFA6E45777C6CE08CA96D0E3CFF29477
Filesize
471B

MD5
5ba190d7308ad2a6846536be7973d093

SHA1
e603159b2da20467f4576436bc7e0eea54ad4d92

SHA256
d5632e3b43673d4335791240538e5ae3b43daf1881dafcb59a5ae748061773b6

SHA512
f6a5526c76129bbe876a002abdffc28c755572f710885911d07fb1ffe65c8bcc5c1a43b53692bf92d708c2f88c97d2a1f6486a11d3fc5b309dc1b89279dcb38b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_D14B79B440CDC26D7D21C81855E2C04D
Filesize
434B

MD5
37dfb6eb30faff503179055f02180d01

SHA1
420bb830775af0437dcf987ee0210a480fba9ee7

SHA256
1354d7bc0b44129d272ff6fccf592bb5dcdee0ca373f2c5f625ab2251bf9f9e2

SHA512
c60e7d9d472ab56f471afc5f0dea1f9ba619e0535bb4d0fa73b630379ddf25dd423b70ad4395a549ef709631d0089c1c9ecd32f1717e006b98449187a661a5ae

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FFA6E45777C6CE08CA96D0E3CFF29477
Filesize
426B

MD5
314cc3424c332e9331900f213c869223

SHA1
3431aa4d8125a26b4db88c6ea54c1d889fd3801c

SHA256
c24e42f840c7a57444bd2a6765657887ee7e8ad1460d5f2ecf131633ea7c058b

SHA512
7fca9de25ae506d300c55c3a93e9e5868104416613342146760595404c684f64ebb01ede15913b9466d8672854bfa10613c6851d857cccc25bebd1031ab9e4c7

Download Submit
\??\c:\users\admin\appdata\roaming\restreful\Eleglate.ini
Filesize
347B

MD5
04e676aa6fd6541b9dbcc9c9282ab343

SHA1
0da31b0abd78b6b4e268776b7bf8adecf458d705

SHA256
d4577b640306fa6d8ff5a43087e4ddf0a3a2555465c97152c37c54b87646781e

SHA512
b4bcda1ff369559276cdc2cf09f29d6eb07b03dadc7ecd79847dd5da0428bbd08e2def3d49f118b8b7f4f006c93bb0e357a39a83b0f66569c631b9c2052f598b

Download Submit
\??\c:\users\admin\appdata\roaming\restreful\Eleglate.ini
Filesize
214B

MD5
67ed326069c917d836b1ab8a082da26d

SHA1
e96aeb341bf0656b89c91c4599cd03adca6cfdc6

SHA256
9a2750b9333070cf987f2bf83e037a7aefa47d9966433f039bed2cafdd0dc86a

SHA512
06745a75e99eaacbaa29ba0020e1b5b64d0349a8f501c8fa5282a4eef92e59b3510fcf8ceed99d6df77874154aac42884cef02573b8123ccc5c9fb59b77267bc

Download Submit
\??\c:\users\admin\appdata\roaming\restreful\Eleglate.ini
Filesize
214B

MD5
3a12ecb0eaea51892921341305082f28

SHA1
d36c899715ebf2b223ab2d255ad1b59761b04178

SHA256
a52775ffa11346b7d8e2b0aef868fb9b7f33d603bec0783f2b4e670512065178

SHA512
2e5ee9d26dfcb48c300fb6183679cc6a44491135128eb4ff290f41d76978a5d820ff757fa4313efca127328fa741f5491403d9e0e46884bd21c521305db9c000

Download Submit
\??\c:\users\admin\appdata\roaming\restreful\wnsvdarme.dll
Filesize
1.9MB

MD5
e4ca9eadaae1c2bb70b07263b74ed91e

SHA1
0321c5b0654dd17ffe60e36afa4bbe39bd3a4618

SHA256
56a926ef76d060ec87e8672e94c0f0617cfac66579cae5189693183c90adfb9f

SHA512
a6a05e649b3f77821ea360e46cf064a62bf050b5caa26750294677b1aa6fc0812d3478d1f60f3aead5de6e24122993d568089dae284c654d789d6e0c48ce9132

Download Submit
\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe
Filesize
4.3MB

MD5
abcade080b90bfff8480d3c19299d6ef

SHA1
28ce4f0bc106ad7197c7347e5a3f4975f54c8843

SHA256
e707c901ee0898862445d3274a92e06c8b3558bd712a6c7a37fcfa436c8fee54

SHA512
cd328e0e8bf17972ae92a470553fce643fdd2312d45a044e80767831ce2433dff75e66c1318a7fc9b75f1cb7be07f4bb56ec87766ea04f50a89ccadba09c7a0b

Download Submit
\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe
Filesize
4.3MB

MD5
abcade080b90bfff8480d3c19299d6ef

SHA1
28ce4f0bc106ad7197c7347e5a3f4975f54c8843

SHA256
e707c901ee0898862445d3274a92e06c8b3558bd712a6c7a37fcfa436c8fee54

SHA512
cd328e0e8bf17972ae92a470553fce643fdd2312d45a044e80767831ce2433dff75e66c1318a7fc9b75f1cb7be07f4bb56ec87766ea04f50a89ccadba09c7a0b

Download Submit
\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
Filesize
7.1MB

MD5
be5e70eb8323ad81f67eae0bcadf37b7

SHA1
675711f6bff27068503472acdd78ac2570cbc515

SHA256
59f35741e20b2944f6f55ef732adebb06fe1ca2771fb9fffaeb6e56943b3bdb9

SHA512
e3c57cbbebe9d77a1f0e15a5864d002bc3c70c62a1ed33e0db1ecefef18a3831a8c9cc3b30f014c74e66b35f163f114ea6435e5b7474300855a92aeb9e67bed0

Download Submit
\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
Filesize
2.6MB

MD5
81dc21c734602ca9b9e4e086f19d9ee0

SHA1
269a928d70022e5388efeb30c3cefb39b2f1ab52

SHA256
551537503f89d58ab32e991b128e4a323306f6df2462a31de833813f0a7ec614

SHA512
a56d9bc449f59752a938b42d7423d45b6811534e8a38dc177e46f578ba275e160918dcc5881f5a0633bc905f0e44752546f6fc277b88c120b779d060e5146862

Download Submit
\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
Filesize
2.6MB

MD5
81dc21c734602ca9b9e4e086f19d9ee0

SHA1
269a928d70022e5388efeb30c3cefb39b2f1ab52

SHA256
551537503f89d58ab32e991b128e4a323306f6df2462a31de833813f0a7ec614

SHA512
a56d9bc449f59752a938b42d7423d45b6811534e8a38dc177e46f578ba275e160918dcc5881f5a0633bc905f0e44752546f6fc277b88c120b779d060e5146862

Download Submit
\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
Filesize
2.6MB

MD5
81dc21c734602ca9b9e4e086f19d9ee0

SHA1
269a928d70022e5388efeb30c3cefb39b2f1ab52

SHA256
551537503f89d58ab32e991b128e4a323306f6df2462a31de833813f0a7ec614

SHA512
a56d9bc449f59752a938b42d7423d45b6811534e8a38dc177e46f578ba275e160918dcc5881f5a0633bc905f0e44752546f6fc277b88c120b779d060e5146862

Download Submit
\Program Files (x86)\WanNengSoftManager\WnUninst.exe
Filesize
4.1MB

MD5
520fb9973d0baed6071ad1d250feb2d3

SHA1
0aa9b05338df7336a86816dcd274ad6bc473740e

SHA256
33f80c4388529b4e9bb2c72582a83a4bac79030aaa2646cfe1a09d6c4f1526f4

SHA512
03adbf7208b1a2c6ad3f48c1643eb0389717d79cc42cb35728561f1c92c781dd79c2c40cb09712c5d27289b78ba6351c1ce1fa1a0a04eab6d4396488e6442c79

Download Submit
\Program Files (x86)\WanNengSoftManager\wke.dll
Filesize
11.2MB

MD5
2f168e79442731d29813727c37277b73

SHA1
2e7ea5a3e50bb2439f2a332ee26e2c447ed0d56c

SHA256
53aa5fbe2464996f462592a9ba28af5952cb7a436e35932c005a11b75cde85c9

SHA512
51807548a73f2a0f99c94f6a5db17168ac8053bfe99a01e97f54ee2d21d366bd436ff8f6a2b641a849d348ae9ffead4f33c9f63a9ba683013c0a51bb1b7f2e4c

Download Submit
\Program Files (x86)\WanNengSoftManager\wke.dll
Filesize
11.2MB

MD5
2f168e79442731d29813727c37277b73

SHA1
2e7ea5a3e50bb2439f2a332ee26e2c447ed0d56c

SHA256
53aa5fbe2464996f462592a9ba28af5952cb7a436e35932c005a11b75cde85c9

SHA512
51807548a73f2a0f99c94f6a5db17168ac8053bfe99a01e97f54ee2d21d366bd436ff8f6a2b641a849d348ae9ffead4f33c9f63a9ba683013c0a51bb1b7f2e4c

Download Submit
\Users\Admin\AppData\Roaming\Restreful\WnSvceous.exe
Filesize
2.0MB

MD5
04340835c59a7ed913b2e432a64fbc7b

SHA1
1572c0c40a9f4cb21834bf5cfeeba6139092126e

SHA256
b578edbd97db3d31db4717035c137c8f85cf0d7692e12bfea268e7741b322864

SHA512
7fa6af71a33f8f36c2027cf6dfb2efd779ed7649d532fe7f4508210d6add19a486ff95fb382add6cfabfd041f212105427c436d4bde03404c213000386b3a5ee

Download Submit
\Users\Admin\AppData\Roaming\Restreful\WnSvdarme.dll
Filesize
1.9MB

MD5
e4ca9eadaae1c2bb70b07263b74ed91e

SHA1
0321c5b0654dd17ffe60e36afa4bbe39bd3a4618

SHA256
56a926ef76d060ec87e8672e94c0f0617cfac66579cae5189693183c90adfb9f

SHA512
a6a05e649b3f77821ea360e46cf064a62bf050b5caa26750294677b1aa6fc0812d3478d1f60f3aead5de6e24122993d568089dae284c654d789d6e0c48ce9132

Download Submit
memory/112-163-0x0000000000000000-mapping.dmp

Download
memory/560-65-0x00000000039B0000-0x00000000039C0000-memory.dmp

Filesize
64KB

Download
memory/560-64-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/596-113-0x0000000000000000-mapping.dmp

Download
memory/596-147-0x0000000010000000-0x0000000010700000-memory.dmp

Filesize
7.0MB

Download
memory/680-61-0x0000000000000000-mapping.dmp

Download
memory/680-63-0x0000000073CD1000-0x0000000073CD3000-memory.dmp

Filesize
8KB

Download
memory/940-88-0x0000000010000000-0x00000000102E2000-memory.dmp

Filesize
2.9MB

Download
memory/940-106-0x00000000023F0000-0x0000000002611000-memory.dmp

Filesize
2.1MB

Download
memory/1012-120-0x0000000000000000-mapping.dmp

Download
memory/1256-70-0x0000000073690000-0x0000000073C3B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-71-0x0000000073690000-0x0000000073C3B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-66-0x0000000000000000-mapping.dmp

Download
memory/1488-141-0x0000000010000000-0x0000000010119000-memory.dmp

Filesize
1.1MB

Download
memory/1488-119-0x0000000000000000-mapping.dmp

Download
memory/1640-162-0x0000000000000000-mapping.dmp

Download
memory/1684-102-0x0000000000000000-mapping.dmp

Download
memory/1700-55-0x0000000010000000-0x0000000010520000-memory.dmp

Filesize
5.1MB

Download
memory/1700-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1808-96-0x0000000000000000-mapping.dmp

Download
memory/1884-98-0x0000000000000000-mapping.dmp

Download
memory/1916-158-0x0000000000000000-mapping.dmp

Download