Analysis
-
max time kernel
744s -
max time network
804s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 15:45
Static task
static1
Behavioral task
behavioral1
Sample
filmora_64bit_full846.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
filmora_64bit_full846.exe
Resource
win10v2004-20220812-en
General
-
Target
filmora_64bit_full846.exe
-
Size
444.6MB
-
MD5
d0c1fd8374b9241906c3201f91eb7b35
-
SHA1
53ab7408b83d5163b70c4e792009a7a3b16b5cf1
-
SHA256
8d0ce60fb79cf6d404332ab17ba16ee54dd0c5c046c8e6b09424eea23223b534
-
SHA512
8a33d642e2edd3cf562f17429d0ba630e7368e1a2b294bde3a1f9529ecf45b980a5f8455187cfadcc0b3c2647316d18a58c9de1dc7eba422a675cb2e38953fba
-
SSDEEP
6291456:r+doXbLh28WlhAwUU+QrMRKBJdIQz8eMxtLwZsRTpqSNN2nL7iHMfZLfHnWs/u+h:uoNWA3ULHuoQ0WTV40Mt//zB0S
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Wondershare Filmora 11.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Wondershare Filmora 11.exe -
Executes dropped EXE 11 IoCs
Processes:
filmora_64bit_full846.tmp_setup64.tmpWondershare Helper Compact.exeWondershare Helper Compact.tmpWSHelper.exevcredist_x64.exeinstall.exeWondershare NativePush.exeWondershare NativePush.tmpWondershare Filmora 11.exeWondershare Filmora 11.exepid process 980 filmora_64bit_full846.tmp 1116 _setup64.tmp 864 Wondershare Helper Compact.exe 1344 Wondershare Helper Compact.tmp 1968 WSHelper.exe 1552 vcredist_x64.exe 1584 install.exe 288 Wondershare NativePush.exe 756 Wondershare NativePush.tmp 2580 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
ie4uinit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0" ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*" ie4uinit.exe -
Registers COM server for autorun 1 TTPs 1 IoCs
Processes:
ie4uinit.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32 ie4uinit.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Wondershare Filmora 11.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Wondershare Filmora 11.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Wondershare Filmora 11.exe -
Loads dropped DLL 64 IoCs
Processes:
filmora_64bit_full846.exefilmora_64bit_full846.tmpWondershare Helper Compact.exeWondershare Helper Compact.tmpWSHelper.exevcredist_x64.exeinstall.exeWondershare NativePush.exeexplorer.exeWondershare Filmora 11.exepid process 1180 filmora_64bit_full846.exe 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 1264 1264 1264 1264 980 filmora_64bit_full846.tmp 1264 1264 864 Wondershare Helper Compact.exe 1344 Wondershare Helper Compact.tmp 1344 Wondershare Helper Compact.tmp 1344 Wondershare Helper Compact.tmp 1344 Wondershare Helper Compact.tmp 1344 Wondershare Helper Compact.tmp 1968 WSHelper.exe 1968 WSHelper.exe 1968 WSHelper.exe 980 filmora_64bit_full846.tmp 1552 vcredist_x64.exe 1552 vcredist_x64.exe 884 884 1584 install.exe 980 filmora_64bit_full846.tmp 288 Wondershare NativePush.exe 980 filmora_64bit_full846.tmp 980 filmora_64bit_full846.tmp 1264 1264 2656 explorer.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Wondershare Helper Compact.tmpdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Wondershare Helper Compact.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wondershare Helper Compact.exe = "C:\\Program Files (x86)\\Common Files\\Wondershare\\Wondershare Helper Compact\\WSHelper.exe" Wondershare Helper Compact.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Wondershare Filmora 11.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Wondershare Filmora 11.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Wondershare Filmora 11.exedescription ioc process File opened for modification \??\PhysicalDrive0 Wondershare Filmora 11.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Wondershare Filmora 11.exepid process 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe -
Drops file in Program Files directory 42 IoCs
Processes:
Wondershare Helper Compact.tmpdescription ioc process File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-58JGT.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-8NV26.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-VUUOL.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-CF0OP.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-LIMSB.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-1T7AU.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-4AUGO.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-9N90U.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-5IQ3M.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-84138.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.dat Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-JF3K0.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-IQ78S.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-9T37P.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-CANPT.tmp Wondershare Helper Compact.tmp File opened for modification C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Wondershare Helper Compact.exe Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-HLVRE.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-1D3KA.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-LEBF4.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-SSREO.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-V0BK8.tmp Wondershare Helper Compact.tmp File opened for modification C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.ini Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-48KJS.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-1L7LM.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-KJDQS.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-H4460.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\is-O6SS7.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-57US5.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-27AV1.tmp Wondershare Helper Compact.tmp File opened for modification C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.dat Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Wondershare Helper Compact.exe Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe_temp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-JUSQO.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-PLJ4F.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-8C4NO.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-39ROT.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-NPMC1.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\is-SMV3J.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-29C4R.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-TBF3T.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-NU92I.tmp Wondershare Helper Compact.tmp File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-FA1VO.tmp Wondershare Helper Compact.tmp -
Drops file in Windows directory 18 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729 msiexec.exe File created \??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8 msiexec.exe File created \??\c:\Windows\Installer\75aaf0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB86A.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20221204165832709.0\9.0.30729.4148.policy msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8 msiexec.exe File created \??\c:\Windows\Installer\75aaf4.msi msiexec.exe File opened for modification \??\c:\Windows\Installer\75aaf2.ipi msiexec.exe File opened for modification \??\c:\Windows\Installer\75aaf0.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20221204165824597.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_22d6ba8a.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20221204165824597.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_22d6ba8a.manifest msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20221204165824597.0 msiexec.exe File created \??\c:\Windows\Installer\75aaf2.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20221204165832709.0\9.0.30729.4148.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20221204165824597.0\vcomp90.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20221204165832709.0 msiexec.exe File opened for modification \??\c:\Windows\Installer\ msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Wondershare Filmora 11.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Wondershare Filmora 11.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Wondershare Filmora 11.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
ie4uinit.exefilmora_64bit_full846.tmpdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "4" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION filmora_64bit_full846.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\Wondershare Filmora 11.exe = "9999" filmora_64bit_full846.tmp Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation ie4uinit.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe -
Modifies registry class 64 IoCs
Processes:
ie4uinit.exeWSHelper.exefilmora_64bit_full846.tmpmsiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C5CAFA8E-F69D-4E6F-9BF3-1F4522AFD4BE}\TypeLib\Version = "1.1" WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}\TypeLib WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}\TypeLib\Version = "1.1" WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\ProxyStubClsid32 WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B76550E2-048B-4D8C-B432-4668A54EDEA3}\ProxyStubClsid32 WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\ = "&Open" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\open ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\PropertySheetHandlers\{FBF23B40-E3F0-101B-8488-00AA003E56F8} ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36B0BA4B-20B5-4369-BBCA-9FAADC8EAC19}\TypeLib WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WFPBundlesFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Wondershare\\Wondershare Filmora\\11.7.3.814\\Wondershare Filmora 11.exe,2" filmora_64bit_full846.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithProgIds\mhtmlfile ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374} WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1007C6B46D7C017319E3B52CF3EC196E\SourceList\LastUsedSource = "n;1;c:\\22b8232e97aa021b093e99\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WFPBundlesFile\Version = "11.7.3.814" filmora_64bit_full846.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.svg\Content Type = "image/svg+xml" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\CommandId = "IE.File" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\ShellEx\PropertyHandler ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iexplore.exe ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}\ProxyStubClsid32 WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC}\ProxyStubClsid32 WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8E215B99-0763-42B4-9D47-AF5F8C26B49A}\Info filmora_64bit_full846.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE filmora_64bit_full846.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\EditFlags = "131074" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\ = "open" ie4uinit.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\ddeexec ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C5CAFA8E-F69D-4E6F-9BF3-1F4522AFD4BE}\TypeLib WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WFIPFile\Shell filmora_64bit_full846.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WFPTSFile\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wondershare\\Wondershare Filmora\\Wondershare Filmora 11.exe\" \"-share:%1\"" filmora_64bit_full846.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\ = "Pinned Site Shortcut" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" %1" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\tn3270\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-909" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\TypeLib WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WFPBundlesFile\path = "C:\\Users\\Admin\\AppData\\Local\\Wondershare\\Wondershare Filmora" filmora_64bit_full846.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D3609D2-1D8A-4E9F-884B-438AFDDECB86}\ProxyStubClsid32 WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36B0BA4B-20B5-4369-BBCA-9FAADC8EAC19}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\TypeLib\Version = "1.1" WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B76550E2-048B-4D8C-B432-4668A54EDEA3}\TypeLib\Version = "1.1" WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}\TypeLib\Version = "1.1" WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{225BE4D8-64CA-49B1-9630-917F2D92F452}\ = "ISilentInstallProduct" WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{225BE4D8-64CA-49B1-9630-917F2D92F452}\ProxyStubClsid32 WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}\TypeLib WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WFPFile\Version = "11.7.3.814" filmora_64bit_full846.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5731" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\opennew\CommandId = "IE.Protocol" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449} ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36B0BA4B-20B5-4369-BBCA-9FAADC8EAC19} WSHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ = "Internet Shortcut" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open\command ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WFIPFile\Shell\Open\ = "&Open" filmora_64bit_full846.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\PropertyHandler ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D3609D2-1D8A-4E9F-884B-438AFDDECB86}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547} WSHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shell ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rlogin\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-908" ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1007C6B46D7C017319E3B52CF3EC196E\AdvertiseFlags = "388" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Wondershare Filmora 11.exepid process 2700 Wondershare Filmora 11.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exeWondershare Helper Compact.tmpmsiexec.exechrome.exechrome.exeWondershare Filmora 11.exepid process 1044 powershell.exe 1344 Wondershare Helper Compact.tmp 1344 Wondershare Helper Compact.tmp 1344 Wondershare Helper Compact.tmp 1088 msiexec.exe 1088 msiexec.exe 1200 chrome.exe 544 chrome.exe 544 chrome.exe 2580 Wondershare Filmora 11.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
filmora_64bit_full846.tmppid process 980 filmora_64bit_full846.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeinstall.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1044 powershell.exe Token: SeShutdownPrivilege 1584 install.exe Token: SeIncreaseQuotaPrivilege 1584 install.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeSecurityPrivilege 1088 msiexec.exe Token: SeCreateTokenPrivilege 1584 install.exe Token: SeAssignPrimaryTokenPrivilege 1584 install.exe Token: SeLockMemoryPrivilege 1584 install.exe Token: SeIncreaseQuotaPrivilege 1584 install.exe Token: SeMachineAccountPrivilege 1584 install.exe Token: SeTcbPrivilege 1584 install.exe Token: SeSecurityPrivilege 1584 install.exe Token: SeTakeOwnershipPrivilege 1584 install.exe Token: SeLoadDriverPrivilege 1584 install.exe Token: SeSystemProfilePrivilege 1584 install.exe Token: SeSystemtimePrivilege 1584 install.exe Token: SeProfSingleProcessPrivilege 1584 install.exe Token: SeIncBasePriorityPrivilege 1584 install.exe Token: SeCreatePagefilePrivilege 1584 install.exe Token: SeCreatePermanentPrivilege 1584 install.exe Token: SeBackupPrivilege 1584 install.exe Token: SeRestorePrivilege 1584 install.exe Token: SeShutdownPrivilege 1584 install.exe Token: SeDebugPrivilege 1584 install.exe Token: SeAuditPrivilege 1584 install.exe Token: SeSystemEnvironmentPrivilege 1584 install.exe Token: SeChangeNotifyPrivilege 1584 install.exe Token: SeRemoteShutdownPrivilege 1584 install.exe Token: SeUndockPrivilege 1584 install.exe Token: SeSyncAgentPrivilege 1584 install.exe Token: SeEnableDelegationPrivilege 1584 install.exe Token: SeManageVolumePrivilege 1584 install.exe Token: SeImpersonatePrivilege 1584 install.exe Token: SeCreateGlobalPrivilege 1584 install.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
filmora_64bit_full846.tmpWSHelper.exechrome.exepid process 980 filmora_64bit_full846.tmp 1968 WSHelper.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe 544 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WSHelper.exeWondershare Filmora 11.exepid process 1968 WSHelper.exe 2700 Wondershare Filmora 11.exe 2700 Wondershare Filmora 11.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
filmora_64bit_full846.exefilmora_64bit_full846.tmpWondershare Helper Compact.exeWondershare Helper Compact.tmpvcredist_x64.exedescription pid process target process PID 1180 wrote to memory of 980 1180 filmora_64bit_full846.exe filmora_64bit_full846.tmp PID 1180 wrote to memory of 980 1180 filmora_64bit_full846.exe filmora_64bit_full846.tmp PID 1180 wrote to memory of 980 1180 filmora_64bit_full846.exe filmora_64bit_full846.tmp PID 1180 wrote to memory of 980 1180 filmora_64bit_full846.exe filmora_64bit_full846.tmp PID 1180 wrote to memory of 980 1180 filmora_64bit_full846.exe filmora_64bit_full846.tmp PID 1180 wrote to memory of 980 1180 filmora_64bit_full846.exe filmora_64bit_full846.tmp PID 1180 wrote to memory of 980 1180 filmora_64bit_full846.exe filmora_64bit_full846.tmp PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp powershell.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp powershell.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp powershell.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp powershell.exe PID 980 wrote to memory of 1116 980 filmora_64bit_full846.tmp _setup64.tmp PID 980 wrote to memory of 1116 980 filmora_64bit_full846.tmp _setup64.tmp PID 980 wrote to memory of 1116 980 filmora_64bit_full846.tmp _setup64.tmp PID 980 wrote to memory of 1116 980 filmora_64bit_full846.tmp _setup64.tmp PID 980 wrote to memory of 1904 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1904 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1904 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1904 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1904 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1904 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1904 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 836 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 836 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 836 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 836 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 836 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 836 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 836 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 1044 980 filmora_64bit_full846.tmp regsvr32.exe PID 980 wrote to memory of 284 980 filmora_64bit_full846.tmp ie4uinit.exe PID 980 wrote to memory of 284 980 filmora_64bit_full846.tmp ie4uinit.exe PID 980 wrote to memory of 284 980 filmora_64bit_full846.tmp ie4uinit.exe PID 980 wrote to memory of 284 980 filmora_64bit_full846.tmp ie4uinit.exe PID 980 wrote to memory of 864 980 filmora_64bit_full846.tmp Wondershare Helper Compact.exe PID 980 wrote to memory of 864 980 filmora_64bit_full846.tmp Wondershare Helper Compact.exe PID 980 wrote to memory of 864 980 filmora_64bit_full846.tmp Wondershare Helper Compact.exe PID 980 wrote to memory of 864 980 filmora_64bit_full846.tmp Wondershare Helper Compact.exe PID 864 wrote to memory of 1344 864 Wondershare Helper Compact.exe Wondershare Helper Compact.tmp PID 864 wrote to memory of 1344 864 Wondershare Helper Compact.exe Wondershare Helper Compact.tmp PID 864 wrote to memory of 1344 864 Wondershare Helper Compact.exe Wondershare Helper Compact.tmp PID 864 wrote to memory of 1344 864 Wondershare Helper Compact.exe Wondershare Helper Compact.tmp PID 864 wrote to memory of 1344 864 Wondershare Helper Compact.exe Wondershare Helper Compact.tmp PID 864 wrote to memory of 1344 864 Wondershare Helper Compact.exe Wondershare Helper Compact.tmp PID 864 wrote to memory of 1344 864 Wondershare Helper Compact.exe Wondershare Helper Compact.tmp PID 1344 wrote to memory of 1968 1344 Wondershare Helper Compact.tmp WSHelper.exe PID 1344 wrote to memory of 1968 1344 Wondershare Helper Compact.tmp WSHelper.exe PID 1344 wrote to memory of 1968 1344 Wondershare Helper Compact.tmp WSHelper.exe PID 1344 wrote to memory of 1968 1344 Wondershare Helper Compact.tmp WSHelper.exe PID 980 wrote to memory of 1552 980 filmora_64bit_full846.tmp vcredist_x64.exe PID 980 wrote to memory of 1552 980 filmora_64bit_full846.tmp vcredist_x64.exe PID 980 wrote to memory of 1552 980 filmora_64bit_full846.tmp vcredist_x64.exe PID 980 wrote to memory of 1552 980 filmora_64bit_full846.tmp vcredist_x64.exe PID 980 wrote to memory of 1552 980 filmora_64bit_full846.tmp vcredist_x64.exe PID 980 wrote to memory of 1552 980 filmora_64bit_full846.tmp vcredist_x64.exe PID 980 wrote to memory of 1552 980 filmora_64bit_full846.tmp vcredist_x64.exe PID 1552 wrote to memory of 1584 1552 vcredist_x64.exe install.exe PID 1552 wrote to memory of 1584 1552 vcredist_x64.exe install.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\filmora_64bit_full846.exe"C:\Users\Admin\AppData\Local\Temp\filmora_64bit_full846.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CF8UH.tmp\filmora_64bit_full846.tmp"C:\Users\Admin\AppData\Local\Temp\is-CF8UH.tmp\filmora_64bit_full846.tmp" /SL5="$2022C,464353272,421888,C:\Users\Admin\AppData\Local\Temp\filmora_64bit_full846.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" [Environment]::GetFolderPath('MyDocuments') | Out-File "C:\Users\Public\Documents\B30281EA-BA02-4586-86F8-C9BE813884C1.txt" -Encoding UTF83⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\_isetup\_setup64.tmphelper 105 0x1BC3⤵
- Executes dropped EXE
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s atimpenc.dll3⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s atixcode.dll3⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s CFDecode64.ax3⤵
-
C:\Windows\system32\ie4uinit.exe"C:\Windows\system32\ie4uinit.exe" -show3⤵
- Modifies Installed Components in the registry
- Registers COM server for autorun
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\Wondershare Helper Compact.exe"C:\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\Wondershare Helper Compact.exe" /VERYSILENT /SP-3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NK81B.tmp\Wondershare Helper Compact.tmp"C:\Users\Admin\AppData\Local\Temp\is-NK81B.tmp\Wondershare Helper Compact.tmp" /SL5="$401E8,2101212,54272,C:\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\Wondershare Helper Compact.exe" /VERYSILENT /SP-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\vcredist_x64.exe" /q3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\22b8232e97aa021b093e99\install.exec:\22b8232e97aa021b093e99\.\install.exe /q4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare NativePush.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare NativePush.exe" /VERYSILENT /BINDINSTALL3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-LR17Q.tmp\Wondershare NativePush.tmp"C:\Users\Admin\AppData\Local\Temp\is-LR17Q.tmp\Wondershare NativePush.tmp" /SL5="$601E8,2940891,938496,C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare NativePush.exe" /VERYSILENT /BINDINSTALL4⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://cbs.wondershare.com/go.php?pid=846&m=i&product_version=11.7.3.814&client_sign={BE21BA6A-39BF-4270-85BE-C4DDF34E1369}&is_silent_install=03⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6894f50,0x7fef6894f60,0x7fef6894f704⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1076 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1436 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1724 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3220 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,7153494875820701133,17167226014003020945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1388 /prefetch:84⤵
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora 11.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora 11.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe4⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive where index=1 get serialnumber3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-CF8UH.tmp\filmora_64bit_full846.tmpFilesize
1.4MB
MD52af0d4e9978fbb968cf508e1c74d7aa4
SHA1d30c337db80324e82fb9728cd243f8d1617e8fe0
SHA25648c138ce7c8d80bfaa079c8a387dbd844aebbc0b4be15e3f0ff2bd5dacee85de
SHA51289d35efdbad77558efd17175621a710470497dbfc124e853e14883ce625b1f8fd7b6cb4d98bc2ee13be875056fc9bd3f76343829db4c53b7ab5dab49dd919861
-
C:\Users\Admin\AppData\Local\Temp\is-CF8UH.tmp\filmora_64bit_full846.tmpFilesize
1.4MB
MD52af0d4e9978fbb968cf508e1c74d7aa4
SHA1d30c337db80324e82fb9728cd243f8d1617e8fe0
SHA25648c138ce7c8d80bfaa079c8a387dbd844aebbc0b4be15e3f0ff2bd5dacee85de
SHA51289d35efdbad77558efd17175621a710470497dbfc124e853e14883ce625b1f8fd7b6cb4d98bc2ee13be875056fc9bd3f76343829db4c53b7ab5dab49dd919861
-
C:\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\_isetup\_setup64.tmpFilesize
6KB
MD54ff75f505fddcc6a9ae62216446205d9
SHA1efe32d504ce72f32e92dcf01aa2752b04d81a342
SHA256a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81
SHA512ba0469851438212d19906d6da8c4ae95ff1c0711a095d9f21f13530a6b8b21c3acbb0ff55edb8a35b41c1a9a342f5d3421c00ba395bc13bb1ef5902b979ce824
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\audio\6_Manos_Mars_-_The_Tunning\Data\Manos Mars - The Tunning.mp3Filesize
5.1MB
MD5230d1dcaf630727b6959ed3c7e052162
SHA1a2e94a13b600563d7c8f67401d2b99c6bda1601f
SHA25669b9e0e222a073c72a84b139a21ee039af5deb9870175421dd56c4430af0c4a7
SHA512b1d8efb77aea1f0779a09c85be1dc9f23397caa24d474c97fce46b2ff1aaeaad9024079586eda358ee5977308734b2841d046e9c7cd779fe5941304e504bb038
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\audio\6_Manos_Mars_-_The_Tunning\Manos Mars - The Tunning.jpgFilesize
43KB
MD518a745db233bd85792f1a19a5036ee46
SHA1e0be9174c3905e54e42fc2a2e253add05e144e5d
SHA2565c36703eeb195224fd1185b5cc1b1bec94694624c3793bfc8624a6a6a89f9f13
SHA512d2a69c7235caf43204d9b146a2a6312e0228ff75fcf091ddd71df5e9a9cdb5b9829ec9b47572b070d93081abf11121589710c010ca6228b2b3410050db9b753b
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\audio\6_Manos_Mars_-_The_Tunning\resinfo.jsonFilesize
1017B
MD5a071b748e0d54b1f85868b4447ffbb8d
SHA146e3433968fe27ff4e179842f15a1424d45f938f
SHA256a7ca782def0a8456271735093bf770974ee6dbe6c50ae0a9c45d44d5cd2216ca
SHA51235d85a42057b5b287c5b017c63c077ecc8901035c7afc1732c5be3b10bbd21516b491d5e90f7125535bdaad071fc80598652db9a11563c89af6ef8e0e324fa96
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\audio\6_Manos_Mars_-_The_Tunning\thumbnail.pngFilesize
43KB
MD518a745db233bd85792f1a19a5036ee46
SHA1e0be9174c3905e54e42fc2a2e253add05e144e5d
SHA2565c36703eeb195224fd1185b5cc1b1bec94694624c3793bfc8624a6a6a89f9f13
SHA512d2a69c7235caf43204d9b146a2a6312e0228ff75fcf091ddd71df5e9a9cdb5b9829ec9b47572b070d93081abf11121589710c010ca6228b2b3410050db9b753b
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Blur\Data\Blur.confFilesize
580B
MD52cba176f7e6da606d24280bcb4f21800
SHA122682801b63821d984bcef0ddbc8041c1106008e
SHA25654f56b411a846c05988fb205893dd2b9a7c9611ef4996f5d0a85c3acc3b97b41
SHA5122807feec2188de0508cfe48c542993f4f321b8500c1a7156a2ecc2533ad2194188665f9b257206f608b04611ed9185107f3e22ad2d7514a86a51c6d692daba7b
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Blur\Data\data.xmlFilesize
890B
MD57fc70db5c481bed7f8d31bbc706ed680
SHA1802a368654e54aaf866a20596afec96115d89475
SHA256fe4d6be90fcfc68d9938a8600eead89cc9d4718959804cdf31cc9ad3e6e66352
SHA512f75280c5bd5710b47fa8b8968538c694d2729b3b2aaa85de31bcd3c556a27ec4c5e3b0944b87c71ddd773f8b23bb4bd52a2ec411dedd0aaa64ef08447e429e90
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Blur\Data\filter.xmlFilesize
247B
MD505d76d67a79e794a44e2112e200fcff0
SHA1d2337f191ab40dbd8d0d833e2e77d5555b2f5950
SHA2562a8f8c8f2ef31c33bb27b709ad8e7d27eb5d197bb291b99ea43852399d2c93e3
SHA512587887fb407a4e3b2b5cd1fc4745ea0f530f5997a200097dabf5dd876dd17d132e570b10f4941a8279c652a385810d86c096021c2ee09249f5ad269c88314431
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Blur\Giddiness.jpgFilesize
13KB
MD50a07da55f97eb90c485b20362c092eb5
SHA18689ce0f4374f4263754b2f59fe5b21f2b47fb43
SHA25638eb2e95a3647178e69a2f3fd0d267fadee1048902a6896db66128476e6b9cb9
SHA512faa7618078a198ef8b81de545952383a4ae6bebe21304b3b768accea3f0249586ae2b18626bb07bdfa21413f19f06d9e85d46536e4ac3bd0ddef7125ea04c83d
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Blur\resinfo.jsonFilesize
806B
MD544d8b16d87a46b429c2fdd8862c2d33e
SHA1b5f73423ec32ed9d88d975d5a1a720bfb41da483
SHA256fbfdf49a2c3d23d6a607b4fc067c6a655e97a2ab77ec4140352e1d459749a44b
SHA512a7e02ba36626602088d79bf45fc51ff407feb418f9a6cbbcff57d283ba6f8df591b187a9846f2698bf8506b5aab663b9e3c9d380b30bd2b3e8b04d52150f924c
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Blur\thumbnail.pngFilesize
13KB
MD50a07da55f97eb90c485b20362c092eb5
SHA18689ce0f4374f4263754b2f59fe5b21f2b47fb43
SHA25638eb2e95a3647178e69a2f3fd0d267fadee1048902a6896db66128476e6b9cb9
SHA512faa7618078a198ef8b81de545952383a4ae6bebe21304b3b768accea3f0249586ae2b18626bb07bdfa21413f19f06d9e85d46536e4ac3bd0ddef7125ea04c83d
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\Data\Canvas.clFilesize
2KB
MD5b96393ff4273330ba4934148f3c6cf33
SHA1d29b4bf12cabfffd4bb40542626ee0031972ba1d
SHA2563fd5b0ca591f07f0db067e92b520bc8025c99e0f14d743648cdfbab90fd11c0d
SHA5129fc90d011df78911a72801221225df84d85295a9b4b24706df681553f6acfb42716ddf1bd5cb2e74b8331f5461030a54f4ed901a95aa1f1109bc553a0f4ea3ce
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\Data\Canvas.confFilesize
312B
MD53709157c6cc272fe7c75d6119f59bbbc
SHA1d5fd54977cf30fcaa0810a56a7dcda964d35558e
SHA25694567b68e6a97bc104afb8429e72d3e963688bb70375f927cfd6b2fb833c6095
SHA5125df95e4e0e23b0159981d071263d5bd3891aaf47464a9aeea89a10bcf898ba36edfda27a551e57775e26c31ec55e4af4a765c2e4a07353338de9d029bef11d2e
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\Data\Canvas.fragFilesize
1KB
MD544cbb017a22c59291327187083eb953e
SHA1a7fc71b9b0e0b3abbef18f2b129076a612b2aff1
SHA2562c84ec5d86cdb681e62f3ed5478a2afb2c32d793e7448ef2c31770c248ba34c9
SHA5125b119f3c2afac4258a03b6e3f524cb93c1862577c56d7deaec6792a9b71bd6df8955621715547e6d77a977e98442f6b111502f85ddc059dfd3623c0960faf575
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\Data\data.xmlFilesize
881B
MD5c787222397eb2d14a6071eee02bbd0a3
SHA1ec1ec8bb0acb1748530c7934bb23cfc0f9400628
SHA25689e1f9f1760f65a3ced17a88d54f7193de94272d503c1964687ad27c0f0a3fcb
SHA51231bdfd64b594b52c120a1407811d7d635a10d75f0ae53bf4bd32caac57c3e99575f3b8405bd4da416d8339ee35aec934e4b3f4d3e2f562f7736c02e10bcc7103
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\Data\filter.xmlFilesize
251B
MD552d1f7b3af9de519f666e932df3f08ad
SHA1db769adfb974e8807de745e04180948c6a44ee87
SHA256ac8e595eab14933d54dac071a67e27ce7791ae0af1db4d64361a330fe841e5e3
SHA512afd16c623df65c974645c2c6bd20244665a1c9b93221028ffb1083e92859397b573d3d96ebdd2800254e337aa70061ebfd67805bca143d370ad9d27c0c1af37d
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\Data\sketch.pngFilesize
406KB
MD56a12135e615e8bc6a709a1c75b14915a
SHA128afaa531d56f0687a6aec34c7d63ba779e1630d
SHA25607d7a66090ccfceaa73ee3eee3d45235ed0610d503f85333d1a88ca8e38ffdf1
SHA512e7b558d545038ee8bac621cd90352d2ce4f2608317715e6597c0c8817321c384e8b525dc81ba9e593d3afd18b7fdf5f880f1974a0ca3f85022d2a32dc187d5ab
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\detail.jsonFilesize
1KB
MD5d6829b8d6ae1096c49b9671efd42a066
SHA15d629e7ce81f1176fffb0a51992f96920bc701ee
SHA2565e75b0ba1b6d79d48b0bceaf9504f4f166f14c2ffda0beaa18a31e332c484ab1
SHA512cb12875b2bbb70cf9e43f1374c9f2228789aad29901584ba1c5a09bf41db493075510412d57bb952563d416a090f94d6f44b773749f472ae0c6719b7b6f1bb5a
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\resinfo.jsonFilesize
851B
MD59860cbd54f5e5ba3786029297a13130c
SHA1030258fe0328c002d5c0927b4e0e793c02f533e4
SHA2565a10cc775c2cd405c4b91ff6b175e3d09e8ff16873be7e5691fd911e12a84189
SHA512fe1949b3672017154e2f2cd097d10d4646af6a6b257033b7bee38742f44092c9b1c6319eda9dc998aa85b3b6dabb5d30001e1d242719820d48a95fb1f24814d6
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Canvas\thumbnail.pngFilesize
13KB
MD5861750c7bce751a1facce5f95496e4ad
SHA191ad4f3bc6b2c34104288741d7c3d38ba60c0c8b
SHA256fcdf318c236ccbbc316de791d42cb45f7513b81ea3d4d67543d23a4f53714cf8
SHA5125ad43efbd0e1f528b1a609c477582148de3a77299bbef5c950e96e1db8a6d03a8c4d44c484661bb76c300b14cc2067d88d85746591dc86cc14ba75dc73056add
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\Data\Chromatic Aberration.clFilesize
1KB
MD5efdc96441b214f968c76692ce5cdc4cf
SHA11b4950edcb73e038c6636bfe744c6b12cb8d15cd
SHA256dee4d16cfa62da12f591996626f7a2290b0116c51a5bc188b957d384453b440c
SHA512bbf5b6249160e59ce9f196cf212e15df835da63f59f10e27121d5cd5dc987d7b0a9bceffc19b13c4167de7eba23461b95c9a45da31ebf8b6547d969f213fb8fe
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\Data\Chromatic Aberration.confFilesize
373B
MD5fa4fd0cb17fcd44d173a637dfbe86a39
SHA1afa7151bcc93bc16f4c11b9933f992b28811dd78
SHA25613ead3bc5bd9bf867e6a8a887faaf71a000c2ddfe224478485fbc1bf24b59539
SHA51274af52cad8c563dd35826f0ec35b4f3ffd02d105eb4e1f340a97541c62f70bd23008abf2edf96245c895ac44a36088005d44788ee390bb35e8820b9c6e582292
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\Data\Chromatic Aberration.fragFilesize
813B
MD53cd820caec58eac715848422f37a3d68
SHA15d63ef1f7a284c028c54321e0d37aa6e670f661b
SHA256b0946f203d53cb0cc7cf69971d287f753a2573e7458aabc7b235abdb69a4a019
SHA5129de2f48aca685c045a394c0abb26b2a851b86eb9269cb8573fc0478dccaacf87478e349fe8a54adeb9558c18db4eda75420905d4a7028ef3d641cc25e4deb3db
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\Data\data.xmlFilesize
881B
MD5c787222397eb2d14a6071eee02bbd0a3
SHA1ec1ec8bb0acb1748530c7934bb23cfc0f9400628
SHA25689e1f9f1760f65a3ced17a88d54f7193de94272d503c1964687ad27c0f0a3fcb
SHA51231bdfd64b594b52c120a1407811d7d635a10d75f0ae53bf4bd32caac57c3e99575f3b8405bd4da416d8339ee35aec934e4b3f4d3e2f562f7736c02e10bcc7103
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\Data\filter.xmlFilesize
284B
MD56e617237af4130ccea2db527c1ed9d68
SHA19f6fec29b675d43f46d77026191de7d6a234e28f
SHA256b747530e7368e030a10ffd1881b97eff9016024db8e3b6c8cc30882437c083b2
SHA5123512250d6303673a65ccfe0d90d99fa9392dee765d9a1e85ef4d82b0795a824a21bb424ed6e08bbbc6c61e92c8b767ad179f2ee8b9bf6f00341cc972295b7572
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\detail.jsonFilesize
1KB
MD587bcd107365aafe24d87a87804d70a40
SHA125c2e87c40f8076cfadef98f29a42986b8b97e21
SHA256af2067abff4961face1c668b8a3c659400b9b205e38486ecf72dc2d2e09063ce
SHA5123fe1b2324dfd8965a36c6128bb281773ae95340a434604477caf45b8bf82d18466308e6cd9cf403543f28506807a99ffd336861104afd37817bac1c72d78f3f6
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\resinfo.jsonFilesize
1004B
MD5ace93952cbc6fce4afdddd9b4aa7d79c
SHA12b9b1759f599543d592808a04174b05a28e3d73a
SHA256cd34c4b1b9c06f606a6868fdc44876b85a3c1969e0a95aef9d17aef7ea649f2a
SHA512e1d4f56ccc521928171e023cd6730a903d28e1c1ae236ac2cde46053cd018c36c480815843a876a9e8f9ad532a2e1015a27925b58788b1682cbb7e7946af9c9b
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Chromatic_Aberration\thumbnail.pngFilesize
17KB
MD5e3d183803380efa74659828b75686d3f
SHA1a838d896a9a571bfc9b11d19eb0474f369f4f769
SHA256260e5a2eeb77859882e9bc93c4c20e65dc34feca055597c4d45d4bd56a94070e
SHA512747639bd6cffe2d5199f45f1630a5605d1d9821733dfd6ed2bba0e7764f4d1443724d68b5c426149c1c31361481064ba5343bf7d473c8b9042b19e70ea3eaa22
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Cool_Film\Data\Cool Film.CUBEFilesize
896KB
MD5d012b05a24f80a19d278636e97fee454
SHA19faa9a1695c1b69578c1c7ebdce8745276763f73
SHA256da828049365592b2c45b048094e989f9b9b14990633259e7ab6aa648dc12131e
SHA51200d0bcb917039a7d5e39dd21fc9b851c58b2dd367721b7ea996cd5839a2117f3a7e6b4b2d0c0043a0dd49e34dac98d6c153634967dfc4abaede7625f88da3150
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Cool_Film\Data\data.xmlFilesize
881B
MD5c787222397eb2d14a6071eee02bbd0a3
SHA1ec1ec8bb0acb1748530c7934bb23cfc0f9400628
SHA25689e1f9f1760f65a3ced17a88d54f7193de94272d503c1964687ad27c0f0a3fcb
SHA51231bdfd64b594b52c120a1407811d7d635a10d75f0ae53bf4bd32caac57c3e99575f3b8405bd4da416d8339ee35aec934e4b3f4d3e2f562f7736c02e10bcc7103
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Cool_Film\Data\filter.xmlFilesize
240B
MD5564c47e034810b2905d3c68a9ed36af9
SHA1ca5ce4cc54ebcc24f19cd59e7d3c85d48c9faf0d
SHA25669a0ebb6d127be5de9a8f745d0b72bd79395e83a0e2ecf57270a61cf53dab998
SHA51208c545f1b022eda5f50c677a7cbdc98b02c658ecae8aa2f15cc455de86eeafe9e126976987c838a0287b1dc65ee44ce22a54455a5710f823049380f4f9b8a09f
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Cool_Film\detail.jsonFilesize
1KB
MD523f30bb8847f37cb2332244b07222ec7
SHA1d8f0b4b2d23ab8f49d12380a1ecbee59ede05205
SHA2564fc7b3a16758e14473beb6f2a00d17babd45d473f05e922784314ea6eec4d6c6
SHA5129d2aeb22afd7bb15195f36b64d8ac1e7909b827ad534bf834c21e2bb12cfb081c6e96bd6beb932e18d3f9261efd96a51d6e11fe2f60a68d583619f53442d5fed
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Cool_Film\resinfo.jsonFilesize
925B
MD5ca4257fe37e7f38fcf265c2f099cb496
SHA18df5f77fc8fea1e94f76a29c3ca2639575ba0c0b
SHA25603f4fb5db998dd397e6505e59b858b085a874ec9babdd61a44e76017809ee1b5
SHA5127be17d942f1075ffa3f780b2d256eef4684dbdf6823158b04605e9b3d8191475914b1e9c08acda7fb676e9c0b17ea77bfc5fba80ec96fa7531b85ffe64d232ff
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Cool_Film\thumbnail.pngFilesize
14KB
MD5fcdc0a162c89241e1862ecb50a2f8b59
SHA13c28fa259010d10f09d8583895320e79eb52fcde
SHA256abca20fa9763524b84d62f065b49fb170a8dd5d34cd25d049a6d34ef3956cee4
SHA5126b957189a0c7a247a064ba28e8d8c3c79de6acf9fc7f6b35ea7185c2ca9fd183f01949a468a3e72136e85bc64ba65a21f05ca4dc93f2c10353ec06af5bd114ca
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Four_Seasons\Data\FourSeason.confFilesize
233B
MD5079b01f20da6542f247e120f153e0e4d
SHA15ca043e39701d8bef7204360a4169b8a0d0cf356
SHA25637b297099235ebd38377b0cd2df8479ba9a35c7931fdda5f216565d3f65e424a
SHA5129a0083f6d348c54d606c70e16605b02939d7f716962c395ef1097e5316e273be97ac229f296e52e2c6491a4e2eafe7353e249ee7db0d44a98cae528ee76c1cf0
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Four_Seasons\Data\data.xmlFilesize
881B
MD5c787222397eb2d14a6071eee02bbd0a3
SHA1ec1ec8bb0acb1748530c7934bb23cfc0f9400628
SHA25689e1f9f1760f65a3ced17a88d54f7193de94272d503c1964687ad27c0f0a3fcb
SHA51231bdfd64b594b52c120a1407811d7d635a10d75f0ae53bf4bd32caac57c3e99575f3b8405bd4da416d8339ee35aec934e4b3f4d3e2f562f7736c02e10bcc7103
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Four_Seasons\Data\filter.xmlFilesize
304B
MD56ac43c627cc68ebb418bc474d0471c1c
SHA1192afb065dd08e1ca86c3ad0d601b7e29fa7642b
SHA256671af274f4c1fdb2f2a7bc13f062b6035e7afb85ee2695885fac9699698f9ee9
SHA512e2de5f24cd94f36db3ac01ad441e0270cfd8aae0144ca1b2a8f54271da9f1f4dbe9d2bcd2889dd6cbd636ca83f74f38303d849b666e090cfdf345f818001cf8a
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Four_Seasons\Data\filter9.clFilesize
4KB
MD54c36077497e9a322951a553a8f80e56a
SHA172308486db335145cc74539d88838aa69a602929
SHA2568bfbb01c879b306a00f9bebd89d574a8f4aee9064889460dd62051472914c3b9
SHA5128daf800739a4d6d895faa45974f8061efc94f9e52d71b6fc4b8bac4a13995f4f9d55d08c29d2ae7045b66ed81a16e83b607c18414dd16480de4cbf76df4094b1
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Four_Seasons\detail.jsonFilesize
1KB
MD5ba4447512a9009c71001bff140540ccd
SHA1f1c1d4c9a27da0d362b2bb01d078084a24a9c542
SHA256d916250fc6e6fb6e6c62395271cea6a84f64a73ee75b00f13829e62e49470033
SHA5120f7062d5d4604544e843a63d050106279b2703d9e86f592636ba1e2b765710f1b5c22215f28a4bc952ed4170307a59df0f8111f387e15c1d33ea8d61678427ca
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Four_Seasons\resinfo.jsonFilesize
1KB
MD5dbc3c41dc00522b086aa84f9fbabd21a
SHA10a3fa161d32f3609546106fba40d269010f49463
SHA25667311e4d6ec893926fed5a57c07fe918a13afa367110b3f5402d416d7583c857
SHA512325c7a4e7752cb787c31e0aff2ed2e55a76520fe27a65bc9a97bcb123da9bdc83da5ccf818df9c8ee97f80257de66b242de6ef642e2d35533ac62a2cd54bde70
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Four_Seasons\thumbnail.pngFilesize
14KB
MD51c5950db5a26bf12dbd78f651d6475a1
SHA17cd542a215e97b82a4d6fc7175d73b84fdddcace
SHA2560609a02ea287b37fad05e7855ddada680a84892892e486f0fd21c724206ec4c6
SHA512c2dedf0fb8049880fbcfd3e4455ca93d6d1abe6e3767ee8606f119b7193ce19ec212e3122dd423e8b5a2199103a00e9a51d9b63cd958044547722c541b5fd92c
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Glow\Data\Glow.confFilesize
322B
MD5d17d1c48dd220ab32322c847f2397476
SHA1b522d8faf77216e24dad109858c1c6b6c94938b6
SHA2569424866d4dc3f01c70ec17b9a4fd4d715b3a81efc520ac72e8647d00deee4b72
SHA5127820d94b5b467b6b342fb4c91c406022da7674a1c1c34e8deaa016afeac5f10cd1d98403cc226c7fadb516cc5024fb677023271cf0a5ca3524b981c0c8e11deb
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Glow\Data\data.xmlFilesize
881B
MD5c787222397eb2d14a6071eee02bbd0a3
SHA1ec1ec8bb0acb1748530c7934bb23cfc0f9400628
SHA25689e1f9f1760f65a3ced17a88d54f7193de94272d503c1964687ad27c0f0a3fcb
SHA51231bdfd64b594b52c120a1407811d7d635a10d75f0ae53bf4bd32caac57c3e99575f3b8405bd4da416d8339ee35aec934e4b3f4d3e2f562f7736c02e10bcc7103
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Glow\Data\filter.xmlFilesize
292B
MD522d22505d4e1a1db93be517d177c28c2
SHA1c149488a1527ea9f4a25e4321bc35bd21cd04802
SHA256c04bda43a6a4c2e16c728b5d5ea0a0614e87aaadb1607bb5b04f1256dea9116e
SHA512952246c9888b476f5da8385dd111c17a3677d78b67b96de1dcee363d0c2194c02accdb155ec3324815d46a869fc3f99feecb053351559e2362bee32ae5970341
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Glow\Data\filter5.clFilesize
1KB
MD52112f46fe7daeabf04a0f969c13d50db
SHA1859e7d7db8f3afa2f5240fc054ccba846bab5d40
SHA2561edd1ae3375a54ba2356e99f8a2acd0dcb3fb702f54a62df20dce5376fdc376b
SHA5124f99fe892a43da5214c2a03231299d806f97e5b0eda941bb20f214f84531cdaf7147f38a26bb2295eb1d4afa147d5b8eb1bb66e4f4973ef3ceb804327dba84d8
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Glow\Glow.jpgFilesize
11KB
MD58ff150746d88b967005b07ac0203e22a
SHA102e64ee36c1b0c83a08a3b4fb66dd1b209a2a184
SHA25630470c0c64c55ad036137747f7425acd78f6afe06ff2361b97a88f0a221959b2
SHA512d45e5025c734f0243e16014fb7ab9213f1570c0b75cacadb929f74ee0b9b6fe09e7308699f8896b4bf5844e5f694de0c70b08810f1ac7738e77faeaa59b36aa7
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Glow\resinfo.jsonFilesize
811B
MD5ab5aa38d243315acc65fef52a0a1a0fb
SHA1853816b305720855f4ef93ecfc21a197f6bc373a
SHA256e981f4c1ac881023d92d837f55b48f0635f05be5481c5648d0513153090d6969
SHA512106ef03f48a3657a76246a4533fbdbda855d83eb8cb99e4a642dca448dfd47fa7dcbb0dbb9eb74b7f065e7081ac5ec6e1dfd0034e57d9afd841395d5a93278fa
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Glow\thumbnail.pngFilesize
11KB
MD58ff150746d88b967005b07ac0203e22a
SHA102e64ee36c1b0c83a08a3b4fb66dd1b209a2a184
SHA25630470c0c64c55ad036137747f7425acd78f6afe06ff2361b97a88f0a221959b2
SHA512d45e5025c734f0243e16014fb7ab9213f1570c0b75cacadb929f74ee0b9b6fe09e7308699f8896b4bf5844e5f694de0c70b08810f1ac7738e77faeaa59b36aa7
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Mosaic_f3\Data\data.xmlFilesize
1KB
MD58579c3a1f8e499cce250d47eff003f47
SHA1866207cfbaa6a1b36f03f3e141193fe74386fefe
SHA256141c7bdaa59d9e44591cb43041ff35db973dca777a6c02f38e846e6859b69f4f
SHA51214d202755cbf4a14b4fb3aa32b49f1d8c59d3019c4492220c1c74a05e730d4a93e92fb3cf1f4a3c815eaa0e53a30c55e6eba9b9b9c8fbfeeef1812564c6380e3
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Mosaic_f3\Data\roiBlur.clFilesize
14KB
MD531a122398cb794cb74c6cfbfef845ee6
SHA160e97eff3ffdd80568be4cb04c03b53fd01b3e4f
SHA256c0fedb247c3d805daea25966a43a9f01bb7d91704eb751c7fb0c137218f9767c
SHA5126d707bc064385d86f0151abbf5f632447cef30fd5f321753d2412022ee05d27992eac92fe4db9898fb6e76eb7a43c01ff4c0c8ac501de0c3aa3a25966f65c03e
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Mosaic_f3\Data\roiBlur.confFilesize
1KB
MD5eb53824ccfe11777dd4b9adc6fd7f2c2
SHA172a4563aa64a9609ca4b4c63d7544565edc7799d
SHA256803c747fb709c1aeafd0d170073edf950a927d47489e9cc2543eaf04e1e74a8a
SHA512544593fd348efeb57f56e105553787dad85d4a1c17ea756f85eabd0f21fb7dc019a13fda2f1ec5fb4e62ccd14f344a93e02027731ef3237ab3b846540cefaa69
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Mosaic_f3\detail.jsonFilesize
1KB
MD544c20ef83f7e4e32610f95f9e3103836
SHA1d544c5e1e012602fa552f8c2d1812ca21edee631
SHA25640fb74afc9120580c881b9ee04d4bf8bd90722d2fd70957d231f79dc23addc20
SHA51298dcd9a8a0eac863994a654500a1de61a4b440fdabddacb207b1ad07010a8bb7b57ed324cca18146b245c62f6c4015fb3c8bcb564505d0b45c7f724e73bef599
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Mosaic_f3\resinfo.jsonFilesize
909B
MD5e4a4b02d84583c8e515b70b405915e1c
SHA1416d1d7a1894736ba762065f764b60b88369d6c7
SHA256c8fad0da8a3ddac99844803a98d0d4c48025d8691cb850e9652865db7cf59aae
SHA5126412983eb9ceb75663a3934550841abf5cbe1af9edac5878a5bbcdfa227b56416bf0bdb6e691360b707e58994cec10359a947f6cdd0b95938e29b90180282965
-
C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Download\Filmora\filter\3_Mosaic_f3\thumbnail.pngFilesize
13KB
MD5f9561be0cd045aff686a30dae71769d5
SHA12bd9248b73daad3750053493ff6597c695e379bf
SHA256169c59fb50533275b0d577d1314bd56f3858fe1a00d2b2608fea294afa440eee
SHA512439565d661540b1a555fc6e2e0375f8f0b10fcfa8843a82c7067aa79afa3962d81bc4f0933d9917d937a6b48cf9102aed779252e01122d80a4ef4a6c75f75f9b
-
C:\Users\Public\Documents\B30281EA-BA02-4586-86F8-C9BE813884C1.txtFilesize
29B
MD5feab0c4fdc4baf0deb7fd33695adcbed
SHA122f35b32c7749e14861168bfe5530e5078bbe6be
SHA2567359b0465d62ec27a67d51fe527f9bf1adf5615a216a75b4f972b4253ba82f37
SHA51275b4064a9c17f12757ac01efa9d9933cf046ca257bd3d37a76862276ea8544d2113a68310ef9a1dcf0d113de1c1ab82de8022ea4ef7dd6ffd634b92a7be33568
-
\Users\Admin\AppData\Local\Temp\is-CF8UH.tmp\filmora_64bit_full846.tmpFilesize
1.4MB
MD52af0d4e9978fbb968cf508e1c74d7aa4
SHA1d30c337db80324e82fb9728cd243f8d1617e8fe0
SHA25648c138ce7c8d80bfaa079c8a387dbd844aebbc0b4be15e3f0ff2bd5dacee85de
SHA51289d35efdbad77558efd17175621a710470497dbfc124e853e14883ce625b1f8fd7b6cb4d98bc2ee13be875056fc9bd3f76343829db4c53b7ab5dab49dd919861
-
\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\WSUtilities_Setup.dllFilesize
202KB
MD5665603698f4a865a873082309712aae2
SHA1b3f2c3d1d679181d9c080419b1dfe0563c518c67
SHA256b42085777505d324d56122f2bd6195ec3a6ce47030a31f9ce6b853c5fa8cd5a8
SHA5120444b1b63980f9b762e6e01b7cdc4efc2fd6f713887c07d8cf8b20ab2582f611e1c8434f8b59b8ee4fb6dba497c2c1f80fc6e758dc02c07d2964dd6e1f0b6ace
-
\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\WS_Log_Setup.dllFilesize
104KB
MD5943e0025c5b5c4e0cddb7a9cc7b7d123
SHA15dd92f9fa572eac7ebc467d8835c64af77dd37a2
SHA25643391e665a63b5e9e1288a3c608691f73ece57478e0655363918e8195d85cf81
SHA512cb42c329e0d5f01a224e4e5b89b4ccc54fefc658d37caea40198f4483e5387f08cbdd0e85af7b0618e6ec72c5e5874098c5946bf749c218978003ad99c5fa852
-
\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\_isetup\_setup64.tmpFilesize
6KB
MD54ff75f505fddcc6a9ae62216446205d9
SHA1efe32d504ce72f32e92dcf01aa2752b04d81a342
SHA256a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81
SHA512ba0469851438212d19906d6da8c4ae95ff1c0711a095d9f21f13530a6b8b21c3acbb0ff55edb8a35b41c1a9a342f5d3421c00ba395bc13bb1ef5902b979ce824
-
\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-CRMUG.tmp\innocallback.dllFilesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
memory/284-141-0x0000000000000000-mapping.dmp
-
memory/288-159-0x0000000000000000-mapping.dmp
-
memory/288-165-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/288-161-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/756-163-0x0000000000000000-mapping.dmp
-
memory/836-137-0x0000000000000000-mapping.dmp
-
memory/864-150-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/864-154-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/864-145-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/864-143-0x0000000000000000-mapping.dmp
-
memory/980-67-0x0000000002EF0000-0x0000000002F05000-memory.dmpFilesize
84KB
-
memory/980-58-0x0000000000000000-mapping.dmp
-
memory/980-80-0x0000000074721000-0x0000000074723000-memory.dmpFilesize
8KB
-
memory/1044-74-0x00000000027BB000-0x00000000027DA000-memory.dmpFilesize
124KB
-
memory/1044-68-0x0000000000000000-mapping.dmp
-
memory/1044-69-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmpFilesize
8KB
-
memory/1044-73-0x00000000027B4000-0x00000000027B7000-memory.dmpFilesize
12KB
-
memory/1044-139-0x0000000000000000-mapping.dmp
-
memory/1044-71-0x000007FEF37B0000-0x000007FEF430D000-memory.dmpFilesize
11.4MB
-
memory/1044-72-0x00000000027B4000-0x00000000027B7000-memory.dmpFilesize
12KB
-
memory/1044-70-0x000007FEF4310000-0x000007FEF4D33000-memory.dmpFilesize
10.1MB
-
memory/1116-77-0x0000000000000000-mapping.dmp
-
memory/1180-54-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1180-55-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/1180-61-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/1180-184-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/1344-149-0x0000000001EC0000-0x0000000001ED4000-memory.dmpFilesize
80KB
-
memory/1344-147-0x0000000000000000-mapping.dmp
-
memory/1552-155-0x0000000000000000-mapping.dmp
-
memory/1584-157-0x0000000000000000-mapping.dmp
-
memory/1904-135-0x0000000000000000-mapping.dmp
-
memory/1968-151-0x0000000000000000-mapping.dmp
-
memory/1968-153-0x0000000000230000-0x00000000002E8000-memory.dmpFilesize
736KB
-
memory/2580-166-0x0000000000000000-mapping.dmp
-
memory/2612-168-0x0000000000000000-mapping.dmp
-
memory/2700-178-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-182-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-174-0x000007FEE30F0000-0x000007FEE334D000-memory.dmpFilesize
2.4MB
-
memory/2700-175-0x000007FEDB460000-0x000007FEDB5C8000-memory.dmpFilesize
1.4MB
-
memory/2700-176-0x000000013F370000-0x000000013F654000-memory.dmpFilesize
2.9MB
-
memory/2700-177-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-172-0x000007FEF43B0000-0x000007FEF4773000-memory.dmpFilesize
3.8MB
-
memory/2700-179-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-180-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-181-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-183-0x0000000077420000-0x00000000775C9000-memory.dmpFilesize
1.7MB
-
memory/2700-173-0x0000000000550000-0x0000000001550000-memory.dmpFilesize
16.0MB
-
memory/2700-171-0x0000000000000000-mapping.dmp
-
memory/2700-185-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-186-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-187-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-188-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-189-0x000007FEF2CD0000-0x000007FEF43B0000-memory.dmpFilesize
22.9MB
-
memory/2700-195-0x00000000092A0000-0x00000000092AA000-memory.dmpFilesize
40KB
-
memory/2700-192-0x0000000008640000-0x0000000008650000-memory.dmpFilesize
64KB
-
memory/2700-193-0x0000000077420000-0x00000000775C9000-memory.dmpFilesize
1.7MB
-
memory/2700-194-0x0000000008640000-0x0000000008650000-memory.dmpFilesize
64KB
-
memory/2700-196-0x00000000092A0000-0x00000000092AA000-memory.dmpFilesize
40KB
-
memory/2828-191-0x0000000000000000-mapping.dmp