Analysis

  • max time kernel
    135s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2024 01:21

General

  • Target

    WinIconMakerFreeSetup.msi

  • Size

    35.2MB

  • MD5

    1414b254f44bba8e17b01983dc22adde

  • SHA1

    a12059b028647968a03d9483815dc5c13bb4b841

  • SHA256

    474fbd180a26139e8013595adedc0ce2bb434677ae667093f86d4a59b11c7045

  • SHA512

    1ea087707ab1f63af26950714d11376bd284984dca4069ab5adf5e35b766b82c6f65447d770ada792a4d1e334e6f5952c0f917e227f3b318986bea819f33e899

  • SSDEEP

    786432:XotrfQO1b8zWttlyhgMglwI4nFbZ2s7i4iOXmditJf0nnPl1x:4trPozWtPyhXJdi4i7EtW91

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 45 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WinIconMakerFreeSetup.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2504
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe
      "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
      2⤵
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe
        "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:872
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="CPPlayer In Service" dir=in action=allow program="C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        PID:2284
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="CPPlayer Out Service" dir=out action=allow program="C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        PID:2488
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2088
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2572
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000059C" "00000000000003B0"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f76b167.rbs

    Filesize

    14KB

    MD5

    e06163886428da7f09f0eed802d5e513

    SHA1

    a52ba9f4da5f0be579eee352ced9b4e48b917ec1

    SHA256

    954e0dd3f5386aa39fb3a828e72e83450f510fdeebcc7770c52cb245c48b9c60

    SHA512

    2155302735080a74540b96911110a07b355dd98db4ecf40c2a5f923583e8d77e45f6ca1d2f8bafc25d08ac985d038f005ebe9e0a5e60b402924ff47b0adc90bc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e1489765ea18799d1b19baff78b1c7b1

    SHA1

    b0ca9b106c7eda8c0e4b92ce85da2a8d2a60ae16

    SHA256

    858b68fb5ad2fc266ba53bdc80f09ce4588d02d534b2a51d0c32afd6ee5a57c7

    SHA512

    c7278697b973b7b14dca9c0f758cef32a758d5e0331cee30ae4c52a75e77050c3d7e8e6bc2801b89312a238220460912fc102f6d9df2a507832d719f0dfa5db8

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPKernel.dll

    Filesize

    3.2MB

    MD5

    00098438ab2cc364ce45d98902fb2b2a

    SHA1

    2a88a24a659f9a7962a4b6602b96d12249d2c790

    SHA256

    bffea8bdb7811b3d52473c07ef2c539dcac00df6bce60c7cafebf8c7beefa52b

    SHA512

    ca430ad171f53bbf3e7d670a9ba2961e3a0777abb640fa64cb722a1eb434f4c86bb71e2b3f6be9f1e3081e13a21fb38fb491a53134e9ac84f71c5fec237abf5b

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe

    Filesize

    11.7MB

    MD5

    2c90a5f4e9f6c1d904f0954911b0e9f3

    SHA1

    bab4656dc9c6df392b0df9328d43a9151bae05ec

    SHA256

    b2c094182699e50eacb69288c3e25146a209e42548baeeb6ca9ff97b5732bf1a

    SHA512

    01c360dc8638b6b227b55101e78a61f193d6b33dd9ae76036cb0c8447ce47d336abb5b317f4be6d9881964a87cbfc8eee450426939012d315626af119d74f85e

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe

    Filesize

    704KB

    MD5

    87486e2a69c91123a6aeec69b3481b90

    SHA1

    53982fc795c00a5bff19c6a223a3a8cf47831406

    SHA256

    c5f4b4cf3eab65416b9b56818db951d2957a34a0bb5882e83ac94d8d3e40995c

    SHA512

    866553350d5abf58f06123bc3ff3347769b7a683a405bb64a04aa9cc5d8e395fd51b65a78efb08fb263f67226a028159e4e972c0f89c463652aee4f5ca041284

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\Fitness.raw

    Filesize

    4.8MB

    MD5

    9563f57718f1ea259bd62b4de0ec1682

    SHA1

    c270f75095a4251d42f7d9947d3369af92c5ed7e

    SHA256

    9e57baeaaf4ea29c340558730646db9e45a9e1fc70426906bbffba32dd455025

    SHA512

    45adc4f64d3053107da03aa8e564f34b3b72a8272952124d12b17b0441b64e8b4790923107cc0f18155d5ffebb0a1bef07f11579921f9778d3d7195cd17278bb

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\License.txt

    Filesize

    3KB

    MD5

    cc5d000307075f7c16eb5cf2c8606c8d

    SHA1

    0169dbed302b8a3d142522e6bcb6040609d07232

    SHA256

    66014baaf612e3aa3084b0c9d7fd95041606f6157236ea10e80865e7cee4cab4

    SHA512

    d8cc2a3ae2bda1ad7d07f5ca4645c60d67bbb719ea8c42696e749604205b43fbb8630060924a486fee7f8f38984e53ab9c9016eabf8a548f9eec177d5d8b268e

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest

    Filesize

    524B

    MD5

    6bb5d2aad0ae1b4a82e7ddf7cf58802a

    SHA1

    70f7482f5f5c89ce09e26d745c532a9415cd5313

    SHA256

    9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582

    SHA512

    3ea373dacfd3816405f6268ac05886a7dc8709752c6d955ef881b482176f0671bcdc900906fc1ebdc22e9d349f6d5a8423d19e9e7c0e6f9f16b334c68137df2b

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\Microsoft.VC90.MFC\Microsoft.VC90.MFC.manifest

    Filesize

    548B

    MD5

    ce3ab3bd3ff80fce88dcb0ea3d48a0c9

    SHA1

    c6ba2c252c6d102911015d0211f6cab48095931c

    SHA256

    f7205c5c0a629d0cc60e30e288e339f08616be67b55757d4a403a2b54e23922b

    SHA512

    211e247ea82458fd68bcc91a6731e9e3630a9d5901f4be4af6099ad15a90caf2826e14846951fdd7d3b199994fd3ac97ca9e325cf0dfeb9474aea9b0d6339dd3

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\Readme.txt

    Filesize

    1KB

    MD5

    969c656269ca1f8437d76200e7620bcd

    SHA1

    80c6b239567b19e358250c8cbda9f100e6b0c28a

    SHA256

    dad36f230fb9f65767b07006df1f73d04ad55863f17c1d0343771ce6c5e2ccfc

    SHA512

    030ba239643d0d2e68283ec428dbf916021b7e3939d2ad7df4ef7101cf581341e50b7900dd6aed32582df8c66539d0d5032106b9e41a95cf2886a25941f15941

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\SDL2.dll

    Filesize

    1.2MB

    MD5

    71e603e402afd0fdba84a781c9934446

    SHA1

    b3a529f7e470e478a77404846d17c1ad2ff017cb

    SHA256

    5ff3186465a347ce8a13991fdb659f77ee21ae5dc9813b9fb2aadafda8a86491

    SHA512

    45aba98b564e4c18bc8fccb71ad4cf1f03770a916c074c1cbf8546f1385dba6e041c67fd870f792a5eec233b8d19bbbe4c4d047015266ac5c060caf037af9c28

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avcodec-55.dll

    Filesize

    6.2MB

    MD5

    a1068bd2b2d26508e745b513d10a48bd

    SHA1

    2c97f15ab052272065994bfb74880815861ace98

    SHA256

    b635fa99267c741b3478c82acd3d3f5acc9bb2d244237323b4f46cc758094275

    SHA512

    6239821d7baa93a58a95e12e66a444ab0b9d1eb9f82041d93ca92bb4a52383ba5e82181d9b28291f4d746c37a20e3d07b31351cc703743e0356958ba7f1cb805

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avformat-55.dll

    Filesize

    2.8MB

    MD5

    839fd32343a2134bbf9edc1d5ccebdde

    SHA1

    ffbb761c55ee5f4b3b82864e686099aa51da6a8b

    SHA256

    c91e4f0b46e80b286df63df3ecb789baa4acb7abe4f6ed9f3ca59083ee115cc2

    SHA512

    20aa82e9bf4ed4d3c5cac4290b9c0b54c39e35ca8b7a6daac65438fa6ca6331f11de25e9925cc1a4e98dc21cd6204eab72856b68cef7fb83f4ec9f59ea410163

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\ax.mem.dll

    Filesize

    3.2MB

    MD5

    bfcb8be288b3b1535c878fac14033351

    SHA1

    9a2af6064e694f7d58f078a9e52e24e0a9448de9

    SHA256

    0c1310f92e0bd207d6c2b1e7d45d527038612849d94a1f97ce0290fb4916a711

    SHA512

    e9c0a86f25118af21f3227c17f8d803f4623221481cf9ab5b8c7c9929681044ae0955df1b4d8c0cc004f71a3c74c56c2fea888e25ae5f9ce0fa0124eead5ffc5

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\corem.dll

    Filesize

    52KB

    MD5

    71f601f8151e34ef31307ab4e46e902d

    SHA1

    1f3d312e2f4755b7f2decca1dedb91bc795288ea

    SHA256

    deac6221d0abe480012e836e5e9dd915828ae55401f0c46fb7ce8049c380c698

    SHA512

    377e6c9540616cad77cf151a31f6461338910d441a12b26175d8bcc2020eba83f621b0df1756123b58fb4358786fcb6a3e187af11123f100a91255218a616aa9

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\corez.dll

    Filesize

    92KB

    MD5

    355f1b97cad97743a8e70dd2803e2f9d

    SHA1

    c7c12bc74483874cbdd39343d149509be355c2d9

    SHA256

    00d4986dfff92cfdd45576da9100d49f374a8dba1a476cfc8dc7cf50f5a6735f

    SHA512

    eb7f8d7b68ab01a95de5aad0023fc4c51c3828138610b488c92ca3ab5c320305f295467972b542c7fe436d08e21ba7926a997702e4383ce5f4cbc674f62479b7

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\nsm.lic

    Filesize

    257B

    MD5

    7067af414215ee4c50bfcd3ea43c84f0

    SHA1

    c331d410672477844a4ca87f43a14e643c863af9

    SHA256

    2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

    SHA512

    17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\pthreadGC2.dll

    Filesize

    68KB

    MD5

    6f346d712c867cf942d6b599adb61081

    SHA1

    24d942dfc2d0c7256c50b80204bb30f0d98b887a

    SHA256

    72e6c8dd77fa7e10a7b05ef6c3e21d3f7e4147301b0bf6e416b2d33d4e19a9c3

    SHA512

    1f95a211d5dd3e58d4e2682f6bf2c5380b230e9907e2882097b77b99520cd2c788f43ad2abcce617dd8ded0043e4ef1c8b6e083c44688b23109868e6cdd2364c

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\pthreadVC2.dll

    Filesize

    44KB

    MD5

    54aeddc619eed2faeee9533d58f778b9

    SHA1

    ca9d723b87e0c688450b34f2a606c957391fbbf4

    SHA256

    ee15e6e3f82c48461eb638c1ea11019ae9e3e303e067e879115c6272139026e7

    SHA512

    7cec39f32804109b3d502027d1ec42a594c1e4a2d93512195c60bd41aad7e32a8b0eb21a0ee859fecb403ee939eebc4608d9d27a4002b8c282de32f696136506

  • C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\templates\bank.wav

    Filesize

    4.0MB

    MD5

    a60d3072a719260abb73a4011ff30642

    SHA1

    cfbf6fac5fdedd793c902b31359c7c94d8e85b52

    SHA256

    523e7e3cc6be48a5f8ac28517a68557ce7d051d047c84d868a00e21ca600c1c8

    SHA512

    425d425e78829b98476fe72b82204423aa52b64b7a0aca92550b371291e557118b3445c28d5494980539e894e1126380dd837eebcaaedfffddd36aaddaf717b9

  • C:\Users\Admin\AppData\Local\Temp\Cab52E3.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar53A1.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Windows\Installer\f76b165.msi

    Filesize

    12.7MB

    MD5

    cfa8953e5635ed863a8b555effa4d65a

    SHA1

    5b93104612633a23e0ce09bf8ac9136a80b5c22d

    SHA256

    2ba819611c3bb280588c0cd15a10557f6ca708389e33434f888c42f1b687809c

    SHA512

    4ea5fd65264606d998b8cca0024dc58d8bb22537bb8126f0a71a2017d20da5e3a17a97f6606657ad94d6be276c894e3b9505b8692352ad01f322a3e2a210e67c

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPKernel.dll

    Filesize

    3.1MB

    MD5

    a57f086032de4aab2a2c69993218f644

    SHA1

    93a85057c822bb3cc19ead5c80bf738fdc2080cb

    SHA256

    eacee14294a5917de033f0a5112a87e9b1345e81f727fa8ba72538b7274f83bc

    SHA512

    54aa2a129241818fd1eb369b99ba255f0e41742dbc6730755a184e831e36d7eaeeea6c492967336833b87c40099e7325ef93369de1bfbcb3868d82e936edf7ab

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPKernel.dll

    Filesize

    1.4MB

    MD5

    bda2f535c4a6003138ffeb1b52ab601c

    SHA1

    4ea2c6f27e376975abaef0af58b43da0591248b2

    SHA256

    2f63e3897860eb57b04cc63ff7a0c89d2896db9e28cb8d01f76497c5974734e4

    SHA512

    97690400203e43db999ddd006a707d75454f9fd5e98958a5c10404bd3d301aa545d0c4223c7dcdfb47bf4b0ee58eece1dfefe9a67d4a830dd2e9fa778281c239

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\GImageView.dll

    Filesize

    543KB

    MD5

    3e837b82501aa2f90cc774890656d02b

    SHA1

    a62e967c006f6bf77fbe489b01ea30993e55fe5d

    SHA256

    c85ca44b1ff1ad0af0ca3daf5f2302498846f3fdc2f48c6c7262f08280c6f5fc

    SHA512

    a4a55fc0ef6ae87c5c73489993e2dc6e0e36f783de79dd7894966df3ebe13ae8341a5fe15dd0e26c72865b4a936247f34b08342769edd0a94ba2b90164b0d27d

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\ImageZoom.dll

    Filesize

    283KB

    MD5

    b01a100820095dc05fdaa0d1c3b5ca14

    SHA1

    70af3c7337248cd4dc8c65d5ba1d18d3fba926b0

    SHA256

    ee7205fa96539f9d9e62f5a403a06004c6c7235b7caee368dcb0db3a765c21ad

    SHA512

    883891959202294edceb3a6360f450182d59e097bb4b0f9fe18b5316c6591aee04d0cd5bf01c1b23d1727b59eeee7c148e56eea2a7436902170993318386933a

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\Player.dll

    Filesize

    84KB

    MD5

    08c68e4121ceeac71745015bf17126cc

    SHA1

    103792ab800377092aabefbf4b94d0a882afdc3c

    SHA256

    e18254dd1e074eb57971d91ab62502611dee96aba1203f2b21810d8d0e761b3a

    SHA512

    d66c9db8a876260f4b86604dd71a52b72dd91d79b7d1da711c45577b0dddbda8e46802f6184c2cd63a202f58cdb04d51da865968b7b203b8c5c2a76a8cfb5bce

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\SharpWnd.dll

    Filesize

    281KB

    MD5

    a555f73041756d249093a1d6a6f28448

    SHA1

    bc75a0047342fb157047c19193c02a8149187656

    SHA256

    2ad9292c875cb8b71a437b0da803d07867d2ed8deae4568f2be1f623755d5b60

    SHA512

    cb2166fcf3a73e60fef9b90102f6aba3a913cc0e84ca0a5c4cd43c52d21ad1696040215b302d2a46d61599024679cb2477fdaffedcc88396ae9c7ff1c649c84d

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avcodec-55.dll

    Filesize

    3.8MB

    MD5

    25d3ba579cf9097b5d0095b53670a972

    SHA1

    7d10a21e8e2587dcf0d231eb8e146da41c1e7ea7

    SHA256

    a54c662fa25d83459d617d9a82afd41b4a9a435e9920b0158c2431ad0e43a82f

    SHA512

    ed74723d678b4735dca5706384e5944c0935bf2471b0bf7656abe36c569d0b000d32dd22a0d6b0dd6d0f47f1f3f6eda544d2e3a33fcfd55d774e42b3424c4b52

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avcodec-55.dll

    Filesize

    2.7MB

    MD5

    5e173ed2bec3442f68b897e836c4ce8e

    SHA1

    90af9b5d5a223c60a7695d9b3c4b9075174cd33c

    SHA256

    f5d89b8b28f17817152c1a5777c2f98c48e6ff5db2260f695677c7a4516dd40f

    SHA512

    e0dbe99daa0be6a88e12667a30491dedb5a7e7b73e2cf12a303e9fffaddd4c7594d523f84764f9fddc3f2bcc704c4bf2072bac551fbe329ed18bcc340e177e80

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avfilter-4.dll

    Filesize

    1.5MB

    MD5

    6b007bedabaa20fb6d445bc62f1091d3

    SHA1

    d3905661051c4415ac92bd5492100a5f2df6f659

    SHA256

    bfc20232c4ecf4aece403d005624c82a64a2d54d5d84720341dc6d45b3522ba5

    SHA512

    7b0cb0959434437f31ab3e6df721be412de003979f19a66d3855ee4c87fe8a79d5cc4b42e6cf453be9289575854d2176d2bfff88a9308f5ab9f0895c0a899cfa

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avformat-55.dll

    Filesize

    2.8MB

    MD5

    838c607a755449a885f6be7069c8efed

    SHA1

    62957b0d6fc212b7cc9b67a4d0ce354e1fc36561

    SHA256

    9ba2e6519c665f4c5f28630be9fce63fb513424cf72640dba4b4f18f45a4faac

    SHA512

    ee0a48c5a58ff08e8402120bf2428951af9db754494a01137e76292d91f86c87f445b9274c1a99c5272bea8d73d4628e52aaf54d7e5382662fc785c1377889a2

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avformat-55.dll

    Filesize

    2.0MB

    MD5

    76db03c6f7d3a73df1b21b53aa23eba3

    SHA1

    0718150962eb3792adfd0e59792c165625452057

    SHA256

    eca3444c6d0727139fb3ef44f07a94d460e7252905c88b58bab62cd1b2aa0873

    SHA512

    f7232862ac12b5312a24902e314bc58e028d42e923117bb17a2789213a01b00d98a0cc3cc12b4029288e84375a4e44ea4dc2722ac2660d0af73a29f8d4310568

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\avutil-52.dll

    Filesize

    327KB

    MD5

    f832d24b70a2f4583c57a5fa9b6f0d68

    SHA1

    092ce5cb6bfe6eadde62c4cfb911eab2474196f8

    SHA256

    67a0f7d47ceff1407b9c4851032346a9b81a75fee6569274f15d092610f04cdc

    SHA512

    41048c023871b485718ae219f0d79bbe01a0704f8d2107d68ead2262e3f66737718afbb636b02109d1a2b427aab04dd394ef82d8014298fa3fdee0c61bfab185

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\awebform.resources.dll

    Filesize

    481KB

    MD5

    0e77bfad6b92733c3296a04719375901

    SHA1

    982674869e2e76ee10937e946aad828ebea818ff

    SHA256

    87810c5d06310b6e61398314300646a0582fad7a99dba8368a06c886a59a38af

    SHA512

    391f6558d5b3241b1e1490763c80633b288e0b8a770815116530b352fb81ab7d18784d9103669c903e6b5b501cb8a062517dc599609bb269b86bf16cb8e8e7bf

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\ax.mem.dll

    Filesize

    2.2MB

    MD5

    d46028df00ce4a9e48eab511fedfb665

    SHA1

    0602fb4a4df79db1965de37a9d647f5047737f02

    SHA256

    52f0886e8cb2ddf6e8950264e6bc0a8978db1e817e6f60bccd59c136901fd709

    SHA512

    a8af5d0ce8ca0d3a891fdcf6a15d8e991371f4a1801c5dda5dbf252520fff5ce4f533c3335725b453ed3ad9f20fe69367bb9aa449b6014e4df2c11e4b2cb5e2e

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\htctl32.dll

    Filesize

    320KB

    MD5

    2d3b207c8a48148296156e5725426c7f

    SHA1

    ad464eb7cf5c19c8a443ab5b590440b32dbc618f

    SHA256

    edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

    SHA512

    55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\pcicapi.dll

    Filesize

    8KB

    MD5

    a58b534a65e9727fd5ca618316a8eca1

    SHA1

    4b1b4837753727723cdac308a043358484298ed5

    SHA256

    733999c43a9b46ebdb1e22291ca7407c9122638c2b395cd5e86db2c7f96e280d

    SHA512

    0c23dae4e62627d6b8c34dfc9ae699760e4c273a62614902ec51c5a124c28ea84f9f3c3a51f6694d70c05588fa323f75ff73db0c10768ac0a4d51476712c3268

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\pcichek.dll

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\pcicl32.dll

    Filesize

    384KB

    MD5

    c634eb1e856f3b5f14e09891a0301038

    SHA1

    36067c048d0b17b198b99c88d09c68b40947d122

    SHA256

    a0150cdf67140bfa6e4e4e768f16c983a1e07f9eb4a0455e572698c4cd1cd571

    SHA512

    2871dce6d24b10d443a53df919a662da2f0ec15c4c1e16b17ef4f58584489c838b3b579028a6aee4c896b2981b7e08346556bdb490cbbb42874d506bf6172301

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\pnras12i.dll

    Filesize

    1.7MB

    MD5

    3f7663206ef2069d0cc16cc1e813d7aa

    SHA1

    2ef1cc5457cb36b4e50de36a9a86b8c7ddf02092

    SHA256

    7896a7429e431a74eb43be3a235dfd1d6625e8634f6ad247c2eb13e8d3d298ff

    SHA512

    2e9f33bb0f776168e600d90a1fea188bc30d587e140b0cb2479384b347aa034152f242ff61e26f8e3fccaf473a2e940641e3db16570dfb1c15b5bc80f8593e34

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\postproc-52.dll

    Filesize

    185KB

    MD5

    f75d1b175e1687ee0a9b9e4a7abd123b

    SHA1

    026f4db79aa8db651964acf17233302d1809de1e

    SHA256

    72180a408b13b7d98c0bc2395b886a5c3aa0b2dea39ef081e193f60ef373365f

    SHA512

    200aec20c95b1ec2e7d1bb33ed89d846a128847b82c9d09aa2788b258967e750718414f05bdec0cf2e4f9c7af697404e19caccac354a1a62db52e76c6a45886b

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\swresample-0.dll

    Filesize

    101KB

    MD5

    77bceb240f65c91d26299a334a0cf8e1

    SHA1

    de9d588a25252d9660fe0247508eadfa6f8a7834

    SHA256

    d179c01c646d821cf745ae5e66ffc7ed394a61a595ecc2bccf27dc144ba91a2c

    SHA512

    b380b592c39fd22302fc4a36aa6f773a79253230f0dd73ad129500654dbdf24c5a0b0ae3b2a4ffd762da4f9705a0c8e48ad4372d85cdb6271c5d3f315c82a281

  • \Users\Admin\AppData\Local\Programs\WinIcon Maker Free\swscale-2.dll

    Filesize

    490KB

    MD5

    2985c39796fb4a5f4357a1a7a134ad45

    SHA1

    305dc537a03e0137a529dc30bfd2fc6c185402a3

    SHA256

    4f17b1ceea162390f64f54a3d13de4bb9e553da1e51ae7061545b7843ddad9ca

    SHA512

    4764dbf01defe417d587adbee16901bf374e0548d4a00f4f977f058dbe00c54712fd25162e1bf1986b55521cc2f005e7ed8e78db15e6cabfddc6b6924ec423b8

  • memory/872-289-0x0000000073F90000-0x000000007401B000-memory.dmp

    Filesize

    556KB

  • memory/872-278-0x0000000005FF0000-0x000000000600A000-memory.dmp

    Filesize

    104KB

  • memory/872-286-0x00000000743F0000-0x0000000074413000-memory.dmp

    Filesize

    140KB

  • memory/872-285-0x0000000074420000-0x000000007448A000-memory.dmp

    Filesize

    424KB

  • memory/872-284-0x00000000730C0000-0x0000000073F68000-memory.dmp

    Filesize

    14.7MB

  • memory/872-282-0x0000000074A50000-0x0000000074D5E000-memory.dmp

    Filesize

    3.1MB

  • memory/872-281-0x0000000000400000-0x0000000001554000-memory.dmp

    Filesize

    17.3MB

  • memory/872-288-0x0000000074220000-0x0000000074257000-memory.dmp

    Filesize

    220KB

  • memory/872-287-0x0000000074260000-0x00000000743EE000-memory.dmp

    Filesize

    1.6MB

  • memory/872-299-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/872-300-0x0000000072930000-0x0000000072AEE000-memory.dmp

    Filesize

    1.7MB

  • memory/872-317-0x00000000074D0000-0x000000000755B000-memory.dmp

    Filesize

    556KB

  • memory/872-319-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

    Filesize

    4KB

  • memory/872-328-0x0000000072930000-0x0000000072AEE000-memory.dmp

    Filesize

    1.7MB

  • memory/1240-178-0x0000000000400000-0x0000000001554000-memory.dmp

    Filesize

    17.3MB

  • memory/1240-155-0x0000000074260000-0x00000000743EE000-memory.dmp

    Filesize

    1.6MB

  • memory/1240-223-0x00000000064A0000-0x00000000064BB000-memory.dmp

    Filesize

    108KB

  • memory/1240-238-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-240-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-209-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-242-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-138-0x0000000005D50000-0x0000000005D60000-memory.dmp

    Filesize

    64KB

  • memory/1240-141-0x0000000005D60000-0x0000000005D79000-memory.dmp

    Filesize

    100KB

  • memory/1240-197-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-112-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1240-186-0x0000000073F90000-0x000000007401B000-memory.dmp

    Filesize

    556KB

  • memory/1240-185-0x0000000074220000-0x0000000074257000-memory.dmp

    Filesize

    220KB

  • memory/1240-183-0x00000000743F0000-0x0000000074413000-memory.dmp

    Filesize

    140KB

  • memory/1240-182-0x0000000074420000-0x000000007448A000-memory.dmp

    Filesize

    424KB

  • memory/1240-212-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1240-175-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-174-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-173-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-135-0x0000000005D40000-0x0000000005D4B000-memory.dmp

    Filesize

    44KB

  • memory/1240-146-0x0000000005EE0000-0x0000000005EFA000-memory.dmp

    Filesize

    104KB

  • memory/1240-153-0x00000000730C0000-0x0000000073F68000-memory.dmp

    Filesize

    14.7MB

  • memory/1240-162-0x0000000006BC0000-0x0000000006D19000-memory.dmp

    Filesize

    1.3MB

  • memory/1240-161-0x0000000072930000-0x0000000072AEE000-memory.dmp

    Filesize

    1.7MB

  • memory/1240-154-0x0000000074A50000-0x0000000074D5E000-memory.dmp

    Filesize

    3.1MB

  • memory/1240-472-0x0000000072930000-0x0000000072AEE000-memory.dmp

    Filesize

    1.7MB

  • memory/2088-446-0x0000000002530000-0x0000000002570000-memory.dmp

    Filesize

    256KB

  • memory/2088-447-0x00000000717A0000-0x0000000071D4B000-memory.dmp

    Filesize

    5.7MB

  • memory/2088-448-0x0000000002530000-0x0000000002570000-memory.dmp

    Filesize

    256KB

  • memory/2088-449-0x00000000717A0000-0x0000000071D4B000-memory.dmp

    Filesize

    5.7MB

  • memory/2088-445-0x00000000717A0000-0x0000000071D4B000-memory.dmp

    Filesize

    5.7MB