Overview

overview

10

Static

static

3

689b81de6f...e9.exe

windows7-x64

10

689b81de6f...e9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 00:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe

  • Size

    2.0MB

  • MD5

    6036bd73dbef78a0bb21bace81ca703f

  • SHA1

    59cb4799cafe00aba015c8a8eee53d3826e616d1

  • SHA256

    689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9

  • SHA512

    be5c11d73fd0c8edf0a1d89c79fd2847511efdc401fe057624c0de67a01d1047b2c76f636733d71c46557c4b6d855ec37694fccf368ee8057901662b4a38adfb

  • SSDEEP

    49152:ZlqwRsD6EZq9NBN8EFWI6xuPFT4u6Dr1LJPMxi:ZlqwRsOEiTVFM2T4FDt

Score
10/10
salitybackdoordiscoveryevasionexecutiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:784
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:792
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:316
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2712
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2756
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2988
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3408
                  • C:\Users\Admin\AppData\Local\Temp\689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
                    "C:\Users\Admin\AppData\Local\Temp\689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Maps connected drives based on registry
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:2748
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -WindowStyle hidden -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WanNengSoftManager\'
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2156
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        4⤵
                          PID:548
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                    1⤵
                      PID:3628
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      1⤵
                        PID:3812
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3908
                        • C:\Windows\System32\RuntimeBroker.exe
                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                          1⤵
                            PID:3976
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4064
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:3940
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:388
                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                  1⤵
                                    PID:3404
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                    1⤵
                                      PID:2864

                                    Network

                                    MITRE ATT&CK Matrix ATT&CK v13

                                    Initial Access

                                    Replication Through Removable Media

                                    1
                                    T1091

                                    Execution

                                    Command and Scripting Interpreter

                                    1
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Persistence

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Privilege Escalation

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Defense Evasion

                                    Modify Registry

                                    5
                                    T1112

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Impair Defenses

                                    3
                                    T1562

                                    Disable or Modify Tools

                                    3
                                    T1562.001

                                    Credential Access

                                    Discovery

                                    Query Registry

                                    3
                                    T1012

                                    System Information Discovery

                                    3
                                    T1082

                                    Peripheral Device Discovery

                                    2
                                    T1120

                                    Lateral Movement

                                    Replication Through Removable Media

                                    1
                                    T1091

                                    Collection

                                    Exfiltration

                                    Command and Control

                                    Impact

                                    Resource Development

                                    Reconnaissance

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Program Files (x86)\Common Files\WanNengSoftManager\WanNengSoftManager.ini
                                      Filesize

                                      194B

                                      MD5

                                      8169df157e5aaa7814e19e4a312a8e6e

                                      SHA1

                                      9250c428993ae78da6f578af6ee968d632f14b32

                                      SHA256

                                      d6da1cdd18fb7b2ee0ea3674e24107b944619eb9e19a8c9b5d9316b3aa197812

                                      SHA512

                                      6d18b5048bd4f1d27fe6485af088bafea5bfdbe56b7cd68b5f8982e0b874601fe304b8f0f68c91a2e120c48c1267409e5bbc24a1020c7bf223fd1c6dce0f52f1

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\Icon\main.ico
                                      Filesize

                                      197KB

                                      MD5

                                      e1bd484966a645a7b456a67ed4a2677c

                                      SHA1

                                      528d589847d60b41e5faa40c6ee5e1d361df0c55

                                      SHA256

                                      87868f0c311ba96d5f8069b070a8309d2a54813535ae99d852cff44a23f626f6

                                      SHA512

                                      8f76bc32ab178b056a7c01608e8a0596aa1784f290837a8f0b844f097a4170d3cf9ed400f9c27de1ccdc645e012a66f086069a922ed2de9bd28cda584cf57dbc

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WanNengSoftManager.ini
                                      Filesize

                                      213B

                                      MD5

                                      78c996d1c37af3ef09b0c61a08cc2972

                                      SHA1

                                      b4e98c080a418ddf736758648a11c6f6c44ac0eb

                                      SHA256

                                      7bf8e8c3d18ee13e02bc5a8917717d0b91d1c1f4a52cfbb944b618f15e3b4f10

                                      SHA512

                                      352450c33ed4796cb7649dc60e26b6a647a8f2dbed52b99600999986e37c825f113747f36ae751ca6be2adeaff948ab6f0c9dc9c04cade1f7bfa438496614635

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnAcelein.dll
                                      Filesize

                                      219KB

                                      MD5

                                      8e2c5d3c053319ed8d63483d256449bc

                                      SHA1

                                      961dfe8155befb9947f58c84df4c4fb32623c911

                                      SHA256

                                      a1cdb58efe50c9824776219541ec36fc9532f0dc68e6f95321bdf4c538387637

                                      SHA512

                                      18b2e3b861db93b1ea1ac090791296aa25d1d2a6584b2624b982f044fb0142c4c413e134cc244d3b3273f90150ee7a22fda1a92bdb5f1f34bf95281579a8f042

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnAcelein64.dll
                                      Filesize

                                      264KB

                                      MD5

                                      1b900520d1c09713f2906f4c5b9d8615

                                      SHA1

                                      38f9967da362505caa4b8a02847288662752447d

                                      SHA256

                                      d8dd77d93a35ffe5d55f16497ccb3ab9cd0c4214d9b6d82ce48c9c2ab2cbb697

                                      SHA512

                                      ccadfd98bf7b4127ba2feb0c040b4af27c2749cc4d063ba6a3f96b10e24fdf237f98f3a9f923f3187461237bd402e7e6bd086fb1bff8847d0e49981f1f639f12

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnCosemism.dll
                                      Filesize

                                      426KB

                                      MD5

                                      7b77180aa387e2480811c118a30dd05e

                                      SHA1

                                      159d07f6a313f130f046af392aaad50bab80eeb6

                                      SHA256

                                      355943ed9b2bbb59ab4298b83d3a98290a42fcee87a1cd46e7c777161a09c106

                                      SHA512

                                      90549e017e331761632f8b5fddecfba928401fce2a5afef5aee665f980d529666ffb36eb5bd5e9cec78b051b4d3bbfaa35f0b72b85cc706176b4a1b5422b6afb

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnCosemism64.dll
                                      Filesize

                                      475KB

                                      MD5

                                      d468405798b4794714b55d7acb5c337f

                                      SHA1

                                      6131ea842c69cb2cf0b8f1b1be1558168e023fb1

                                      SHA256

                                      550994432a9ebce0b266a2d7892194e89d5aab4b2b6d7dae6b102fcdcb803c84

                                      SHA512

                                      ca64de673d4a2f4fd63ed7347f7d9e0743c5ee5583563423429f1d19952f43cb91ee61e8b85f08731325700e92836d5d4026d79929b0e1811c25a6aa06e8ee1c

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnFSUpd.exe
                                      Filesize

                                      4.5MB

                                      MD5

                                      30d04c3ac9a0a938f0742c504ad7b256

                                      SHA1

                                      46966a65cb4c4e74cd949bc2615776701564b67b

                                      SHA256

                                      5b8a6f3d529c085601d971ef44c4d6bf4bc8b05cd765a6986cb2968473374103

                                      SHA512

                                      17ec81395837c365f61e43fd162ab4215dd1c2c035348205ce48d568d28894aa3b078c30040964cd1ca580e2df1aa92c5a827ccc247e5fdc880c5d8ee84a3765

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnFerous.dll
                                      Filesize

                                      250KB

                                      MD5

                                      6b5253223698a88ea8393c0bb324aae8

                                      SHA1

                                      df156ead59e070d232aa6488c8ce1d857617aa15

                                      SHA256

                                      3ef4d209c611807a27b2e01298ef2651a25b01f389ef59c60997a019bf14c575

                                      SHA512

                                      595aa7805198984cbcceffc71ad45d1fb4b6651987030a78dc703f0f0d575ddb7606c69fc5aa1e563a8d679f0b56b32c436b1a299f1f5e173d23d35e8ecc0a18

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnFerous64.dll
                                      Filesize

                                      303KB

                                      MD5

                                      acd59a749f0e56a163bddc1f454f69b2

                                      SHA1

                                      08f05945d666c6e19e0e8eaf0ab14d26eaa424fd

                                      SHA256

                                      c7fce5752658147e008cbfa8b39dfdb51615ff2c0e73866483bf829c375b8ce5

                                      SHA512

                                      627b027abdd502738958bbf62fdf737cf8a0930e4ac5c54e4ef5d74e6493d196b69a6b3911518d115fbcf039868e16e88ba7b1d6c01d8a993c945e99bb6ab234

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnKernel.dll
                                      Filesize

                                      2.7MB

                                      MD5

                                      de11310bfdd3f2d2bf49201dd1914699

                                      SHA1

                                      4625d4d3bf4ece6599fbb1abd7357438c6d76ae5

                                      SHA256

                                      b485275db6102a1c1fa41b8b260d35bbdb7600d6d1c32099c54b3b6750556699

                                      SHA512

                                      ee91e6d5953207ed69b011ed06ed1fc95fcf86d392009802a6f4d080fbe306123c30cfc7a5e64839a51c5cd018a4e147dc3b962088a3a30ba2f0880ba59b437c

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnMfgohsht.exe
                                      Filesize

                                      2.3MB

                                      MD5

                                      c9f30057628368706bcdc4cc1da5fc27

                                      SHA1

                                      8447d2ec544b4288c0eb4f0c913cdda8e475fc31

                                      SHA256

                                      64b9caf38355a451b34e8a7d012fb7e60eb4b76fd98fe82c096e0e34268d7d51

                                      SHA512

                                      c9135fca1f79531a5ff16c6a641dd110952f7b28958a245fc75a7ff2a8c8c271b4c2c95ba2f288909ffbfefca70c7c12f0a8ae0d763c69d5a93bc50b5ca35eb0

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnPatemar.exe
                                      Filesize

                                      2.4MB

                                      MD5

                                      1a8d6b945faa865f5c189bba5df42844

                                      SHA1

                                      10b7c7628a40a882de155722c2d7942734fe4901

                                      SHA256

                                      de8eac7f944a6c99a894b74fa4327f765cb381d4745602f3acbbcf1c3a7ff5ab

                                      SHA512

                                      579993711e6eba9a54f72a04f13209255e50656277dac9e0309ca77afec3acbe12ad3ccb4337afde70e2d5db7453a0ab557585e45da4699ebe03bf1d635777b6

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnQdX.tsc
                                      Filesize

                                      42KB

                                      MD5

                                      2c4fdced429b803305607ed171dff5bb

                                      SHA1

                                      449000b216cbb472bc18b122c4fa516adb299a19

                                      SHA256

                                      ce792fbac3c45906e948319f9e06d2854ee6ab580220f66c562cd75358b1a894

                                      SHA512

                                      f499a42044774222c3221fde90b0c33617ff329b2d858e242a31f6f365c8b36a7628dca24c41d92cf2adfc36813ba5cb309f48c5ad616377b348124837784465

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnSeve3.fes
                                      Filesize

                                      39KB

                                      MD5

                                      e220627df0f7912ca9abf9003e3536ac

                                      SHA1

                                      5dfade04a3a08d68f2937b89792c06db299eaa7e

                                      SHA256

                                      844a4a6d945fbce245cde1f3edb7ed3c93b36b472a3a00c347d210c4e459f921

                                      SHA512

                                      a69326f0ba5450f859308a9a1d44d7f021ac7209674274ddb8437ab885567f39cc4571f38b739ea731510c7755e3afd4923e28d20cbfdc162fd41c1920592c9e

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnSeve6.tff
                                      Filesize

                                      45KB

                                      MD5

                                      17758d686860dddfa39a0515829a23c6

                                      SHA1

                                      f9efe7b295d31b3e8c359f8e3fe2e893fd0ebfce

                                      SHA256

                                      241610908c9f40566296f34066195c0606b577595b84cfb282337b58e23d07e1

                                      SHA512

                                      664f0a90c40d7789bef2e4866e96145d32d5dfafe329b6c62c54fe9bf367317ba5b69962454d62e4c94b9b9530df3d64d702bd54bac24ab380243ba6b6426a4b

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnSoftManager.exe
                                      Filesize

                                      7.1MB

                                      MD5

                                      14f78023f4a504ace87f681028eae4be

                                      SHA1

                                      8eb62dd9894adcd90bb080b7cb33bd9affc3c05f

                                      SHA256

                                      5a2102ff5ad0f9ed8a1c10119e90f9d2bc432595df4b7fe85b089bd14527fc81

                                      SHA512

                                      24f6e3b3116c8dfd297cc766bc8e54fa6f40ce82e2d6910a195b684e9055c5922b3206a80e5f4dc7a0144e678309e21ff46b6cdc26b56eb313f514cbe52ec998

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnSvccen.exe
                                      Filesize

                                      2.5MB

                                      MD5

                                      db101c5d26f7d92064c6d3faaba20175

                                      SHA1

                                      683afd3c7512886d0f4c5987deefafb5f396b573

                                      SHA256

                                      f5cd65baabbcc556b0beae9e6e65b71b5fd19b44f7776cfaef9b6bd09bb156f5

                                      SHA512

                                      07f56957258ed8bee16577998bbf97f7d8ff799cacf865fdb47029dc008af6df632ac55e860b0f859b7525d41478f06885bda89185b67f73c79eccc30ec83503

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnSvceous.exe
                                      Filesize

                                      2.2MB

                                      MD5

                                      7333a527dbedff3be88294d07dd9e4a1

                                      SHA1

                                      6aeb844db20b0f440734bf53283e57619834db7a

                                      SHA256

                                      1ee4e893e72d4475d49ac22d3290a8a7e2fb2a14cbc22eb6edd2d382b2ce20e3

                                      SHA512

                                      12f60e7caecff70bf3daaf36dab9d1b9bb0b548624da62a387fda2ce57927961d1fcd0631be31b4247f4190d056f5e6d60bba8d50597714285e1632e86294580

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnSvdarme.dll
                                      Filesize

                                      2.2MB

                                      MD5

                                      2ea1bb79182e0832833828cf04288fbb

                                      SHA1

                                      3613dfa6fd8a15ad931db368fd4928d4836143e0

                                      SHA256

                                      b3c7a548073644da7d501e663cad09feef8ff30a2b232e58e2c50b6c8ca9d801

                                      SHA512

                                      55f443552a1cd1762dd5eabb35db459cc51d2bfadfa07a3a7fcaca99d437c1d077b84f660a08805af64c69bef0d0561c579c6d15e01b44b02218f8a932b813e5

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnTen3.fes
                                      Filesize

                                      50KB

                                      MD5

                                      6a99dce0aa4798a921799231fb98d0b7

                                      SHA1

                                      f986740992007f92ddb6db452a0d4ee7a3de3b3c

                                      SHA256

                                      64cad370d5373313a05e71efc4d719b17b4801576356e693b47e4515fb64641a

                                      SHA512

                                      31b684a3e72d36f6077f792257c4fd33ba79eb7a02e153b0898bfcaa64c8dac931b7ee7b371784b88b47a014fd744df2743388773444b82d25d65932b64d6eee

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnTen6.tff
                                      Filesize

                                      55KB

                                      MD5

                                      39b59f56c7cdcc204ea2e2f44f0f11ba

                                      SHA1

                                      5a6b0fa4849b38fd75edb0b66c1e8fcd4f70b17a

                                      SHA256

                                      5eccd83aa0e78f466a14fa4862d273eaa1999fed6cef6f451c6d7b829ea71388

                                      SHA512

                                      88b8ccfc1989cb4eb365562240a96117e2cb90601f053e803bee1c10defd17323a10e946797bd721bae6b4d8255a03f06a04266010ae838657e37c06525b85b5

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnUmanlike.exe
                                      Filesize

                                      2.9MB

                                      MD5

                                      c962318702eac982494f55762d5358e5

                                      SHA1

                                      dfee67eec82c97614261ad826020e95b9183fa45

                                      SHA256

                                      bffb5df552ff14235d9c09b47e15b9755beda1f1e2957ef65475ddb6f603a1ac

                                      SHA512

                                      9f8a7082654fe3bec0eb92c9955776982e12dd123f67baf9457263219a4ccf7bd8b28438125690bdf07abc7132d1cd57f85a3ce6124112b9995081b358b2c4c1

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\WnUninst.exe
                                      Filesize

                                      4.3MB

                                      MD5

                                      4c87ae53f9687a128563aa0bdd931e3a

                                      SHA1

                                      f08b3e12e5e3492a8b0f14e2230c0da4099f9a88

                                      SHA256

                                      dd62ffa2383984ce8c009cb55cb6818afe9b343d6c8dc73f6f78210aa4d9e6f5

                                      SHA512

                                      e26bf9065a0d976fe3533b35c4e3193e98bec8cf46855bdfd58ce5b86106a1a8b4655c41d40dd407f2702dbaaa5d0b9c0ab7e73010fe2dd957ab5f2a010bc832

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\Wnfghshmndf.exe
                                      Filesize

                                      2.4MB

                                      MD5

                                      3003134f2f47ee73ea52bd7690854274

                                      SHA1

                                      5ef19e5392cb71a98186ca2fa3fafafc1a8fae12

                                      SHA256

                                      6c51048d92d86081bd5323e2ce25734a2b5d0991585dcab95dd051b87204334b

                                      SHA512

                                      d4ba9175b4a0e2a7b8ba377d731a0c76dadaaad254630bd62781fbf72339c8228c501e9ddad0f456b1de9beac40910f1f2a964d78064e457e6f1e88cf7864965

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\Wnhghshtol.exe
                                      Filesize

                                      2.4MB

                                      MD5

                                      a177078edd4918268d7c2f9b0ba086a0

                                      SHA1

                                      c8229ded91155bfe0de7ed49fa6df988129f7064

                                      SHA256

                                      c7459aeab6058396ccffb3e0b7cc45fbc39b90b86ec3c50accc4a5e10ff52edf

                                      SHA512

                                      e6f9680b897266453706cd236324551ed69ef9aa5061a5c1c5ad45acce8fb635d09174c760ce998403261e774d3bff207d73d2a26e97b78d9c120cf735f069b3

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\Wnhghshtp.exe
                                      Filesize

                                      2.4MB

                                      MD5

                                      db553556e221b52c88a80b8005704737

                                      SHA1

                                      a76664b31a66d6f117a50224010616a335fd8e21

                                      SHA256

                                      98813ebe375289f2f514fa2064c5817f9bea0e89a91f16455918b46e42d7ed43

                                      SHA512

                                      4647a12b9ca93a4fd0cab4df518e5b0a66a5c5984ade09db335905cdd9da89074572ad3011c9f4a14823a08653183ba6ab4cf799ff1dd10fc13f3346f9d7d71d

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\wke.dll
                                      Filesize

                                      11.2MB

                                      MD5

                                      cb099b500ceb0e2c123ceef14bd7183e

                                      SHA1

                                      7c7538b9bade66b4561bc14183b31deec50d0021

                                      SHA256

                                      bb68484b71147c91d664bb23de320fdfdec1cdb42d64a3dd9ca74010e8d47592

                                      SHA512

                                      f74f5dde21c733cbaa5e13434d2a82db6baa45a22bb1c466b4a064f77af625e0672dfca81dada6c8f0cc3c2f8df995be583dce15c236782b01c90d1be7073705

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\wndr.cat
                                      Filesize

                                      12KB

                                      MD5

                                      5d61437ee311a8aedc5af1d92b520a23

                                      SHA1

                                      4411b26ed712a63a6dd15d909e7c6c6d29d49400

                                      SHA256

                                      7f784e9ffd1ea2e8b19ed583db8d395d643186a7f930234ee69fd71dcc208f3b

                                      SHA512

                                      d0b1c5961e067693729546502255e91721e4a97e5413e76e9f19d73e774ff3f55ad89713f3b643c88e096958103536d600ef768e3eeca2d8a2b858b3953a8ff8

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\AllIcon\normal.ico
                                      Filesize

                                      194KB

                                      MD5

                                      9fd1679643ee825d340f58471a869fde

                                      SHA1

                                      2ac5b4f383d5fa10ad3fbbb30c6fe0654c8b8039

                                      SHA256

                                      3c75eaa4dc66bc1cab8324f14a2f54a62a44ee050a7a6e925592921ebb48f8f5

                                      SHA512

                                      d1a4cb08415493f7b10a6edb45f2fe30c7e4d8cb77fe29143887edaac5bf992146df61c412016c687ef4dd9e1b181c7328c0811314e3ebec7f19798cb5e75a79

                                      Download Submit
                                    • C:\Program Files (x86)\WanNengSoftManager\wngj\Icon\main.ico
                                      Filesize

                                      422KB

                                      MD5

                                      e7065376abcdb34c3147162172c29ea7

                                      SHA1

                                      4608d48bb5476823116db94a0890f52f559eca39

                                      SHA256

                                      ecb25a772f8e3db7027850aa646384d37190d9233dec18a9151201b0acb20c69

                                      SHA512

                                      7119480da0cc16a7609a611c984c888589c722edc9d5d213a488b11426020a92402ea06be0a375bb2912661d73caa06d4a52243b8233fdec64af1f056a8b44c2

                                      Download Submit
                                    • C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
                                      Filesize

                                      89B

                                      MD5

                                      222551cb2e469a87c1972e5e66b2080f

                                      SHA1

                                      b6522a05128622197dd3bcef677dd2ee2d131c93

                                      SHA256

                                      0250fb5859894a3e013c3fe28e16b85fa54e88b0a6a7e9ba99f9be3cbbaaa9d4

                                      SHA512

                                      6e3795f3aa9a37437b382f0f465a5751e57377d922bc837ab229d2475862bb26a5358ca8b48edc079536fceca8fcc2759947bb0310ff2a657ce268c34efd1a63

                                      Download Submit
                                    • C:\Users\Admin\AppData\LocalLow\WanNengSoftManager\SoftConfig\SoftUse.ini
                                      Filesize

                                      330B

                                      MD5

                                      8039c071c563590a2cb23d85966a3a8d

                                      SHA1

                                      73fea27243d487edbc823b223666157b02bc5624

                                      SHA256

                                      a7d07fb60464b4f19c67203b4fa5101ab759596963d2083822570de5c3166584

                                      SHA512

                                      5cdc064bd84dc77c292cdda42508a4fe151f4e93f885aea148bb7e67cd3714044dc71ee40b75692ae66f42b8afa08d9115a650b2ff3709644f7858affddddce7

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\802rd848\dhjk.bce
                                      Filesize

                                      11.5MB

                                      MD5

                                      ec8eda88ce80e96d2c8110e8e9e46adf

                                      SHA1

                                      05607645a64283d92cd34e28873494d274798719

                                      SHA256

                                      f8683fa3e248cc7dfd17d541dde23366d5b05112b30442aba033abd671cc2524

                                      SHA512

                                      9ee23e2d5d5d5ce0e5a2d3b592cfc1bec1876dec605ccdbb7e4e5f74a9099948f9c0842a7506c9eafb9be90b12fe8b5eaa0267a51f496f8c6bc58adc9cd5e730

                                      Download Submit
                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sr2mbhbd.lll.ps1
                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      Download Submit
                                    • C:\uyuvav.exe
                                      Filesize

                                      97KB

                                      MD5

                                      ff8e2d576ca9914af0d6daf056a8203e

                                      SHA1

                                      cf785c80117568bf4c626690f63fcc1d750e97de

                                      SHA256

                                      538ef69041e4cd241babc92e40bce792ca3de57f048897b9072addf6223d730e

                                      SHA512

                                      2135dc290e30b8dd1fee1afd5e4654b126e5e34bfb762c1e3980ab3b2a09427e5b762bd363e89c01ac8910dae350bddc53acda0a3c52852d96ff5f06c9d64af5

                                      Download Submit
                                    • memory/2156-277-0x0000000007450000-0x00000000074F3000-memory.dmp
                                      Filesize

                                      652KB

                                      Download
                                    • memory/2156-265-0x0000000007410000-0x0000000007442000-memory.dmp
                                      Filesize

                                      200KB

                                      Download
                                    • memory/2156-286-0x0000000007950000-0x000000000795E000-memory.dmp
                                      Filesize

                                      56KB

                                      Download
                                    • memory/2156-282-0x0000000007750000-0x0000000007761000-memory.dmp
                                      Filesize

                                      68KB

                                      Download
                                    • memory/2156-281-0x00000000077D0000-0x0000000007866000-memory.dmp
                                      Filesize

                                      600KB

                                      Download
                                    • memory/2156-280-0x00000000075C0000-0x00000000075CA000-memory.dmp
                                      Filesize

                                      40KB

                                      Download
                                    • memory/2156-279-0x0000000007550000-0x000000000756A000-memory.dmp
                                      Filesize

                                      104KB

                                      Download
                                    • memory/2156-278-0x0000000007B90000-0x000000000820A000-memory.dmp
                                      Filesize

                                      6.5MB

                                      Download
                                    • memory/2156-249-0x0000000005350000-0x0000000005978000-memory.dmp
                                      Filesize

                                      6.2MB

                                      Download
                                    • memory/2156-276-0x00000000067E0000-0x00000000067FE000-memory.dmp
                                      Filesize

                                      120KB

                                      Download
                                    • memory/2156-266-0x000000006F9C0000-0x000000006FA0C000-memory.dmp
                                      Filesize

                                      304KB

                                      Download
                                    • memory/2156-287-0x0000000007A20000-0x0000000007A34000-memory.dmp
                                      Filesize

                                      80KB

                                      Download
                                    • memory/2156-264-0x0000000006260000-0x00000000062AC000-memory.dmp
                                      Filesize

                                      304KB

                                      Download
                                    • memory/2156-263-0x0000000006220000-0x000000000623E000-memory.dmp
                                      Filesize

                                      120KB

                                      Download
                                    • memory/2156-288-0x0000000007A60000-0x0000000007A7A000-memory.dmp
                                      Filesize

                                      104KB

                                      Download
                                    • memory/2156-262-0x0000000005C80000-0x0000000005FD4000-memory.dmp
                                      Filesize

                                      3.3MB

                                      Download
                                    • memory/2156-289-0x0000000007A50000-0x0000000007A58000-memory.dmp
                                      Filesize

                                      32KB

                                      Download
                                    • memory/2156-252-0x0000000005C10000-0x0000000005C76000-memory.dmp
                                      Filesize

                                      408KB

                                      Download
                                    • memory/2156-251-0x0000000005B30000-0x0000000005B96000-memory.dmp
                                      Filesize

                                      408KB

                                      Download
                                    • memory/2156-250-0x0000000005990000-0x00000000059B2000-memory.dmp
                                      Filesize

                                      136KB

                                      Download
                                    • memory/2156-248-0x0000000004C90000-0x0000000004CC6000-memory.dmp
                                      Filesize

                                      216KB

                                      Download
                                    • memory/2748-1-0x0000000000400000-0x0000000000607000-memory.dmp
                                      Filesize

                                      2.0MB

                                      Download
                                    • memory/2748-47-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-52-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-54-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-57-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-121-0x0000000006370000-0x0000000006380000-memory.dmp
                                      Filesize

                                      64KB

                                      Download
                                    • memory/2748-111-0x00000000007E0000-0x00000000007E2000-memory.dmp
                                      Filesize

                                      8KB

                                      Download
                                    • memory/2748-55-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-95-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-85-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-82-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-80-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-78-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-77-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-74-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-72-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-71-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-67-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-66-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-60-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-58-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-49-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-50-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-43-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-46-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-51-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-41-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-39-0x0000000006370000-0x0000000006380000-memory.dmp
                                      Filesize

                                      64KB

                                      Download
                                    • memory/2748-38-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-27-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-28-0x0000000010000000-0x0000000010537000-memory.dmp
                                      Filesize

                                      5.2MB

                                      Download
                                    • memory/2748-24-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-26-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-25-0x0000000002470000-0x0000000002471000-memory.dmp
                                      Filesize

                                      4KB

                                      Download
                                    • memory/2748-23-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-22-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-18-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-13-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-6-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-14-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-19-0x00000000007E0000-0x00000000007E2000-memory.dmp
                                      Filesize

                                      8KB

                                      Download
                                    • memory/2748-21-0x00000000007E0000-0x00000000007E2000-memory.dmp
                                      Filesize

                                      8KB

                                      Download
                                    • memory/2748-20-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-15-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-16-0x00000000007E0000-0x00000000007E2000-memory.dmp
                                      Filesize

                                      8KB

                                      Download
                                    • memory/2748-17-0x00000000007F0000-0x00000000007F1000-memory.dmp
                                      Filesize

                                      4KB

                                      Download
                                    • memory/2748-7-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-5-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-4-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download
                                    • memory/2748-3-0x0000000002490000-0x000000000354A000-memory.dmp
                                      Filesize

                                      16.7MB

                                      Download