hxxps://download[.]wondershare[.]net/filmora-idco_full1901[.]exe?_gl=1*1356wih*_gcl_au*MTI4NTQ2ODMxMy4xNzIzOTQ5NDE5*_ga*MTk1MDAxNTgyMi4xNzIzOTQ5NDIx*_ga_24WTSJBD5B*MTcyMzk0OTQyMS4xLjAuMTcyMzk0OTQyMS42MC4wLjExNzg0ODI4ODY[.]

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18/08/2024, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download.wondershare.net/filmora-idco_full1901.exe?_gl=1*1356wih*_gcl_au*MTI4NTQ2ODMxMy4xNzIzOTQ5NDE5*_ga*MTk1MDAxNTgyMi4xNzIzOTQ5NDIx*_ga_24WTSJBD5B*MTcyMzk0OTQyMS4xLjAuMTcyMzk0OTQyMS42MC4wLjExNzg0ODI4ODY.

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3820	filmora-idco_setup_full1901.exe
3896	NFWCHK.exe
5424	filmora-idco_setup_full1901.exe
4440	NFWCHK.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\filmora-idco_setup_full1901.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	filmora-idco_setup_full1901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	filmora-idco_setup_full1901.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Control Panel\Desktop\MuiCached	filmora-idco_setup_full1901.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Control Panel\Desktop\MuiCached	filmora-idco_setup_full1901.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 772178.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\filmora-idco_setup_full1901.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4000	msedge.exe
4000	msedge.exe
1020	identity_helper.exe
1020	identity_helper.exe
4356	msedge.exe
4356	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3820	filmora-idco_setup_full1901.exe
3820	filmora-idco_setup_full1901.exe
3820	filmora-idco_setup_full1901.exe
5424	filmora-idco_setup_full1901.exe
5424	filmora-idco_setup_full1901.exe
5424	filmora-idco_setup_full1901.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1944	4000	msedge.exe	81
PID 4000 wrote to memory of 1944	4000	msedge.exe	81
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4700	4000	msedge.exe	82
PID 4000 wrote to memory of 4748	4000	msedge.exe	83
PID 4000 wrote to memory of 4748	4000	msedge.exe	83
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84
PID 4000 wrote to memory of 3840	4000	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.wondershare.net/filmora-idco_full1901.exe?_gl=1*1356wih*_gcl_au*MTI4NTQ2ODMxMy4xNzIzOTQ5NDE5*_ga*MTk1MDAxNTgyMi4xNzIzOTQ5NDIx*_ga_24WTSJBD5B*MTcyMzk0OTQyMS4xLjAuMTcyMzk0OTQyMS42MC4wLjExNzg0ODI4ODY.
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb269d3cb8,0x7ffb269d3cc8,0x7ffb269d3cd8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,12438424148465729101,11925990035587543401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1872
- C:\Users\Admin\Downloads\filmora-idco_setup_full1901.exe
  "C:\Users\Admin\Downloads\filmora-idco_setup_full1901.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of SetWindowsHookEx
  PID:3820
- - C:\Users\Public\Documents\Wondershare\NFWCHK.exe
    C:\Users\Public\Documents\Wondershare\NFWCHK.exe
    3⤵
    - Executes dropped EXE
    PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\ce00cb5314564f4ab6e30d51abcc5b3f /t 4056 /p 3820
1⤵
PID:5464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3192

C:\Users\Admin\Downloads\filmora-idco_setup_full1901.exe
"C:\Users\Admin\Downloads\filmora-idco_setup_full1901.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
PID:5424
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:4440

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\7e3cbd2d0e804056bd188feac134f253 /t 5408 /p 5424
1⤵
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\NFWCHK.exe.log

Filesize
1KB

MD5
7ded17b124b30ba361ac271071eef8a1

SHA1
c0054d211643fb47b32a9517ce08fd55142f26ed

SHA256
502c12b5b477f2d66e73863c6743a2adb205c59ae88414d118893e962ecce60a

SHA512
a1119516849efc66c2a09d9520872324f2092856ea13156432a740c993c5fa3821e94d4ee9cff1e45f65cc9bf3a3619684d75421255b2bbce35f090391362f38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
ec887a877961c948e69e29e7579a4890

SHA1
436bf0d92165e98b22aa1822e1de8a12da90a40e

SHA256
e9cf9059a8d4969ffdefade39889b3145acbae3c010a249206dcbe8af7207f23

SHA512
fbd1a67c070cbe67c84b10475f3e3fe5fbc682a7091a1c8602f280d776415b89bcd5fbc51c3c1d2aa166aa1f0c33a35b755c97d50ee0cdd54e0abdc30098ea0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c90e7a3307acd302a33d0cca30d8ebf

SHA1
a00b6adecba4258532ea32c392d077ba1bc53701

SHA256
3cc0ea31e3a38726d8b6decd3f6a01c3365755ae536805f09d6fcaae2157a54b

SHA512
206fe0c7f68e3b01344e904b7434655f30edb7b12eb55640674374a123f6e538094b49a17a243a0ec8a8e46119f1570f7ab8db8ace785ef4d86dcb6ebc174c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7149c04e1879305bc1cc5f3339ff924

SHA1
8bd65aa373decd3b705a0c42cea00dc6b4fcb489

SHA256
e5f4eff68e0b07cc320b6cae0644481df4001f86cf3d614bedd26b37512fb834

SHA512
55d53cd8b5baeb3bdea4422a579b9e60da2e4a20d9dffe1590c5f90801b0710f1a4ab19492d53ea9f46accdbcd175d67a241060d4d95df58a54fe2a007357c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d04830ade9cbbfcba4eb97c9b8fee3cf

SHA1
699e3f8260c488b2ced464096a83c7695dcc17d7

SHA256
3e5e6be1e78ab00b2f0993568e96393ee9c4dc429369a328cb85ccde3c8256f2

SHA512
fc2ad58cab8888d40839c6bfb30f7c306fe6eb60c7ee3f662c05221a82a6e7a7d1a5b142c11e9be66619c5da18b3ab52fd444e32d242c33df360ca725c4ffd43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a3d6457d0bd5be3285a0b68a0b38bea

SHA1
6c379ed42ba1525dd8d4a9a4fde794db48968f81

SHA256
03a8d7f42e593e2261bf56168678141d1dee157f8b770958f3b7abeb488371ce

SHA512
9d9c455392e436928ea2648da4575061518c388acc24560044f990809a762de37e3b823a53a5d2e1c6dee3ee0d5fc0c4ba31633a9d775c770154306abdac2e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
445912a45c6e0e9f40e738825750cb1a

SHA1
a93c1967dbf7beb91f88e88b4334e94ec3f82540

SHA256
34b7fe79d70bd501734e328bab04a2ca76a011a92c93b1f00ae839aa62e74b64

SHA512
4c40a7ec59303f85ac8f4870f80b31b55e49ad4239ab5dde3cb1b192ac6a81c382a56d5dc0f5a2a8cb5062bc62c199e2ec6f0e835aaa4794f38fc20655d03db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
88f33747e9f7b9df6eb4ba070d680ba1

SHA1
783d4546e84ebfebf107f6f213fc86dc921b10ee

SHA256
e07e9764e9ab73a99c60df4ffe8b3ec4602e481c73cdd6b6dfbbfde6647f32a9

SHA512
c25f377cb0f18297a670959462f5d7558c8e3c29ea490817aa8ad19e16187b3ad8615549432e0f6193d6128cb12041187560eaf534dc7c42435586ef179b7e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
2KB

MD5
86e3071e33dc0160fa56ec2af22c968d

SHA1
cf798f1a1941a072859893b2c4a3374a9ca1707e

SHA256
49484fef0813326bd5acb2678d8ce2e87b17a9f44491fe62b7f89d0fa31733d2

SHA512
98f587f035d222d5a3035fd4dc47c351c2f40cf939718b1e76d7697b33d1082989088ea767f9a42e9eb52f3ff7b74e9d8a2ab8a4f5625b269bb1936cb2dba688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
2KB

MD5
489ce473db6aefb9c15368b92387635d

SHA1
532b35fbb5bc7d04a3c0a3e4604181d0f8ecb86d

SHA256
9717992cd5425fcf2365f94558a5ec4cf002e37d0a3b3aa4637888bf9c754365

SHA512
9078eca28521cb03dda04a244929f4f79289418ad08c75c5be1ac887e1414282cd4b89d760d4b795005e1315bda32e9d44dd0075f171f0ab2630801820a5f7ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
4KB

MD5
a65e01adfddee61c08c827e3d96ead91

SHA1
74ad0ff832878163dd11db7eeaba2d312f4aa48f

SHA256
be45d677bfb16d86aa889842dfcd06368b3784ae545650c1cc1a928e80d5b216

SHA512
f0769b3722531fbc05f58dc54c6ed4e16558ca739b46e6619196943e6f9453baf5bf90facfce4bb844f48abe062d8d61c62199cb3c8e435cf7c13c310d829250

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
124KB

MD5
dd744074a6e6ee61ea3a7e4b1252ea57

SHA1
302c510eeb77110b60d869c0919e29beab64ce3c

SHA256
c7c0bf6ae52f61648cc3a34e3824742ed316f089a789ec630f64fb6ddcbb10ff

SHA512
8dc05d28f9b682b467547259ca329ce10ccf8b1b360c28b126ed5926e878a9f563ec1fc7ecd8d2b0a147dbbb54d215f941c866f69a902cb1e5ce31beaabf4c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
32KB

MD5
ce9c8cab93e5092469ab68e8df00bd2b

SHA1
7fadcd61fdcde204984d787177a521c2b562cbf1

SHA256
0d6b19e072b0563e13e374812ec007d3a41ee3857f9eaed12d669760b4a30cea

SHA512
3cc2bd2c86ccc69b1aa354b038889e775155140717fc6d51d91ff2223f6518a91c43e5990284a9e6d31e1359aff72ef4e06408527ef4e1394a290410ef707c39

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 772178.crdownload

Filesize
1.9MB

MD5
4a2cc9a194b872a64790f14f1d102301

SHA1
f780d19e26ad14cf64c4f068c3ceb4fb193e364c

SHA256
08aedd6d0cb756a6552378823e29e78c8752ac16fc7afb2a610e552ce5aa6935

SHA512
655ea9874604e77f739d577713ff5b320aeaa7094adc35a3c1cb8e0b9aadb8b2228a2be4136be09303bb203ea1448bc95e721a139cac4a116677fad1cccfd0ae

Download Submit
C:\Users\Admin\Downloads\filmora-idco_setup_full1901.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
223B

MD5
5babf2a106c883a8e216f768db99ad51

SHA1
f39e84a226dbf563ba983c6f352e68d561523c8e

SHA256
9e676a617eb0d0535ac05a67c0ae0c0e12d4e998ab55ac786a031bfc25e28300

SHA512
d4596b0aafe03673083eef12f01413b139940269255d10256cf535853225348752499325a5def803fa1189e639f4a2966a0fbb18e32fe8d27e11c81c9e19a0bb

Download Submit
memory/3896-1233-0x000000001BBA0000-0x000000001BBB8000-memory.dmp

Filesize
96KB

Download
memory/3896-1241-0x000000001D300000-0x000000001D33E000-memory.dmp

Filesize
248KB

Download
memory/3896-1240-0x000000001C350000-0x000000001C358000-memory.dmp

Filesize
32KB

Download
memory/3896-1239-0x000000001CF30000-0x000000001CFCC000-memory.dmp

Filesize
624KB

Download
memory/3896-1238-0x000000001C9C0000-0x000000001CE8E000-memory.dmp

Filesize
4.8MB

Download
memory/3896-1237-0x000000001C480000-0x000000001C4E2000-memory.dmp

Filesize
392KB

Download
memory/3896-1236-0x000000001C3C0000-0x000000001C409000-memory.dmp

Filesize
292KB

Download
memory/3896-1235-0x000000001BC00000-0x000000001BF10000-memory.dmp

Filesize
3.1MB

Download
memory/3896-1234-0x000000001BBE0000-0x000000001BC00000-memory.dmp

Filesize
128KB

Download
memory/3896-1232-0x0000000001810000-0x0000000001834000-memory.dmp

Filesize
144KB

Download