Analysis
- max time kernel
52s - max time network
206s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 14:09
General
- Target wondershare-filmora-15-5-3-19727.exe
- Size 772.7MB
- Sample261003-rf4jrazfld
- SHA256 77d97eda8331ff790fe35e27db34c956ece24aef4af1e75b753fd7b6d09d0951
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 6 IoCs
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 13 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\wondershare-filmora-15-5-3-19727.exe"C:\Users\Admin\AppData\Local\Temp\wondershare-filmora-15-5-3-19727.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AVJ4D.tmp\wondershare-filmora-15-5-3-19727.tmp"C:\Users\Admin\AppData\Local\Temp\is-AVJ4D.tmp\wondershare-filmora-15-5-3-19727.tmp" /SL5="$4011A,808044398,401920,C:\Users\Admin\AppData\Local\Temp\wondershare-filmora-15-5-3-19727.exe"2⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JKJOT.tmp\_isetup\_setup64.tmphelper 105 0x903⤵
- Executes dropped EXE
-
-
F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 1.exe"F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 1.exe" /VERYSILENT /SUPPRESSMSGBOXES /DIR="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727" /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-.SubPack1.log" /UPGRADE_HWND=7213823⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-S6403.tmp\Wondershare Filmora SubPack 1.tmp"C:\Users\Admin\AppData\Local\Temp\is-S6403.tmp\Wondershare Filmora SubPack 1.tmp" /SL5="$702A4,259334690,401920,F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 1.exe" /VERYSILENT /SUPPRESSMSGBOXES /DIR="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727" /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-.SubPack1.log" /UPGRADE_HWND=7213824⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-8HDAS.tmp\_isetup\_setup64.tmphelper 105 0x4145⤵
-
-
-
-
F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 2.exe"F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 2.exe" /VERYSILENT /SUPPRESSMSGBOXES /DIR="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727" /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-.SubPack2.log" /UPGRADE_HWND=1972523⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-10TVF.tmp\Wondershare Filmora SubPack 2.tmp"C:\Users\Admin\AppData\Local\Temp\is-10TVF.tmp\Wondershare Filmora SubPack 2.tmp" /SL5="$302DC,220166252,401920,F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 2.exe" /VERYSILENT /SUPPRESSMSGBOXES /DIR="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727" /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-.SubPack2.log" /UPGRADE_HWND=1972524⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-8ISMK.tmp\_isetup\_setup64.tmphelper 105 0x4845⤵
-
-
-
-
F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 3.exe"F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 3.exe" /VERYSILENT /SUPPRESSMSGBOXES /DIR="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727" /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-.SubPack3.log" /UPGRADE_HWND=2624823⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VEJD1.tmp\Wondershare Filmora SubPack 3.tmp"C:\Users\Admin\AppData\Local\Temp\is-VEJD1.tmp\Wondershare Filmora SubPack 3.tmp" /SL5="$2021C,159505992,401920,F:\Wondershare\{822F4CEE-71EB-4911-A867-FD974AB3632F}\Wondershare Filmora SubPack 3.exe" /VERYSILENT /SUPPRESSMSGBOXES /DIR="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727" /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-.SubPack3.log" /UPGRADE_HWND=2624824⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s FilmoraContextMenu.dll3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s atimpenc.dll3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s atixcode.dll3⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s CFDecode64.ax3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-JKJOT.tmp\Wondershare NativePush.exe"C:\Users\Admin\AppData\Local\Temp\is-JKJOT.tmp\Wondershare NativePush.exe" /VERYSILENT /BINDINSTALL3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-69VDE.tmp\Wondershare NativePush.tmp"C:\Users\Admin\AppData\Local\Temp\is-69VDE.tmp\Wondershare NativePush.tmp" /SL5="$4024E,2832329,938496,C:\Users\Admin\AppData\Local\Temp\is-JKJOT.tmp\Wondershare NativePush.exe" /VERYSILENT /BINDINSTALL4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq WsNativePushService.exe" 2>NUL | find /I /N "WsNativePushService.exe"5⤵
- Executes a command shell one-liner
-
C:\Windows\System32\tasklist.exetasklist /FI "IMAGENAME eq WsNativePushService.exe"6⤵
- Discovers running processes
-
-
C:\Windows\System32\find.exefind /I /N "WsNativePushService.exe"6⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq WsToastNotification.exe" 2>NUL | find /I /N "WsToastNotification.exe"5⤵
- Executes a command shell one-liner
-
C:\Windows\System32\tasklist.exetasklist /FI "IMAGENAME eq WsToastNotification.exe"6⤵
- Discovers running processes
-
-
C:\Windows\System32\find.exefind /I /N "WsToastNotification.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-079IG.tmp\_isetup\_setup64.tmphelper 105 0x45C5⤵
-
-
C:\Windows\system32\netsh.exe"netsh.exe" advfirewall firewall add rule name="WsToastNotification" dir=in security=authnoencap action=allow program="C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe"5⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe" install5⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe" start5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-JKJOT.tmp\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-JKJOT.tmp\vcredist_x64.exe" /q3⤵
-
\??\f:\f83d007f9ee2ece105\install.exef:\f83d007f9ee2ece105\.\install.exe /q4⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://cbs.wondershare.com/go.php?pid=846&m=i&product_version=15.5.3.19727&client_sign={14671d29-9e6b-481d-8729-02bd5efa7da9G}&is_silent_install=23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb0a50c728,0x7ffb0a50c734,0x7ffb0a50c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,1266797925465373092,17856363507039416242,524288 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,6700057891671981105,16898018379945357644,262144 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,17776346358158438573,7161175761703599330,524288 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,8056204994079417418,4401673605341309318,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,8576887536089937731,15441636966656735619,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,5576323431867627307,10052790934156405723,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3576,i,6018469374262550283,8447319385694127162,524288 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5020,i,9942475395507730622,9646624665853031714,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5156,i,3560327699566900860,10772175358081125778,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,15976741004035066411,11887657869860238736,524288 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,6064331735225021775,4711863893560771828,524288 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,5529209029149708274,6763845520353739509,524288 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,10223264652479767459,12710894101299784497,524288 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6128,i,1130916870904598539,4527299464038136135,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6140,i,3559115401436080908,5643074268753095502,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6272,i,12486066423344460935,15286018248981764469,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6388,i,9931945135337706315,14959696717795219531,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6236,i,6122501774295879050,3811862615254751281,2097152 --field-trial-handle=1940,i,12428140680638921853,2050396165519732884,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14⤵
-
-
-
C:\Windows\system32\ie4uinit.exe"C:\Windows\system32\ie4uinit.exe" "-show"3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora Launcher.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora Launcher.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Wondershare Filmora.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe"1⤵
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe"2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Wondershare Filmora.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Wondershare Filmora.exe"2⤵
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\DataReporting.exeDataReporting.exe {\"process_guid\":\"b5a9215c-f6cf-4dcf-b72f-3de8649dc045\",\"process_name\":\"DataReporting\",\"process_type\":3,\"server_guid\":\"f9fcac2c-99a6-47e4-906a-9ced30a70524\",\"server_name\":\"WS_Filmora\",\"server_process_id\":4472,\"server_process_start_time\":1791036900805}3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\PlayServer.exePlayServer.exe {\"process_guid\":\"c8941327-e76a-4708-b5ef-657f53e41451\",\"process_name\":\"PlayServer\",\"process_type\":11,\"server_guid\":\"f9fcac2c-99a6-47e4-906a-9ced30a70524\",\"server_name\":\"WS_Filmora\"}3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Performance.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Performance.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\FilmoraPlayer.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\FilmoraPlayer.exe" check3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\ofx_check.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\ofx_check.exe" --app-path "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/15.5.3.19727" --cache-file-path "C:/Users/Admin/AppData/Local/Temp/Wondershare Filmora" --enable-common-ofx-path --ofx-path C:\Users\Admin\AppData\Roaming\OFX3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\WebBrowser.exeWebBrowser.exe {\"prload_url_list\":[\"https://filmora.wondershare.com/client/upgrade-v14.html?preload=1\",\"https://app.filmora.io/#/ai/copilot-v5?embed=client&preload=1\",\"https://wae.wondershare.cc/nps2/?embed=desktop&preload=yes\"],\"process_guid\":\"3f1b8af3-815c-4f1b-ac09-521e5bcf351b\",\"process_name\":\"WebBrowser\",\"process_type\":1,\"proxy_info_mode\":0,\"proxy_info_password\":\"\",\"proxy_info_port\":0,\"proxy_info_server\":\"\",\"proxy_info_type\":2,\"proxy_info_user\":\"\",\"server_guid\":\"f9fcac2c-99a6-47e4-906a-9ced30a70524\",\"server_name\":\"WS_Filmora\"}3⤵
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --field-trial-handle=1928,16993740972031477373,8109217956123971547,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources" --user-agent="CEF89.0.0.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --use-mock-keychain --renderer-process-limit=1 --disable-gpu --bridge-obj-name=filmora --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=2 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:14⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing" --type=gpu-process --field-trial-handle=1928,16993740972031477373,8109217956123971547,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources" --user-agent="CEF89.0.0.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --lang=en-US --use-mock-keychain --renderer-process-limit=1 --disable-gpu --bridge-obj-name=filmora --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --mojo-platform-channel-handle=2392 /prefetch:24⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,16993740972031477373,8109217956123971547,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources" --user-agent="CEF89.0.0.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --lang=en-US --use-mock-keychain --renderer-process-limit=1 --disable-gpu --bridge-obj-name=filmora --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --mojo-platform-channel-handle=2452 /prefetch:84⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,16993740972031477373,8109217956123971547,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources" --user-agent="CEF89.0.0.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --lang=en-US --use-mock-keychain --renderer-process-limit=1 --disable-gpu --bridge-obj-name=filmora --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --mojo-platform-channel-handle=2460 /prefetch:84⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --field-trial-handle=1928,16993740972031477373,8109217956123971547,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources" --user-agent="CEF89.0.0.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --use-mock-keychain --renderer-process-limit=1 --disable-gpu --bridge-obj-name=filmora --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:14⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\CefViewWing" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --field-trial-handle=1928,16993740972031477373,8109217956123971547,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\debug.log" --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cefresources" --user-agent="CEF89.0.0.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --use-mock-keychain --renderer-process-limit=1 --disable-gpu --bridge-obj-name=filmora --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:14⤵
-
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\FilmoraTray.exeFilmoraTray.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cmdCheckATI.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cmdCheckATI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Wondershare Filmora Update(x64).exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\\Wondershare Filmora Update(x64).exe" /VERYSILENT /SP- "/DIR=C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora Update/"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DCTKF.tmp\Wondershare Filmora Update(x64).tmp"C:\Users\Admin\AppData\Local\Temp\is-DCTKF.tmp\Wondershare Filmora Update(x64).tmp" /SL5="$73007E,8272281,163840,C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Wondershare Filmora Update(x64).exe" /VERYSILENT /SP- "/DIR=C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora Update/"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0C1JC.tmp\_isetup\_setup64.tmphelper 105 0x4605⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cmdCheckHEVC.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cmdCheckHEVC.exe" 875967049 320 240 1000 30003⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cmdCheckHEVC.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\cmdCheckHEVC.exe" 892744265 320 240 1000 30003⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\coremediaserver.exe"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\coremediaserver.exe" 570aed1e370c460a-a52962841d86c890 27148 4472 "C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora\MediaInfo\Wondershare Filmora.exe.sqldb" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\proxypath" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\Log"3⤵
-
-
C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\15.5.3.19727\magic_xe_supported_detect.exemagic_xe_supported_detect.exe single face_detector "C:\ProgramData\Wondershare Filmora\VblProductData\VblExtension/Models/" ./resources/wfx_effect/material/models/model_data.json ./resources/wfx_effect/material/models/magic_xe.lic ./log3⤵
-
-
C:\Windows\system32\cmd.execmd.exe /c nvidia-smi --query-gpu=gpu_name,driver_version,memory.total,memory.used,memory.free,compute_cap --format=csv,noheader,nounits3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\tasklist.exetasklist /FI "\"PID EQ 4472 \""3⤵
- Discovers running processes
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e5c4bf8.rbs
Tiny zoom.png
is-018TF.tmp
is-0LH66.tmp
is-0NB9B.tmp
is-1702C.tmp
is-17MKL.tmp
is-1BV5I.tmp
is-1RHPQ.tmp
is-24LHU.tmp
is-2FP8S.tmp
is-2IKNQ.tmp
is-2LJ9S.tmp
is-2MO4G.tmp
is-37QTR.tmp
is-3CDKU.tmp
is-3F4KR.tmp
is-3F899.tmp
is-3IIUJ.tmp
is-3LN4F.tmp
is-3M4Q9.tmp
is-3NF5H.tmp
is-47OOI.tmp
is-49BMF.tmp
is-4JNSQ.tmp
is-4MSB2.tmp
is-4N6GS.tmp
is-556GH.tmp
is-56HP9.tmp
is-5KMM5.tmp
is-5NKIU.tmp
is-5NVMJ.tmp
is-5PF9O.tmp
is-5RMMQ.tmp
is-5SBQ7.tmp
is-693GQ.tmp
is-7NKVQ.tmp
is-7P7E2.tmp
is-8C6R7.tmp
is-8IDKN.tmp
is-967NM.tmp
is-9GLVK.tmp
is-9HJ34.tmp
is-9K8CA.tmp
is-9PO72.tmp
is-9Q0DE.tmp
is-A7M49.tmp
is-AFDO2.tmp
is-AG4PV.tmp
is-AP3SB.tmp
is-ATICK.tmp
is-BE3K0.tmp
is-BH4FB.tmp
is-BK1LH.tmp
is-BSUKU.tmp
is-BVF6A.tmp
is-C7UOE.tmp
is-C8351.tmp
is-C8Q33.tmp
is-CIA6F.tmp
is-DO2VM.tmp
is-DR1K3.tmp
is-DT0HU.tmp
is-E3MQF.tmp
is-EA2NT.tmp
is-EI8HF.tmp
is-ERMFL.tmp
is-FCG6L.tmp
is-G4OS8.tmp
is-GL372.tmp
is-GPNSK.tmp
is-H37NT.tmp
is-HF7O8.tmp
is-HMUHO.tmp
is-HOBVK.tmp
is-HVTBK.tmp
is-I03UA.tmp
is-I6A44.tmp
is-INRKJ.tmp
is-IQTSL.tmp
is-J1F17.tmp
is-J26CE.tmp
is-J31DO.tmp
is-J563N.tmp
is-JB31R.tmp
is-JCK5K.tmp
is-JFDLQ.tmp
is-JITMA.tmp
is-JM1TF.tmp
is-JR7AN.tmp
is-JRFLR.tmp
is-JU25E.tmp
is-K1ARB.tmp
is-KUB2U.tmp
is-LAL6I.tmp
is-LAMHR.tmp
is-LDFVR.tmp
is-MP279.tmp
is-NEKPO.tmp
is-NKU9C.tmp
is-NRLGI.tmp
is-O6PD8.tmp
is-OCIP6.tmp
is-P1HHR.tmp
is-P6L6Q.tmp
is-PG7MK.tmp
is-PL5TB.tmp
is-PND6N.tmp
is-PQM7P.tmp
is-PSL5E.tmp
is-PU8VJ.tmp
is-Q0651.tmp
is-Q0FRK.tmp
is-Q37EI.tmp
is-QCAH0.tmp
is-QEEQA.tmp
is-QPBV1.tmp
is-QUR7U.tmp
is-R2MBN.tmp
is-R85LK.tmp
is-RN5DB.tmp
is-RRAEG.tmp
is-RRGIP.tmp
is-S910T.tmp
is-SAVFK.tmp
is-SBRFB.tmp
is-SPDH1.tmp
is-TEEQK.tmp
is-TO178.tmp
is-TRAPJ.tmp
is-TSO4S.tmp
is-U0AH6.tmp
is-U3B0V.tmp
is-U5RS9.tmp
is-UEC29.tmp
is-UILSN.tmp
is-V49E8.tmp
is-VBR4U.tmp
is-VQPQO.tmp
is-0NAIS.tmp
is-13BPH.tmp
is-1CCJK.tmp
is-2OQDM.tmp
is-2P5A0.tmp
is-2REB8.tmp
is-3L9BG.tmp
is-54LGK.tmp
is-5GJNM.tmp
is-5HEUJ.tmp
is-6DO73.tmp
is-72PIO.tmp
is-7M8BC.tmp
is-7NEU7.tmp
is-7T9VT.tmp
is-8IVTJ.tmp
is-93140.tmp
is-9NNB3.tmp
is-A2UGG.tmp
is-APBE4.tmp
is-B8AQV.tmp
is-BHE24.tmp
is-C12CP.tmp
is-C1U4M.tmp
is-C2SJ5.tmp
is-C5FMQ.tmp
is-C5QVL.tmp
is-CKPMS.tmp
is-CO6CI.tmp
is-CR0RD.tmp
is-EBVBM.tmp
is-EE585.tmp
is-EVAN9.tmp
is-FHGMO.tmp
is-GSQ14.tmp
is-HAKJ4.tmp
is-HRGVP.tmp
is-JDBCG.tmp
is-JOD9O.tmp
is-JQ561.tmp
is-JR2FV.tmp
is-K6JBP.tmp
is-KBITA.tmp
is-KI3VJ.tmp
is-LUAMO.tmp
is-M9KKD.tmp
is-NC049.tmp
is-NMPT2.tmp
is-P9EOI.tmp
is-PMVF4.tmp
is-PN9EA.tmp
is-QJB1D.tmp
is-QN9GK.tmp
is-SH3CD.tmp
is-TCDJD.tmp
is-TH4Q4.tmp
is-UP3LV.tmp
is-URD7H.tmp
is-URIUM.tmp
is-VA2JC.tmp
is-VOO48.tmp
is-EA20V.tmp
is-0B12G.tmp
is-5SMRK.tmp
is-6P7PM.tmp
is-FNFKQ.tmp
is-GMHRC.tmp
is-H9U52.tmp
is-LLG3C.tmp
is-OH3HC.tmp
is-UEO07.tmp
is-0CH7D.tmp
is-1SINS.tmp
is-I5IP3.tmp
is-K8VIC.tmp
is-NN86M.tmp
is-S1SLG.tmp
is-1V7OQ.tmp
is-CCG4M.tmp
is-LAG3H.tmp
is-LBBTA.tmp
FConfig.ini
FConfig.ini
FConfig.ini.QWMvDh
FConfig.ini.ZQNzWc
Filmora.ini
WM_FaceDetector_OpenVINO_FP32_2.0.0.5.model
version
WM_FaceDetectorScrdf0_5_384_MNN_FP16_1.1.2.0.model
WM_FaceDetectorScrdf0_5_384_OpenVINO_FP32_1.1.2.0.model
WM_FaceFeatureEdgeFace_MNN_FP16_1.0.0.0.model
WM_FaceFeatureEdgeFace_Openvino_FP32_1.0.0.0.model
WM_FaceLandmarksV3_Resnet_224_MNN_FP16_3.3.2.1.model
WM_FaceLandmarksV3_Resnet_224_OpenVINO_FP16_3.3.2.1.model
WM_FacePoseEstimator_Net_Binary_1.0.0.0.model
version
WM_HumanSegmentEffect_OpenVINO_FP16_2.4.1.1.model
version
WM_HumanSegmentHighAcc_MNN_FP32_3.1.1.4.model
WM_HumanSegmentHighAcc_OpenVINO_FP16_3.1.0.4.model
version
is-ETHIH.tmp
is-F2C39.tmp
is-PURG9.tmp
is-IUS4F.tmp
is-2ATA3.tmp
is-BKIP8.tmp
is-I1I7V.tmp
is-8O63C.tmp
is-US43G.tmp
is-C8PQN.tmp
is-DHUNK.tmp
is-P9F5T.tmp
is-P62TJ.tmp
is-18GU2.tmp
is-NRV4A.tmp
is-KL2NQ.tmp
is-DOVAQ.tmp
is-U9E6M.tmp
is-9B7GV.tmp
is-KLMA9.tmp
is-P0EUH.tmp
is-CJDKL.tmp
is-NDO79.tmp
is-IKN2H.tmp
is-88QIL.tmp
is-JOGI2.tmp
is-HFDN5.tmp
is-HJESL.tmp
is-94TGE.tmp
is-37J9K.tmp
is-DDVNC.tmp
CloudConfig.json
is-0MVV4.tmp
is-294UA.tmp
is-5KL1E.tmp
is-7BS0A.tmp
is-7T0A9.tmp
is-A5QFA.tmp
is-BGAJA.tmp
is-GHDMP.tmp
is-KT58F.tmp
is-L4NQ5.tmp
is-L7GKK.tmp
is-LE05H.tmp
is-OE2U4.tmp
is-Q9JHK.tmp
is-S8UEH.tmp
is-1VV90.tmp
is-KBGF4.tmp
is-G4JVM.tmp
is-JI8PC.tmp
is-39B8V.tmp
is-ODI43.tmp
is-H7N48.tmp
is-IJIR1.tmp
is-5M9D0.tmp
is-FS7PI.tmp
is-E106H.tmp
Circle.conf
is-VRVRL.tmp
is-FE0G3.tmp
is-KU7MC.tmp
is-NH021.tmp
is-9KGSV.tmp
is-5SUT8.tmp
is-3STB7.tmp
is-76RNF.tmp
is-0R94A.tmp
is-4D839.tmp
is-9KDTB.tmp
is-E4REV.tmp
is-H1HT6.tmp
is-KT0VP.tmp
is-OGQ3V.tmp
is-AK0R4.tmp
is-G5N4C.tmp
is-GUCA2.tmp
is-EH4VJ.tmp
is-2C28G.tmp
is-9FTUM.tmp
is-01B87.tmp
is-SRDIA.tmp
is-1OH05.tmp
is-IUT90.tmp
is-UBQ98.tmp
is-22M9I.tmp
is-N1T9U.tmp
is-BNC9L.tmp
is-TFE68.tmp
is-DB6SU.tmp
is-0D9OS.tmp
is-RJMM7.tmp
Filmora.ini
04ac0249-3ee1-45ca-940c-29bc499ea852.tmp
45286450-d5ec-4b7d-958b-ba7fbfacdbd1.tmp
6520fa9a-aa40-4481-ad36-6c12de8616b6.tmp
418e4aae-2fa6-409c-8781-5c3d04a2df79.tmp
temp-index
82fc6493-9be6-484d-83f9-736b394f3bbd.tmp
index.txt
index.txt.tmp
temp-index
aacc74a7-61c6-4d5f-ac2d-91b21c2afef0.tmp
b07b3aaa-cd65-4467-a3bf-9781c5f14c45.tmp
WMSDKNS.XML.bak
VWL6019.tmp
aiConfig_GPT5_Image_2.json
aiConfig_NanoBanana_2.json
aiConfig_NanoBanana_Pro.json
config.json
case2_img1.png
case2_img2.png
case2_img3.jpg
case3_img1.png
case3_img2.png
case2_img1.png
case3_img1.png
case2_img1.png
case3_img1.jpg
case3_img2.jpg
case3_img3.png
case3_img4.jpg
case3_img5.jpg
case3_img6.jpg
info.json
uiConfig_GPT5_Image_2.json
uiConfig_NanoBanana_2.json
uiConfig_NanoBanana_Pro.json
aiConfig_Seedance2.json
uiConfig_Seedance2.json
uiConfig_Standard-1.0.json
uiConfig_Veo3.json
uiConfig_Veo3.json
icon_happyhorse.svg
wsUpgrade.log
wsUpgrade.log
wsUpgrade.log
gKZ-NnC9Zbk.lock
Wondershare Filmora SubPack 2.tmp
wondershare-filmora-15-5-3-19727.tmp
Customization.xml
FilmoraContextMenu.dll
InnoUtils.dll
InstallHelper.dll
WSUtilities_Setup.dll
WS_Log_Setup.dll
Wondershare NativePush.exe
_setup64.tmp
innocallback.dll
vcredist_x64.exe
Wondershare Filmora SubPack 1.tmp
Wondershare Filmora SubPack 3.tmp
is-7HNAN.tmp
is-BGFL0.tmp
is-D59S2.tmp
is-U11SV.tmp
is-8S1M8.tmp
is-EMNPJ.tmp
is-NJN1V.tmp
is-OMLK3.tmp
is-PJSL5.tmp
is-164AA.tmp
is-782EV.tmp
is-0MO1C.tmp
is-H8H9B.tmp
is-T1VN1.tmp
is-T3SPQ.tmp
is-TGS6S.tmp
is-7HIJQ.tmp
is-HKVVV.tmp
is-LFDQM.tmp
is-N2BHD.tmp
is-PMUF6.tmp
is-RGM4L.tmp
is-CG84G.tmp
is-GJQ66.tmp
is-PGUMK.tmp
is-PU606.tmp
is-U7QGS.tmp
is-9RD5D.tmp
is-MNMAF.tmp
is-PNE49.tmp
is-VUQ4B.tmp
translation.json
is-01F7A.tmp
is-45QME.tmp
is-EJHQQ.tmp
is-P72AO.tmp
is-0FQ28.tmp
is-4UGMG.tmp
is-BT172.tmp
is-OFF8M.tmp
is-PT7T0.tmp
is-QF560.tmp
is-1GLKQ.tmp
is-GL8RT.tmp
is-H61NM.tmp
is-I080B.tmp
is-2Q6P0.tmp
is-5IR07.tmp
is-B4IMV.tmp
is-F7K5G.tmp
is-HHH8E.tmp
is-KT8EQ.tmp
is-NOASQ.tmp
is-SFCB5.tmp
is-STOJA.tmp
is-5EN4M.tmp
is-6DS4E.tmp
is-8AAEA.tmp
is-GFUQ7.tmp
is-ICBQE.tmp
is-JCL13.tmp
is-JU5RT.tmp
is-PS4KQ.tmp
is-SQC6I.tmp
is-STQSU.tmp
is-UICA6.tmp
is-16LN5.tmp
is-69B5N.tmp
is-759K7.tmp
is-9PMIN.tmp
is-A875G.tmp
is-CQ1D3.tmp
is-HB7DV.tmp
is-JHA2D.tmp
is-KOAML.tmp
is-MQHMV.tmp
is-T5K3L.tmp
is-RORT7.tmp
is-6A2UO.tmp
is-9H2CT.tmp
is-B0DP6.tmp
is-6FBJB.tmp
is-APQE7.tmp
is-DA2PE.tmp
is-GVQIQ.tmp
is-KGCK7.tmp
is-L0MIM.tmp
CefViewWing.exe
Customization.xml
DataReporting.exe
FilmoraPlayer.exe
FilmoraTray.exe
is-1077U.tmp
is-83H47.tmp
is-BA6AD.tmp
is-CENB6.tmp
is-D75ND.tmp
is-DFU3R.tmp
is-DU8HQ.tmp
is-EHEIN.tmp
is-FT3SU.tmp
is-J3I9K.tmp
is-KE44B.tmp
is-LIE13.tmp
is-MKE05.tmp
is-R1I3Q.tmp
Performance.exe
PlayServer.exe
WebBrowser.exe
WebUtility.dll
Wondershare Filmora Update(x64).exe
Wondershare Filmora.exe
cmdCheckATI.exe
cmdCheckHEVC.exe
is-HTRE6.tmp
is-656UT.tmp
is-5KUBM.tmp
is-LS67I.tmp
is-U3JGA.tmp
is-K1RQO.tmp
is-COKF7.tmp
is-KKNI7.tmp
is-EGAJ9.tmp
is-5V1LN.tmp
is-7A0A7.tmp
is-6HLG3.tmp
is-B0MQE.tmp
is-14KL1.tmp
is-3EV8I.tmp
is-AMARP.tmp
is-APSH9.tmp
is-DIB4I.tmp
is-E05NC.tmp
is-J446E.tmp
is-JB2D5.tmp
is-R6KPL.tmp
is-4PANI.tmp
is-4PJA6.tmp
is-DNJQ7.tmp
is-C6EE3.tmp
is-O289O.tmp
is-R8NGE.tmp
is-HTSLA.tmp
is-L6AIK.tmp
is-6D2C0.tmp
is-4QQHI.tmp
is-A2TJ1.tmp
is-L1SFH.tmp
is-BBONB.tmp
is-9QVAB.tmp
is-HB2TN.tmp
is-MVG2R.tmp
is-9IFSJ.tmp
is-K6C8M.tmp
is-VIODD.tmp
is-PQ8UB.tmp
is-SRR3M.tmp
is-36R99.tmp
is-NLGA1.tmp
is-SVL53.tmp
is-0T6N5.tmp
is-PM00N.tmp
is-UJRG3.tmp
is-08REK.tmp
is-3CGKK.tmp
is-SIFTM.tmp
is-7IMSR.tmp
is-RVMDE.tmp
is-APCBB.tmp
is-C330M.tmp
is-GEFTJ.tmp
is-3K25P.tmp
is-3OK8S.tmp
is-06DGM.tmp
is-3IT5T.tmp
is-C2PRT.tmp
is-9E6T9.tmp
is-RK4U9.tmp
is-EPMRF.tmp
is-J792O.tmp
is-2JHOH.tmp
is-PDNH2.tmp
is-80I9I.tmp
is-C7OHH.tmp
is-DO5C1.tmp
is-EN3BD.tmp
is-QGO3U.tmp
is-00NDL.tmp
is-3F130.tmp
is-SH1IT.tmp
is-0FAGU.tmp
is-76B65.tmp
is-QKTO5.tmp
is-45MID.tmp
is-6NDDS.tmp
is-5HRRE.tmp
is-9HO92.tmp
is-2IULE.tmp
is-NRKEF.tmp
is-THVSI.tmp
is-C5QLA.tmp
is-DRNNC.tmp
is-TABF8.tmp
is-CLDL8.tmp
is-E7A88.tmp
is-MFL7F.tmp
is-2C04P.tmp
is-HILOR.tmp
is-K02TJ.tmp
is-OTKTE.tmp
is-SEBP5.tmp
is-VUT1M.tmp
is-ERJL2.tmp
is-LJRPP.tmp
is-1LBE3.tmp
is-E99TP.tmp
is-N5SNP.tmp
is-55N54.tmp
is-G2HJK.tmp
is-L1G2S.tmp
is-801OL.tmp
is-JQJD1.tmp
is-4LDUT.tmp
is-NII21.tmp
is-V1JN9.tmp
is-JTNQV.tmp
is-MIQBO.tmp
is-BR7GA.tmp
is-OUHDI.tmp
is-G63D8.tmp
is-Q9ARN.tmp
is-6E2F9.tmp
is-DEEO7.tmp
is-27LBC.tmp
is-DT0GE.tmp
is-VNVGM.tmp
is-GVHF0.tmp
is-NDG5D.tmp
is-ROKVB.tmp
is-BBAP3.tmp
is-LTUN4.tmp
is-SQ014.tmp
is-1TPI9.tmp
is-BHKFP.tmp
is-F4F0K.tmp
is-C6F62.tmp
is-LC1TK.tmp
is-S5C0I.tmp
is-FU8M6.tmp
is-OBUOK.tmp
is-V4MK3.tmp
is-4RBJ1.tmp
is-ST59N.tmp
is-9PRPH.tmp
is-PFUJF.tmp
is-4K513.tmp
is-DKFL6.tmp
is-NSR0T.tmp
is-HRMF4.tmp
is-RE268.tmp
is-C0GVQ.tmp
is-DB0D6.tmp
is-RSHG2.tmp
is-0R8KQ.tmp
is-2H9T1.tmp
is-8OF2A.tmp
is-3GCIL.tmp
is-AUV96.tmp
is-RTBA0.tmp
is-382I6.tmp
is-P71LG.tmp
is-TMNOC.tmp
is-LLQ9M.tmp
is-P1QUE.tmp
is-QL7VE.tmp
is-31FTH.tmp
is-63JN4.tmp
is-TUMDR.tmp
is-5FUGN.tmp
is-HVFR6.tmp
is-SRKL8.tmp
is-COU55.tmp
is-KDAHL.tmp
is-VBDK6.tmp
is-2O6H3.tmp
is-SCH06.tmp
is-CJC1D.tmp
is-ENTI2.tmp
is-M2K98.tmp
is-4R9FG.tmp
is-6KB74.tmp
is-K5608.tmp
is-EJQ9U.tmp
is-SH2OR.tmp
is-UFU9S.tmp
is-00TUK.tmp
is-B6U28.tmp
is-LVC1L.tmp
is-3IR68.tmp
is-MTH8D.tmp
is-OIT0T.tmp
is-63CH9.tmp
is-CUCKK.tmp
is-QUAQS.tmp
is-OKDGJ.tmp
is-TC8HK.tmp
is-A5F88.tmp
is-BDCK5.tmp
is-EIVQ0.tmp
is-DS9N9.tmp
is-FJQ9J.tmp
is-KRH2S.tmp
is-3J3GD.tmp
is-BRTHT.tmp
is-L002B.tmp
is-62GVU.tmp
is-6MHPL.tmp
is-9PK1L.tmp
is-9T96J.tmp
is-NCNC3.tmp
is-4HR63.tmp
is-GJAR7.tmp
is-ID4SM.tmp
is-6BLES.tmp
is-8RGG2.tmp
is-61369.tmp
is-F0TG4.tmp
is-SPUB5.tmp
is-AMJCK.tmp
is-G74J9.tmp
is-JELDT.tmp
is-1CLKQ.tmp
is-1UFP4.tmp
is-HTNH8.tmp
is-G3Q4F.tmp
is-HLSD3.tmp
is-RAARF.tmp
is-DV6SO.tmp
is-SDG1G.tmp
is-D3ETG.tmp
is-QSLN0.tmp
is-R4G8C.tmp
is-MF0B6.tmp
is-N1G8J.tmp
is-OGAG4.tmp
is-KOP1D.tmp
is-NQ5UP.tmp
is-FM8VP.tmp
is-LBLNA.tmp
is-4QSA2.tmp
is-O918G.tmp
is-C7M0P.tmp
is-NS775.tmp
is-EKSNU.tmp
is-VMA0C.tmp
is-ETQPB.tmp
is-ULHLR.tmp
is-0ICT0.tmp
is-6J3OJ.tmp
is-IOGLV.tmp
is-86T1T.tmp
is-A0B9J.tmp
is-FDHE9.tmp
is-FECBP.tmp
is-CHFEE.tmp
is-OICDE.tmp
is-48RGS.tmp
is-CP7DO.tmp
is-FGL4A.tmp
is-0KOEL.tmp
is-GMM08.tmp
is-MS666.tmp
is-047K7.tmp
is-796UN.tmp
is-QISSF.tmp
is-D8FD9.tmp
is-HGDHT.tmp
is-NMQJ1.tmp
is-CFQF9.tmp
is-GHI1C.tmp
is-3UUHK.tmp
is-DLO41.tmp
is-8AINF.tmp
is-PSBGV.tmp
is-QIKE5.tmp
is-RUFJ9.tmp
is-6O2DC.tmp
is-TRH73.tmp
is-KV5HN.tmp
is-RGQSQ.tmp
is-VCJ9H.tmp
is-2GHQP.tmp
is-73QCS.tmp
is-OGIIK.tmp
is-RL57V.tmp
is-T959A.tmp
is-1LF24.tmp
is-L05SJ.tmp
is-I6NI7.tmp
is-TDFJ3.tmp
is-0068D.tmp
is-B0BB3.tmp
is-SRAUU.tmp
is-02URV.tmp
is-8S8MV.tmp
is-L2IN8.tmp
is-LMN3S.tmp
is-3UV7N.tmp
is-57AQB.tmp
is-3888B.tmp
is-L7A5J.tmp
is-O6GE6.tmp
is-DPF8B.tmp
is-QT6TR.tmp
is-8IK3B.tmp
is-PFRLA.tmp
is-RF7PK.tmp
is-7BBLC.tmp
is-EUTSU.tmp
is-4VLTS.tmp
is-G826O.tmp
is-HK1DU.tmp
is-J0RGQ.tmp
is-5VOH6.tmp
is-IKUJU.tmp
is-K76IH.tmp
is-Q961H.tmp
is-8CS8S.tmp
is-N4FQS.tmp
is-CP21G.tmp
is-HDFL0.tmp
is-KNDFF.tmp
is-E5TAF.tmp
is-IU4BH.tmp
is-8JI52.tmp
is-OOQM2.tmp
is-R5MJA.tmp
is-FA0AM.tmp
is-G7QGR.tmp
is-N5C6N.tmp
is-S5MC3.tmp
is-3D2P3.tmp
is-DDLBD.tmp
is-U98LE.tmp
is-0992G.tmp
is-1FKK8.tmp
is-K0P48.tmp
is-17U8G.tmp
is-476H6.tmp
is-MJN2T.tmp
is-KS4G0.tmp
is-LSSHN.tmp
is-NLSBT.tmp
is-JENDK.tmp
is-K9M14.tmp
is-BJ4BB.tmp
is-EVKCM.tmp
is-TOB0H.tmp
is-3IFV9.tmp
is-4A002.tmp
is-7I3BI.tmp
is-2HCRA.tmp
is-6F4NN.tmp
is-9RQAV.tmp
is-2N970.tmp
is-GGTDO.tmp
is-30IOP.tmp
is-KO4PI.tmp
is-RC8MC.tmp
is-HV787.tmp
is-S3815.tmp
is-VPJTR.tmp
is-CJVHV.tmp
is-E0E55.tmp
is-LT5R9.tmp
is-21PO4.tmp
is-3DJ96.tmp
is-Q0BFJ.tmp
is-22DUA.tmp
is-64TI6.tmp
is-9778S.tmp
is-2IOK0.tmp
is-4R9QG.tmp
is-GGKPO.tmp
is-FCATO.tmp
is-GV4LN.tmp
is-5VH0J.tmp
is-8MJES.tmp
is-CPTEK.tmp
is-5DDSE.tmp
is-BQC6I.tmp
is-O6M14.tmp
is-E5RCS.tmp
is-NSV72.tmp
is-V65CS.tmp
is-141S9.tmp
is-M75OT.tmp
is-ME7D7.tmp
is-2TUU6.tmp
is-II17S.tmp
is-OOB4J.tmp
is-8I1PS.tmp
is-G4R3J.tmp
is-ULSHC.tmp
is-53GHH.tmp
is-633T0.tmp
is-PO4H2.tmp
is-2HC6M.tmp
is-B3HVU.tmp
is-L4MIR.tmp
is-K0BAQ.tmp
is-LGPK6.tmp
is-6MQMS.tmp
is-KQTVA.tmp
is-KU1L1.tmp
is-9C8IR.tmp
is-UVK5M.tmp
is-97MM3.tmp
is-D9CAM.tmp
is-Q1GAQ.tmp
is-2U2B2.tmp
is-KB4RV.tmp
is-PA39Q.tmp
is-N9S9I.tmp
is-QT0HM.tmp
is-UT9RP.tmp
is-J2VJQ.tmp
is-M8TOE.tmp
is-SD6AJ.tmp
is-I3HH1.tmp
is-JGGBV.tmp
is-5T4A3.tmp
is-8IKAB.tmp
is-EHFJJ.tmp
is-IUH3R.tmp
is-V6K59.tmp
is-CIMN5.tmp
is-KETS3.tmp
is-2C36R.tmp
is-HR2SC.tmp
is-OCS7F.tmp
is-UVM7P.tmp
is-8DGRL.tmp
is-GROQ7.tmp
is-N8KHP.tmp
is-6F49R.tmp
is-BJMR9.tmp
is-66ORL.tmp
is-AS40U.tmp
is-QRO5G.tmp
is-TFGBS.tmp
is-29NRU.tmp
is-O5RM0.tmp
is-64BGI.tmp
is-MSUPQ.tmp
is-G8GVP.tmp
is-QN58I.tmp
is-37AG2.tmp
is-5DCEO.tmp
is-3FBVU.tmp
is-4TAAD.tmp
is-D8Q3U.tmp
is-L45H4.tmp
is-R6TVJ.tmp
is-7E4PN.tmp
is-APEUG.tmp
is-C2O17.tmp
is-4NETO.tmp
is-M2GR5.tmp
is-942E3.tmp
is-P1KAU.tmp
is-OR0HF.tmp
is-M7G43.tmp
is-TQVP4.tmp
is-AFMGH.tmp
is-8LPJH.tmp
is-2RV6A.tmp
is-0F0AC.tmp
is-1IODP.tmp
is-P73GL.tmp
is-1MKNH.tmp
is-QTV0I.tmp
is-PC12E.tmp
is-JSG9J.tmp
is-A3FHH.tmp
is-4IEEF.tmp
is-VO2I7.tmp
is-5A0J4.tmp
is-224I1.tmp
is-V0EQQ.tmp
is-L7O4S.tmp
is-BN9M0.tmp
is-4LCQQ.tmp
is-QF40C.tmp
is-R2466.tmp
is-UHREU.tmp
is-DJJHJ.tmp
is-UVE5T.tmp
is-D8405.tmp
is-SD0NN.tmp
is-GLNK7.tmp
is-IA7JF.tmp
is-HA3VI.tmp
is-LEDKR.tmp
is-7I8NT.tmp
is-E7QRJ.tmp
is-3VTN1.tmp
is-6AV50.tmp
is-Q3IBG.tmp
is-E7PM7.tmp
is-QG0QL.tmp
is-G0PN4.tmp
is-J244I.tmp
is-FEGCA.tmp
is-BV89O.tmp
is-GKDUN.tmp
is-34OJ9.tmp
is-RGRQF.tmp
is-CLD91.tmp
is-JN194.tmp
is-7VMM5.tmp
is-B49RD.tmp
is-S40V4.tmp
is-V5KR1.tmp
is-DQ8V6.tmp
is-234KM.tmp
is-UKTA3.tmp
is-5UM9U.tmp
is-1M74L.tmp
is-0UVA9.tmp
is-6FNLB.tmp
is-NNQTH.tmp
is-9NGJE.tmp
is-MKTNL.tmp
is-4L7KT.tmp
is-E6CPQ.tmp
is-CG8PA.tmp
is-NTVTT.tmp
is-JBUTH.tmp
is-IG0TP.tmp
is-KBQOH.tmp
is-TACLH.tmp
is-OO3EA.tmp
is-84JK9.tmp
is-V0TFA.tmp
is-I7D24.tmp
is-7HUGU.tmp
is-U9V6A.tmp
is-NIHA8.tmp
is-TD1CK.tmp
is-H4SVK.tmp
is-445D4.tmp
is-TFC7F.tmp
is-OHCD5.tmp
is-DESK2.tmp
is-DMLKA.tmp
is-UG2DU.tmp
is-2J955.tmp
is-M17T5.tmp
is-9PJBL.tmp
is-KNF50.tmp
is-5QV98.tmp
is-3UHAI.tmp
is-68ES6.tmp
is-86AI8.tmp
is-ANJVJ.tmp
is-CJLHQ.tmp
is-RF8K5.tmp
is-11LLE.tmp
is-L2ADG.tmp
is-G8ODE.tmp
is-JPCQG.tmp
is-HNSOJ.tmp
is-AK67P.tmp
is-9RLAD.tmp
is-V25R2.tmp
is-30DIK.tmp
is-L5QU4.tmp
is-DLK4U.tmp
is-7AOP6.tmp
is-GN2UM.tmp
is-K29ED.tmp
is-3BNSC.tmp
is-DMNEH.tmp
Clockwise rotate to zoom in 2.conf
Fly in and Fly out.conf
Wham!.conf
Zoom out 1.conf
is-01FF4.tmp
is-0DQKO.tmp
is-0LJNS.tmp
is-100HI.tmp
is-12800.tmp
is-2E749.tmp
is-2MHKI.tmp
is-2RRPU.tmp
is-2T5KL.tmp
is-2TH21.tmp
is-32T3Q.tmp
is-3KCHV.tmp
is-4JP2L.tmp
is-50UCN.tmp
is-50VAN.tmp
is-5E8TS.tmp
is-6CE10.tmp
is-6HQOF.tmp
is-7MLEG.tmp
is-7RPMK.tmp
is-7SI11.tmp
is-7T2V4.tmp
is-8ACD4.tmp
is-9DMCV.tmp
is-9GMG2.tmp
is-9SG5P.tmp
is-9T8QR.tmp
is-A5V41.tmp
is-AUF84.tmp
is-B8CGB.tmp
is-BETEO.tmp
is-C02UV.tmp
is-C2S3C.tmp
is-CC4J3.tmp
is-DLAB2.tmp
is-DQRN8.tmp
is-DSTOO.tmp
is-DU10L.tmp
is-EAJ49.tmp
is-EI63P.tmp
is-F65R9.tmp
is-FB069.tmp
is-FCQH7.tmp
is-FDB74.tmp
is-FN9C0.tmp
is-GNI1O.tmp
is-GTB9C.tmp
is-HPC7U.tmp
is-HSCN0.tmp
is-JM76L.tmp
is-JUAO0.tmp
is-KP06V.tmp
is-KP8ST.tmp
is-L15EI.tmp
is-L5SKI.tmp
is-LQUJ8.tmp
is-MKT6I.tmp
is-MV93V.tmp
is-N55C5.tmp
is-NM40G.tmp
is-O1ALS.tmp
is-OBSJI.tmp
is-OQ68K.tmp
is-OUA41.tmp
is-P0DLH.tmp
is-P28CP.tmp
is-P5I1G.tmp
is-RJBL9.tmp
is-S1NJC.tmp
is-S5SOL.tmp
is-SK713.tmp
is-TMR3Q.tmp
is-TPLA9.tmp
is-V1NTF.tmp
is-VHEK0.tmp
is-VU6IH.tmp
is-0BR11.tmp
is-2BL25.tmp
is-86MV3.tmp
is-8EBHE.tmp
is-A9J3V.tmp
is-D19Q9.tmp
is-MTPDC.tmp
is-3TSQA.tmp
is-IHMC8.tmp
is-J6BH7.tmp
is-U1AOL.tmp
is-TLTIV.tmp
is-VBLSA.tmp
is-9E04O.tmp
is-AOIUK.tmp
is-I5GKH.tmp
resinfo.json
is-S3SAD.tmp
is-TM2C3.tmp
is-AH7MF.tmp
is-CQV2G.tmp
is-EHG5M.tmp
is-JE52T.tmp
is-QEIN7.tmp
is-HGO82.tmp
is-9F2KE.tmp
is-388BL.tmp
is-DF5TU.tmp
is-I56GM.tmp
is-PJH2J.tmp
is-EOK1B.tmp
is-FIHLE.tmp
is-JONT4.tmp
is-IPPJS.tmp
is-N1MMO.tmp
is-JFMRE.tmp
is-EBO16.tmp
is-HTDDD.tmp
is-1O1GO.tmp
is-QMS0M.tmp
is-HOMCI.tmp
data.xml
is-IQ12N.tmp
is-SSVHF.tmp
is-9R4JI.tmp
is-NV5N6.tmp
is-MMQ7M.tmp
is-Q4JHB.tmp
is-PUNLU.tmp
is-07GI5.tmp
is-0V9PE.tmp
is-6K012.tmp
is-RRFNF.tmp
is-NP8OQ.tmp
is-C12LM.tmp
is-J4RLB.tmp
is-QULVT.tmp
is-4MKHT.tmp
is-F5RU7.tmp
is-91HMV.tmp
is-5SQQV.tmp
is-89TO7.tmp
is-1JUOO.tmp
is-7782L.tmp
is-5SJOD.tmp
is-HS7QF.tmp
is-DVKF1.tmp
is-HT595.tmp
is-JAPC0.tmp
is-3P5RE.tmp
is-1TKES.tmp
is-EGMF8.tmp
is-775DF.tmp
is-EK925.tmp
is-BR3G1.tmp
is-P1CIJ.tmp
is-OQQHN.tmp
is-3MB8H.tmp
is-FGT2R.tmp
is-0QLFL.tmp
is-2LJU0.tmp
is-R5ACV.tmp
is-RFPS2.tmp
is-1SASM.tmp
is-6GQA2.tmp
is-TMJ08.tmp
is-4BGFC.tmp
is-9KLSC.tmp
is-VEJ3K.tmp
is-1QO73.tmp
is-UJOKK.tmp
is-A255I.tmp
is-OLVSF.tmp
data.xml
is-JQ97G.tmp
is-1H32U.tmp
is-B7CAA.tmp
is-VIA6G.tmp
is-JHM7O.tmp
is-DMBJ8.tmp
is-I1S6U.tmp
is-K2KCJ.tmp
is-NLEP5.tmp
is-UN299.tmp
is-09PG2.tmp
is-FR218.tmp
is-RAR3F.tmp
is-8D8BO.tmp
is-D027F.tmp
is-1Q1D8.tmp
is-CAQID.tmp
is-MPILE.tmp
is-FQMIS.tmp
is-2BBDA.tmp
is-651LN.tmp
is-JHVL2.tmp
is-IE6S2.tmp
is-NN9I6.tmp
is-08B29.tmp
is-0RL57.tmp
is-0U5CO.tmp
is-163PB.tmp
is-19F2R.tmp
is-27TSE.tmp
is-2EQQ4.tmp
is-2LJ91.tmp
is-2M4FO.tmp
is-2OGQ9.tmp
is-2STE4.tmp
is-2TBDG.tmp
is-2VOBO.tmp
is-31FJR.tmp
is-38Q17.tmp
is-40L9V.tmp
is-4DSD7.tmp
is-4KL5D.tmp
is-4L040.tmp
is-4NSFR.tmp
is-4PM8B.tmp
is-52K92.tmp
is-556MJ.tmp
is-589HC.tmp
is-5APCB.tmp
is-5SVO7.tmp
is-60UNR.tmp
is-6338Q.tmp
is-6QSOB.tmp
is-7HE4U.tmp
is-7VIP2.tmp
is-8U3D8.tmp
is-95BIS.tmp
is-9FKR4.tmp
is-9GP3M.tmp
is-9QTD6.tmp
is-A4A2T.tmp
is-AIH98.tmp
is-BK8PU.tmp
is-C45PL.tmp
is-C5UET.tmp
is-D7HIK.tmp
is-DOJSD.tmp
is-E4QK3.tmp
is-F5KFD.tmp
is-F64IT.tmp
is-F7D7G.tmp
is-FMUIM.tmp
is-G0F79.tmp
is-HAC6V.tmp
is-HAPHB.tmp
is-I0KQC.tmp
is-ID425.tmp
is-IGB8V.tmp
is-J8SNA.tmp
is-JBK7I.tmp
is-K7TIV.tmp
is-K8M7A.tmp
is-KC08N.tmp
is-KCMP5.tmp
is-L2SFV.tmp
is-L7EQR.tmp
is-LDU3J.tmp
is-LN4O3.tmp
is-LQ930.tmp
is-MGDOD.tmp
is-MI8SV.tmp
is-MLBBA.tmp
is-MR0VO.tmp
is-N6JH9.tmp
is-N8Q6S.tmp
is-O8BJ7.tmp
is-OCTH9.tmp
is-OE6C9.tmp
is-OELLF.tmp
is-ON3L5.tmp
is-PN5D5.tmp
is-PNNMG.tmp
is-POL6F.tmp
is-Q0B2J.tmp
is-RU2K8.tmp
is-S7RIO.tmp
is-SHQEO.tmp
is-SI2Q3.tmp
is-SJLJ9.tmp
is-SN91F.tmp
is-T3UMP.tmp
is-TDT4I.tmp
is-TQ0BC.tmp
is-TQTA6.tmp
is-TSE46.tmp
is-U6J8C.tmp
is-U9C6D.tmp
is-UN7UR.tmp
is-V7P1K.tmp
is-VFK4K.tmp
is-VGJ5J.tmp
is-VH850.tmp
is-VN5BA.tmp
is-8FGHR.tmp
is-9HEH6.tmp
is-BRBM2.tmp
is-D6I9U.tmp
is-D6LDM.tmp
is-GQGOJ.tmp
is-SUS8F.tmp
is-U2EU1.tmp
is-UQMCT.tmp
is-V5HD4.tmp
Text style 4.conf
is-05S63.tmp
is-0S4AK.tmp
is-1PGPC.tmp
is-302NV.tmp
is-3OTCH.tmp
is-3QSMT.tmp
is-4G85L.tmp
is-4KL21.tmp
is-4U5JO.tmp
is-58BDN.tmp
is-5CIMO.tmp
is-5RTMF.tmp
is-5VI54.tmp
is-6TJRG.tmp
is-79C43.tmp
is-878FJ.tmp
is-8Q1L3.tmp
is-8RJIB.tmp
is-8UOJT.tmp
is-924FJ.tmp
is-9SJN2.tmp
is-A09FR.tmp
is-AHD8E.tmp
is-AV7SR.tmp
is-BSV31.tmp
is-C0LLC.tmp
is-C5G5A.tmp
is-CAFNF.tmp
is-CNFI6.tmp
is-E8M5A.tmp
is-FE2O1.tmp
is-FNIB6.tmp
is-FU761.tmp
is-GILEM.tmp
is-H0NI3.tmp
is-H7T52.tmp
is-IM1ND.tmp
is-ISH8C.tmp
is-J0DKO.tmp
is-JS6QH.tmp
is-K77ET.tmp
is-K97TV.tmp
is-LDIMU.tmp
is-LKNU3.tmp
is-MMCCV.tmp
is-MO2C9.tmp
is-MOKRE.tmp
is-MQKOV.tmp
is-NIVBE.tmp
is-NPFCS.tmp
is-NRE56.tmp
is-O64CA.tmp
is-OA4V3.tmp
is-Q0VDA.tmp
is-QGB6F.tmp
is-QH9ML.tmp
is-RE6OP.tmp
is-RN0SG.tmp
is-S03LU.tmp
is-SLMER.tmp
is-SR1UE.tmp
is-SULSE.tmp
is-T8PCJ.tmp
is-TB95P.tmp
is-UJU1D.tmp
is-UNECA.tmp
is-UP5I5.tmp
is-UPJIR.tmp
is-V2SLD.tmp
is-VNPSG.tmp
is-VR9EF.tmp
is-VTGFQ.tmp
is-V7FC1.tmp
is-4AG0A.tmp
is-H5U5M.tmp
is-RKHLQ.tmp
is-2FEDD.tmp
is-67M4T.tmp
is-HCPAM.tmp
is-R2PCG.tmp
is-S8SFN.tmp
coremediaserver.exe
is-5KJ9L.tmp
wsUpgrade.log
magic_xe_supported_detect.exe
ofx_check.exe
is-2O1S0.tmp
is-ASQV2.tmp
is-E6GP0.tmp
is-HS0PL.tmp
is-Q3882.tmp
GoPro Hero 5 Black_1080_M.xml
is-34EK9.tmp
is-362KL.tmp
is-3BIEB.tmp
is-63N4L.tmp
is-6HJGT.tmp
is-7CGQA.tmp
is-7HKQF.tmp
is-BCC2F.tmp
is-D5JDM.tmp
is-DK71O.tmp
is-F0SPB.tmp
is-FA6QS.tmp
is-GUHQB.tmp
is-H8FBK.tmp
is-IHBIM.tmp
is-JQ4H0.tmp
is-JVK6P.tmp
is-SKIQQ.tmp
is-TGFFB.tmp
is-MQJV8.tmp
is-0AIDN.tmp
is-B4IKA.tmp
is-FF4SK.tmp
is-HP2B5.tmp
is-F3DJE.tmp
is-PM2M6.tmp
is-QI2G6.tmp
is-N54KB.tmp
is-2MEQO.tmp
is-EEFLD.tmp
is-4THOM.tmp
is-0GGLG.tmp
is-27B7H.tmp
is-9628P.tmp
is-IR6J4.tmp
is-0R8K3.tmp
is-IFVGD.tmp
is-TT955.tmp
is-8737I.tmp
is-EMQ7L.tmp
is-9JGFS.tmp
is-624JU.tmp
is-0CIQI.tmp
is-8NCDC.tmp
is-5EA0K.tmp
is-UFCKN.tmp
is-1KAJC.tmp
is-0F47B.tmp
is-43APA.tmp
is-50R76.tmp
is-5VLPQ.tmp
is-94V29.tmp
is-99Q6F.tmp
is-DBS9B.tmp
is-F1RA6.tmp
is-SHNIA.tmp
is-5L4BV.tmp
is-GKI9C.tmp
is-CU8UN.tmp
is-N8ONV.tmp
is-0BMVV.tmp
is-0HPN4.tmp
is-14KSR.tmp
is-26MQ6.tmp
is-3M0AA.tmp
is-5JD2Q.tmp
is-9QMDK.tmp
is-CGGU1.tmp
is-FD6VS.tmp
is-FRMN1.tmp
is-GLU8Q.tmp
is-I4QUO.tmp
is-I7RUU.tmp
is-K2FCP.tmp
is-LHMO1.tmp
is-N1JI9.tmp
is-S6I18.tmp
is-TQBOK.tmp
is-UDJVE.tmp
is-ISAL2.tmp
is-QHBO9.tmp
is-5F61O.tmp
is-N25D5.tmp
is-9QDEN.tmp
is-3TDFH.tmp
is-9RDL3.tmp
is-N0KD9.tmp
is-701BU.tmp
is-B95I0.tmp
is-NOUJ1.tmp
is-TH3UP.tmp
is-45ENI.tmp
is-F4KJF.tmp
is-K5KGO.tmp
is-6BTSS.tmp
is-FGSSK.tmp
is-PD4O5.tmp
is-7S0J9.tmp
is-S7S5M.tmp
is-P7N8J.tmp
is-KR1GH.tmp
is-67B4H.tmp
is-49GLQ.tmp
is-E0GCS.tmp
is-IQLGO.tmp
is-QUHEC.tmp
is-BU63C.tmp
is-VC0V9.tmp
is-DLNEH.tmp
is-M2H3K.tmp
is-DV7VH.tmp
is-H73OL.tmp
is-C5PEF.tmp
is-AQ9JO.tmp
is-JE2M0.tmp
is-MRIT4.tmp
is-B4BSS.tmp
is-QC2BC.tmp
is-1B7SH.tmp
is-EGQTC.tmp
is-OACQA.tmp
is-UM44Q.tmp
is-J94MU.tmp
is-5U0LH.tmp
is-7CIRJ.tmp
is-TCGH7.tmp
is-FI46E.tmp
is-2B7GT.tmp
is-2JUGH.tmp
is-DLDFI.tmp
is-LAP6Q.tmp
is-964PH.tmp
is-G9R2H.tmp
is-JVMFK.tmp
is-KBR3R.tmp
is-551IC.tmp
is-V1F4S.tmp
is-PT6GP.tmp
is-Q20PD.tmp
is-S7P60.tmp
is-8R9KP.tmp
is-BO1L1.tmp
is-BRBJL.tmp
is-5UPSN.tmp
is-0EQ8A.tmp
is-0UMP1.tmp
is-3A16V.tmp
is-JMRT0.tmp
is-AVIJ6.tmp
is-J9B4E.tmp
is-J4943.tmp
is-KF7P4.tmp
is-6R550.tmp
is-KBNN0.tmp
is-H4CT5.tmp
is-LNT8S.tmp
is-80736.tmp
is-DN7N6.tmp
is-JCVA0.tmp
is-S155A.tmp
wes_black_list.json
Wondershare Filmora Launcher.exe
WsNativePushService.exe
WsToastNotification.exe
is-Q5H1O.tmp
categoryTree.json
communityCategoryTree.json
Manos Mars - The Tunning.mp3
resinfo.json
thumbnail.png
Blur.conf
data.xml
filter.xml
resinfo.json
thumbnail.png
resinfo.json
Canvas.cl
Canvas.conf
Canvas.frag
filter.xml
sketch.png
detail.json
resinfo.json
thumbnail.png
Chromatic Aberration.cl
Chromatic Aberration.conf
Chromatic Aberration.frag
filter.xml
detail.json
resinfo.json
thumbnail.png
detail.json
resinfo.json
thumbnail.png
is-V2M7L.tmp
is-DTFDR.tmp
is-PJQ16.tmp
resinfo.json
is-OU8D1.tmp
resinfo.json
resinfo.json
is-0P1I9.tmp
is-3O7M9.tmp
is-IDFS9.tmp
is-TE81I.tmp
is-2SVPL.tmp
is-3A486.tmp
resinfo.json
is-U98PC.tmp
is-OVJIJ.tmp
is-NNH8O.tmp
is-AJ2LK.tmp
resinfo.json
is-HM182.tmp
is-SCJAN.tmp
da7c232d4b37f1eba7629daafcc8e430_0.png
a68ccacf26e1f9c48f2ec68d869da1dc.zip
resinfo.json
1155cec6be51369c6c16e5f26114820c.zip
roiBlur.frag
8c2832ac233c04ba2769a934f86a60a5_0.png
thumbnail.png
resinfo.json
1d1efa732cadcaae337aba4990d11ca1.zip
TVWall.conf
TVWall.frag
filter10.cl
96fd19522fd019bf73a283c987c2dd2a_0.png
resinfo.json
c39f85329af005e3ed9ed19e338dbf19_0.png
preview.png
d6eac34c275d0ff7c0c3bbce76596d56.zip
RGB_Stroke.cl
RGB_Stroke.conf
RGB_Stroke.frag
filter.xml
version.md
resinfo.json
21be7a6485f3cca0dffc2f01e9691dc6.zip
data.xml
resinfo.json
1df8369284cd62f21000fcde1a8a53ee.zip
thumbnail.png
thumbnail.png
ca8228e7986e7be7e3f92ca61cdba3c9.zip
extra.json
timeline.wesproj
resinfo.json
FilmoraSettings.xml
ShortcutSetting.xml
e5c4bf9.msi
memory/1408-19255-0x0000000000400000-0x00000000004F2000-memory.dmp
memory/1408-18756-0x0000000000400000-0x00000000004F2000-memory.dmp
memory/1884-57-0x0000000000400000-0x000000000046C000-memory.dmp
memory/1884-24336-0x0000000000400000-0x000000000046C000-memory.dmp
memory/1884-4685-0x0000000000400000-0x000000000046C000-memory.dmp
memory/2724-7353-0x0000000000400000-0x000000000046C000-memory.dmp
memory/2724-2792-0x0000000000400000-0x000000000046C000-memory.dmp
memory/2724-24521-0x0000000000400000-0x000000000046C000-memory.dmp
memory/3120-5010-0x0000000000400000-0x000000000046C000-memory.dmp
memory/3120-11233-0x0000000000400000-0x000000000046C000-memory.dmp
memory/3120-24743-0x0000000000400000-0x000000000046C000-memory.dmp
memory/3392-22-0x0000000003F40000-0x0000000003F55000-memory.dmp
memory/3392-38-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-24776-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-11895-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-957-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-961-0x0000000003F40000-0x0000000003F55000-memory.dmp
memory/3392-24779-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-42-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-39-0x0000000003F40000-0x0000000003F55000-memory.dmp
memory/3392-5352-0x0000000003F40000-0x0000000003F55000-memory.dmp
memory/3392-40-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3392-5351-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-17722-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-19312-0x0000000000400000-0x0000000000572000-memory.dmp
memory/3392-6-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/3392-20476-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4152-19254-0x0000000000400000-0x0000000000731000-memory.dmp
memory/4224-24262-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4224-10401-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4224-20134-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4224-19253-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4224-16834-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4224-4686-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4224-24335-0x0000000000400000-0x0000000000572000-memory.dmp
memory/4336-24811-0x0000000000400000-0x000000000046C000-memory.dmp
memory/4336-0-0x0000000000400000-0x000000000046C000-memory.dmp
memory/4336-37-0x0000000000400000-0x000000000046C000-memory.dmp
memory/4472-24925-0x00007FFAEA720000-0x00007FFAEAC61000-memory.dmp
memory/4472-24957-0x00007FF6AFE10000-0x00007FF6B088C000-memory.dmp
memory/4472-24923-0x00007FFAE2CA0000-0x00007FFAE3B91000-memory.dmp
memory/4472-24956-0x00007FFAE9BB0000-0x00007FFAEA051000-memory.dmp
memory/4472-24961-0x00007FFADEFB0000-0x00007FFAE008F000-memory.dmp
memory/4472-24924-0x00007FFAE8660000-0x00007FFAE8CA3000-memory.dmp
memory/4472-24926-0x00007FFAE1A90000-0x00007FFAE1E69000-memory.dmp
memory/4472-24959-0x00007FFAE1430000-0x00007FFAE1A84000-memory.dmp
memory/4472-24960-0x00007FFAE1E70000-0x00007FFAE2C93000-memory.dmp
memory/4472-24962-0x00007FFADD290000-0x00007FFADE526000-memory.dmp
memory/4472-24921-0x00007FFAE9910000-0x00007FFAE9BAD000-memory.dmp
memory/4472-24922-0x00007FFAE9420000-0x00007FFAE968A000-memory.dmp
memory/4472-24958-0x00007FFAE3BA0000-0x00007FFAE4884000-memory.dmp
memory/4952-25020-0x00007FFAEA720000-0x00007FFAEAC61000-memory.dmp
memory/4952-25021-0x00007FFADEFB0000-0x00007FFAE008F000-memory.dmp
memory/4952-25023-0x00007FFAE1430000-0x00007FFAE1A84000-memory.dmp
memory/5044-18843-0x0000000000400000-0x0000000000572000-memory.dmp
memory/5044-19772-0x0000000000400000-0x0000000000572000-memory.dmp
memory/5044-24520-0x0000000000400000-0x0000000000572000-memory.dmp
memory/5044-7612-0x0000000000400000-0x0000000000572000-memory.dmp
memory/5044-15066-0x0000000000400000-0x0000000000572000-memory.dmp
memory/5044-22433-0x0000000000400000-0x0000000000572000-memory.dmp
memory/6076-17724-0x0000000000400000-0x0000000000572000-memory.dmp
memory/6076-19315-0x0000000000400000-0x0000000000572000-memory.dmp
memory/6076-11897-0x0000000000400000-0x0000000000572000-memory.dmp
memory/6076-24742-0x0000000000400000-0x0000000000572000-memory.dmp
memory/6076-24386-0x0000000000400000-0x0000000000572000-memory.dmp
memory/6076-20478-0x0000000000400000-0x0000000000572000-memory.dmp