Edit tour

Windows Analysis Report
filmora-idco_setup_full1901.exe

Overview

General Information

Sample name:	filmora-idco_setup_full1901.exe
Analysis ID:	1428767
MD5:	aeb7797267cb552cf82e0348c985543e
SHA1:	a080667a17d09a4e6b333c6a99a528c75e9da468
SHA256:	b26919b9167cc1ac3c06ff8b2506ff50b23ffa346b9203cafce3972f702fe31e
Infos:

Detection

Score:	14
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	48
Range:	0 - 100

Signatures

Sigma detected: Execution from Suspicious Folder

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w10x64_ra

filmora-idco_setup_full1901.exe (PID: 7016 cmdline: "C:\Users\user\Desktop\filmora-idco_setup_full1901.exe" MD5: AEB7797267CB552CF82E0348C985543E)

NFWCHK.exe (PID: 6168 cmdline: C:\Users\Public\Documents\Wondershare\NFWCHK.exe MD5: 27CFB3990872CAA5930FA69D57AEFE7B)

conhost.exe (PID: 6160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, CommandLine: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, NewProcessName: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, OriginalFileName: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, ParentCommandLine: "C:\Users\user\Desktop\filmora-idco_setup_full1901.exe", ParentImage: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe, ParentProcessId: 7016, ParentProcessName: filmora-idco_setup_full1901.exe, ProcessCommandLine: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, ProcessId: 6168, ProcessName: NFWCHK.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Source: filmora-idco_setup_full1901.exe, 00000000.00000000.1119233376.00000000003CA000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_db5fc684-b

Compliance

Uses 32bit PE files

Source: filmora-idco_setup_full1901.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: filmora-idco_setup_full1901.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: filmora-idco_setup_full1901.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: G:\devops_yanfa\workspace\p-4663c901377d457795e7a5c44ce670aa\src\bin\WAE_ENG.pdb source: filmora-idco_setup_full1901.exe
Source:	Binary string: G:\devops_yanfa\workspace\p-4663c901377d457795e7a5c44ce670aa\src\bin\WAE_ENG.pdbn" source: filmora-idco_setup_full1901.exe
Source:	Binary string: E:\MobileGo\Trunk\PC\Setup\Framework_Lite\DotNetChecker\obj\x86\Release\NFWCHK.pdb source: filmora-idco_setup_full1901.exe, NFWCHK.exe.0.dr

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 23.34.82.12 23.34.82.12
Source: Joe Sandbox View	IP Address: 47.254.80.199 47.254.80.199

Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.34.82.12/cbs_down/filmora-idco_64bit_full1901.exe
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.34.82.12/cbs_down/filmora-idco_64bit_full1901.exey
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.34.82.26/cbs_down/filmora-idco_64bit_full1901.exe
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/in
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://download.wondershare.com/inst/NetFxLite.exe
Source: filmora-idco_setup_full1901.exe, 00000000.00000003.1980986954.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A48000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A8C000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down
Source: filmora-idco_setup_full1901.exe, 00000000.00000003.1900772172.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2386212187.000000000BE90000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1913987875.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1918842662.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1971922486.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1976584877.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1883788985.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1927103496.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1909528066.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1922570929.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1931777431.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1905075119.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1980986954.000000000BE93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down.exe
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bi
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_
Source: filmora-idco_setup_full1901.exe, wsWAE.log.0.dr	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exe
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeS
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeSY
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeSl
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeSr:
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.execom
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exewin_x64
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down1
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_down3
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_downP
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2386212187.000000000BE90000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1971922486.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1976584877.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1980986954.000000000BE93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_downexe
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_downm
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_downo;
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_downp
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.net/cbs_downq
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://platform.wondershare.cc
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.cc/
Source: filmora-idco_setup_full1901.exe, 00000000.00000003.1151227324.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign=
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pop.wondersha
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://pop.wondershare.com/filmora-license.html
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: filmora-idco_setup_full1901.exe, 00000000.00000003.2068524982.000000000BFD6000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.2032533661.000000000F0F4000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.2045645040.000000000BF73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://223.5.5.5
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://223.5.5.5Mzc4Miop0xjZfMjQzNzgwOTYzOTcyMTg4MTY=&uid=/resolve?type=1&short=1&name=&ak=&key=&ts
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://223.6.6.6
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://analytics.300624.com:8106/sa?project=
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.300624.com:8106/sa?project=UA_Wae_Web
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://analytics.wondershare.cc:8106/sa?project=
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.wondershare.cc:8106/sa?project=UA_Wae_Web
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.wondershare.cc:8106/sa?project=UA_Wae_Web:
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://analytics.wondershare.cc:8106/sa?project=https://analytics.300624.com:8106/sa?project=downlo
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.wond
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://download.wondershare.net/cbs_down/filmora-idco_full1901.exe
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.wondershare.net/cbs_down/filmora-idco_full1901.exey
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://filmora.wondershare.net/install/filmora-win-idco.html?act=install
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filmora.wondershare.net/install/filmora-win-idco.html?act=installap
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://pc-api.300624.com
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://pc-api.wondershare.cc
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://prod-web.wondershare.cc/api/v1/prodweb/trk&os=Windows
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://wae.tmp
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://www.wondershare.com/company/end-user-license-agreement.html
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://www.wondershare.com/privacy.html
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/privacy.htmle.html

System Summary

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

Process Stats: CPU usage > 24%

Detected potential crypto function

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Code function: 2_2_00007FFEC92C6DF4		2_2_00007FFEC92C6DF4
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Code function: 2_2_00007FFEC92C90B0		2_2_00007FFEC92C90B0

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Documents\Wondershare\NFWCHK.exe 43881549228975C7506B050BCE4D9B671412D3CDC08C7516C9DBBB7F50C25146

PE file contains executable resources (Code or Archives)

Source: filmora-idco_setup_full1901.exe	Static PE information: Resource name: EXE type: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: filmora-idco_setup_full1901.exe	Static PE information: Resource name: ZIPRES type: Zip archive data, at least v2.0 to extract, compression method=deflate

Sample file is different than original file name gathered from version info

Source: filmora-idco_setup_full1901.exe, 00000000.00000000.1119294056.0000000000429000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNFWCHK.exe0 vs filmora-idco_setup_full1901.exe
Source: filmora-idco_setup_full1901.exe	Binary or memory string: OriginalFilenameNFWCHK.exe0 vs filmora-idco_setup_full1901.exe

Uses 32bit PE files

Source: filmora-idco_setup_full1901.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean14.winEXE@4/76@0/6

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

File created: C:\Users\Public\Documents\Wondershare\

Jump to behavior

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6160:120:WilError_03

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

File created: C:\Users\user\AppData\Local\Temp\Wondershare

Jump to behavior

Source: filmora-idco_setup_full1901.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: filmora-idco_setup_full1901.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.72%

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: filmora-idco_setup_full1901.exe	String found in binary or memory: <?xml version="1.0" encoding="UTF-8"?> <config> <Status>1</Status> <JoinExp>1</JoinExp> <SelectLang>English</SelectLang> <InstallPath>C:\Users\user\AppData\Local\</InstallPath> <AgreeExtInstall>1</AgreeExtInstall> </config>
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: https://filmora.wondershare.net/install/filmora-win-idco.html?act=install
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: C:\Users\user\AppData\Local\</InstallPath>
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: dir=[%s]prodstarttimeprodstartcode&product_version=&installtime=&m_nProductID=client_sign=;[WARN] %d - jump url=[%s] is invalid.&?[WARN] %d - thanks url=[%s] is invalid.&?thank_you_pagepagedownloader_web1browserdownpackage_pagepagedownloader_webretrycbs_down[INFO] %d - set select lang=[%s].\\\\[INFO] %d - BuildInstallPara, common./VERYSILENT /NOPAGE [INFO] %d - BuildInstallPara, product startup=[%d]..logWAE-" /LOG="/VERYSILENT /NOPAGE /LANG=" /WAEWIN= /DIR="" /installpath: " /PID=[INFO] %d - BuildInstallPara product arg.token /TOKEN_PRODUCTINSTALL_ARG= /NOTRUN[INFO] %d - BuildInstallPara dependent startup=[%d]..log" /WAEWIN=WAE- /LOG="/VERYSILENT /NOPAGE /LANG= /PID=" /DIR="" /installpath: "[INFO] %d - BuildInstallPara dependent arg.token /TOKEN_PRODUCTINSTALL_ARG= /NOTRUN" /HOSTINFOPATH="3264[INFO] %d - BuildProductAndDepentTask, bit=[%s] package.64downpackagebits32downpackagebitsstartupproduct1[INFO] %d - BuildProductAndDepentTask, use local x86 down url.1[INFO] %d - BuildProductAndDepentTask, use local x64 down url.[INFO] %d - query package size=[%I64u] by domain_url.[WARN] %d - dir=[%s], disk_free_size=[%lld],,true[INFO] %d - already install wcc.1.NET Frameworkdotnetver[INFO] %d - PrepareDown0[INFO] %d - set host hwnd=[%x].-startmodel:floatmode[INFO] %d - startup wcc ret=[%d]:
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: dir=[%s]prodstarttimeprodstartcode&product_version=&installtime=&m_nProductID=client_sign=;[WARN] %d - jump url=[%s] is invalid.&?[WARN] %d - thanks url=[%s] is invalid.&?thank_you_pagepagedownloader_web1browserdownpackage_pagepagedownloader_webretrycbs_down[INFO] %d - set select lang=[%s].\\\\[INFO] %d - BuildInstallPara, common./VERYSILENT /NOPAGE [INFO] %d - BuildInstallPara, product startup=[%d]..logWAE-" /LOG="/VERYSILENT /NOPAGE /LANG=" /WAEWIN= /DIR="" /installpath: " /PID=[INFO] %d - BuildInstallPara product arg.token /TOKEN_PRODUCTINSTALL_ARG= /NOTRUN[INFO] %d - BuildInstallPara dependent startup=[%d]..log" /WAEWIN=WAE- /LOG="/VERYSILENT /NOPAGE /LANG= /PID=" /DIR="" /installpath: "[INFO] %d - BuildInstallPara dependent arg.token /TOKEN_PRODUCTINSTALL_ARG= /NOTRUN" /HOSTINFOPATH="3264[INFO] %d - BuildProductAndDepentTask, bit=[%s] package.64downpackagebits32downpackagebitsstartupproduct1[INFO] %d - BuildProductAndDepentTask, use local x86 down url.1[INFO] %d - BuildProductAndDepentTask, use local x64 down url.[INFO] %d - query package size=[%I64u] by domain_url.[WARN] %d - dir=[%s], disk_free_size=[%lld],,true[INFO] %d - already install wcc.1.NET Frameworkdotnetver[INFO] %d - PrepareDown0[INFO] %d - set host hwnd=[%x].-startmodel:floatmode[INFO] %d - startup wcc ret=[%d]:
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: <Url_Install><![CDATA[https://filmora.wondershare.net/install/filmora-win-idco.html?act=install]]></Url_Install>
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: </Installurl>
Source: filmora-idco_setup_full1901.exe	String found in binary or memory: <InstallTime>240</InstallTime>

Source: unknown	Process created: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe "C:\Users\user\Desktop\filmora-idco_setup_full1901.exe"
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Process created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Process created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Jump to behavior

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4657278A-411B-11d2-839A-00C04FD918D0}\InProcServer32

Jump to behavior

Uses Rich Edit Controls

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: filmora-idco_setup_full1901.exe

Static PE information: certificate valid

PE file has a big code size

Source: filmora-idco_setup_full1901.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: filmora-idco_setup_full1901.exe

Static file information: File size 1995256 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

PE file has a big raw section

Source: filmora-idco_setup_full1901.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x138400

PE file contains a mix of data directories often seen in goodware

Source: filmora-idco_setup_full1901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: filmora-idco_setup_full1901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: filmora-idco_setup_full1901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: filmora-idco_setup_full1901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: filmora-idco_setup_full1901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: filmora-idco_setup_full1901.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: filmora-idco_setup_full1901.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: filmora-idco_setup_full1901.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: G:\devops_yanfa\workspace\p-4663c901377d457795e7a5c44ce670aa\src\bin\WAE_ENG.pdb source: filmora-idco_setup_full1901.exe
Source:	Binary string: G:\devops_yanfa\workspace\p-4663c901377d457795e7a5c44ce670aa\src\bin\WAE_ENG.pdbn" source: filmora-idco_setup_full1901.exe
Source:	Binary string: E:\MobileGo\Trunk\PC\Setup\Framework_Lite\DotNetChecker\obj\x86\Release\NFWCHK.pdb source: filmora-idco_setup_full1901.exe, NFWCHK.exe.0.dr

PE file contains a valid data directory to section mapping

Source: filmora-idco_setup_full1901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: filmora-idco_setup_full1901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: filmora-idco_setup_full1901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: filmora-idco_setup_full1901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: filmora-idco_setup_full1901.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00D6126A push esi; retf	0_2_00D61279
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA3ECD push eax; retf	0_2_00CA3ECE
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA0AD1 push eax; retf	0_2_00CA0AD2
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA0CD5 push esi; retf	0_2_00CA0CD6
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA54E9 push ebp; retf 0000h	0_2_00CA553E
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA1E89 push ds; retf 0000h	0_2_00CA1E8A
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA5489 push esp; retf 0000h	0_2_00CA5496
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA0AA9 push cs; retf 0000h	0_2_00CA0AAA
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA10B0 push ecx; retf	0_2_00CA10B2
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA0CB1 push esp; retf	0_2_00CA0CB2
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00C934B4 push edx; retf	0_2_00C934CA
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA106F push ebx; retf	0_2_00CA1072
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA0E63 push cs; retf 0000h	0_2_00CA0E66
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA1660 push ss; retf 0000h	0_2_00CA1662
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA1005 push cs; retf 0000h	0_2_00CA1026
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA1031 push ecx; retf	0_2_00CA1032
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA09CD push ebp; retf	0_2_00CA09D6
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA0FE4 push ebx; retf	0_2_00CA0FF2
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00C9A797 push C700001Bh; ret	0_2_00C9A7C1
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA09A4 push ebp; retf	0_2_00CA09B6
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA53BD push ebx; retf 0000h	0_2_00CA53BE
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA3F5D push ebx; retf	0_2_00CA3F5E
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00C97D67 push ss; retf	0_2_00C97D6A
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00CA0D31 push esp; retf	0_2_00CA0D32
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00C748F8 pushfd ; iretd	0_2_00C748F9
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_00C7265D push esi; retf	0_2_00C7265E
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_05A832A1 push eax; iretd	0_2_05A832A2
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_05A83275 push eax; iretd	0_2_05A83276
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_05A6A305 push ecx; iretd	0_2_05A6A317
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_05A6A48E push edi; iretd	0_2_05A6A4B4
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Code function: 0_2_05A6A311 push ecx; iretd	0_2_05A6A317

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

File created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Memory allocated: 54C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Memory allocated: 1560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Memory allocated: 3330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Memory allocated: 1B330000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 7200000	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 7200000	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

Window / User API: threadDelayed 8030

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe TID: 7036	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe TID: 7040	Thread sleep time: -77100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe TID: 7108	Thread sleep time: -71400000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe TID: 7040	Thread sleep time: -14400000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe TID: 7108	Thread sleep time: -14400000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe TID: 7036	Thread sleep time: -2409000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe TID: 6276	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe TID: 6332	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 7200000	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Thread delayed: delay time: 7200000	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: filmora-idco_setup_full1901.exe	Binary or memory string: Hyper-V RAW
Source: filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

Process created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_64\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\filmora-idco_setup_full1901.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
filmora-idco_setup_full1901.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Documents\Wondershare\NFWCHK.exe	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://23.34.82.26/cbs_down/filmora-idco_64bit_full1901.exe	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://223.5.5.5	filmora-idco_setup_full1901.exe	false	unknown
http://download.wondershare.net/cbs_downo;	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://platform.wondershare.cc/	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	filmora-idco_setup_full1901.exe, 00000000.00000003.2068524982.000000000BFD6000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.2032533661.000000000F0F4000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.2045645040.000000000BF73000.00000004.00000020.00020000.00000000.sdmp	false	high
https://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	filmora-idco_setup_full1901.exe	false	high
http://download.wondershare.com/in	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	false	high
http://23.34.82.12/cbs_down/filmora-idco_64bit_full1901.exe	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://filmora.wondershare.net/install/filmora-win-idco.html?act=install	filmora-idco_setup_full1901.exe	false	high
http://download.wondershare.net/cbs_down	filmora-idco_setup_full1901.exe, 00000000.00000003.1980986954.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A48000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A8C000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A41000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exewin_x64	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A10000.00000004.00000020.00020000.00000000.sdmp	false	high
https://prod-web.wondershare.cc/api/v1/prodweb/trk&os=Windows	filmora-idco_setup_full1901.exe	false	high
http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeSY	filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exe	filmora-idco_setup_full1901.exe, wsWAE.log.0.dr	false	high
https://pc-api.wondershare.cc	filmora-idco_setup_full1901.exe	false	high
http://download.wondershare.net/cbs_downq	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://analytics.300624.com:8106/sa?project=UA_Wae_Web	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://analytics.wondershare.cc:8106/sa?project=	filmora-idco_setup_full1901.exe	false	high
http://pop.wondersha	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://download.wondershare.net/cbs_downm	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_downp	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.wondershare.com/privacy.html	filmora-idco_setup_full1901.exe	false	high
https://223.5.5.5Mzc4Miop0xjZfMjQzNzgwOTYzOTcyMTg4MTY=&uid=/resolve?type=1&short=1&name=&ak=&key=&ts	filmora-idco_setup_full1901.exe	false	low
http://download.wondershare.net/cbs_down/filmora-idco_64bit_	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeSl	filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.wondershare.com/company/end-user-license-agreement.html	filmora-idco_setup_full1901.exe	false	high
http://platform.wondershare.cc	filmora-idco_setup_full1901.exe	false	high
https://curl.se/docs/http-cookies.html	filmora-idco_setup_full1901.exe	false	unknown
http://download.wondershare.net/cbs_downP	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign=	filmora-idco_setup_full1901.exe, 00000000.00000003.1151227324.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	false	high
https://download.wond	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://curl.se/docs/alt-svc.html	filmora-idco_setup_full1901.exe	false	unknown
https://filmora.wondershare.net/install/filmora-win-idco.html?act=installap	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A10000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pc-api.300624.com	filmora-idco_setup_full1901.exe	false	unknown
https://analytics.wondershare.cc:8106/sa?project=UA_Wae_Web	filmora-idco_setup_full1901.exe, filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	false	high
https://analytics.wondershare.cc:8106/sa?project=https://analytics.300624.com:8106/sa?project=downlo	filmora-idco_setup_full1901.exe	false	high
https://analytics.300624.com:8106/sa?project=	filmora-idco_setup_full1901.exe	false	unknown
https://download.wondershare.net/cbs_down/filmora-idco_full1901.exey	filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_down.exe	filmora-idco_setup_full1901.exe, 00000000.00000003.1900772172.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000002.2386212187.000000000BE90000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1913987875.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1918842662.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1971922486.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1976584877.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1883788985.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1927103496.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1909528066.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1922570929.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1931777431.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1905075119.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1980986954.000000000BE93000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.com/inst/NetFxLite.exe	filmora-idco_setup_full1901.exe	false	high
https://wae.tmp	filmora-idco_setup_full1901.exe	false	unknown
http://download.wondershare.net/cbs_down1	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.execom	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A10000.00000004.00000020.00020000.00000000.sdmp	false	high
http://pop.wondershare.com/filmora-license.html	filmora-idco_setup_full1901.exe	false	high
http://download.wondershare.net/cbs_down3	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005ACB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_downexe	filmora-idco_setup_full1901.exe, 00000000.00000002.2386212187.000000000BE90000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1971922486.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1976584877.000000000BE93000.00000004.00000020.00020000.00000000.sdmp, filmora-idco_setup_full1901.exe, 00000000.00000003.1980986954.000000000BE93000.00000004.00000020.00020000.00000000.sdmp	false	high
https://analytics.wondershare.cc:8106/sa?project=UA_Wae_Web:	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.wondershare.com/privacy.htmle.html	filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C70000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeSr:	filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	high
http://download.wondershare.net/cbs_down/filmora-idco_64bit_full1901.exeS	filmora-idco_setup_full1901.exe, 00000000.00000002.2380025162.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	false	high
https://223.6.6.6	filmora-idco_setup_full1901.exe	false	unknown
http://23.34.82.12/cbs_down/filmora-idco_64bit_full1901.exey	filmora-idco_setup_full1901.exe, 00000000.00000002.2384496374.0000000005A66000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://download.wondershare.net/cbs_down/filmora-idco_64bi	filmora-idco_setup_full1901.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
47.251.49.246	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
23.34.82.12	unknown	United States	25019	SAUDINETSTC-ASSA	false
47.254.80.199	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
23.34.82.26	unknown	United States	25019	SAUDINETSTC-ASSA	false
47.88.57.97	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428767
Start date and time:	2024-04-19 15:38:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	filmora-idco_setup_full1901.exe
Detection:	CLEAN
Classification:	clean14.winEXE@4/76@0/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 57% Number of executed functions: 53 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target NFWCHK.exe, PID 6168 because it is empty
Execution Graph export aborted for target filmora-idco_setup_full1901.exe, PID 7016 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: filmora-idco_setup_full1901.exe

Simulations

Behavior and APIs

Time	Type	Description
15:38:53	API Interceptor	4760125x Sleep call for process: filmora-idco_setup_full1901.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
47.251.49.246	recoverit_setup_full4134.exe	Get hash	malicious	Unknown	Browse
47.251.49.246	https://drfoneair.wondershare.com/	Get hash	malicious	Unknown	Browse
23.34.82.12	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	osvpYbj9SC.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	e0Ae1lY8DL.exe	Get hash	malicious	Unknown	Browse
	BtO55PhUbM.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	Payment Advice Batch#876756.jpeg .SVG	Get hash	malicious	AgentTesla, HTMLPhisher	Browse
	ODDBALL0.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
47.254.80.199	recoverit_setup_full4134.exe	Get hash	malicious	Unknown	Browse
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://www.edrawmax.com/online/share.html?code=6ff2799ebde611ee80880a54be41f961	Get hash	malicious	Unknown	Browse
	https://tracedm-ap-southeast-1.aliyun.com/trace/v1/report?bid=20221123&env=17870283361186532041&mac=73310&mf=pdfcloud%40mail-service.wondershare.com&msgid=ee12d1b7-58c3-4a31-b3d2-3d27cc17b3b2%40alibaba.com&sac=0&tag=API&tid=task20221123&to=john%40jrgrif.com.au&tpl=&ts=1669185545&type=0&url=https%3A%2F%2Fdocumentcloud.wondershare.com%2Fshare%2Freview%2F4TOdulHoE4tDDJkYojwSieEYmk6u5ppAEg8icFW9-omyLzIMpcz1BrmzGLoJZVTVdt_NTVnv_nNTApsf2vDh6A%3Flang%3Den-us&v=1.0&sign=3d00d92ef44c0af98c6f2c3fd80b2aa4	Get hash	malicious	Unknown	Browse
	https://www.hipdf.com/download-file?share_id=TJFSlUuhm3TrYHMFvuLGhA	Get hash	malicious	Unknown	Browse
	https://www.hipdf.com/download-file?share_id=TJFSlUuhm3TrYHMFvuLGhA	Get hash	malicious	Unknown	Browse
23.34.82.26	BtO55PhUbM.exe	Get hash	malicious	Unknown	Browse
47.88.57.97	recoverit_setup_full4134.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	2.jpg.exe	Get hash	malicious	CobaltStrike, Metasploit, ReflectiveLoader	Browse	8.218.236.5
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	47.246.136.185
	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Get hash	malicious	Unknown	Browse	47.243.79.202
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	47.241.21.33
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	8.220.102.72
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	8.218.15.223
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	47.252.147.82
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	8.222.72.244
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	2.jpg.exe	Get hash	malicious	CobaltStrike, Metasploit, ReflectiveLoader	Browse	8.218.236.5
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	47.246.136.185
	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Get hash	malicious	Unknown	Browse	47.243.79.202
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	47.241.21.33
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	8.220.102.72
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	8.218.15.223
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	47.252.147.82
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	8.222.72.244
SAUDINETSTC-ASSA	czEunnbk7b.elf	Get hash	malicious	Mirai	Browse	159.47.222.152
	Gq7FlDf6cE.elf	Get hash	malicious	Mirai	Browse	178.86.249.202
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	142.247.166.28
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	212.118.147.131
	vEnh6fr6F0.elf	Get hash	malicious	Unknown	Browse	159.42.98.189
	szBCKC8yTb.elf	Get hash	malicious	Mirai	Browse	37.105.134.66
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse	23.34.82.23
	d94i39z585.elf	Get hash	malicious	Mirai	Browse	170.101.238.219
	x86.elf	Get hash	malicious	Mirai	Browse	178.86.249.223
	2EFEN3j6ml.elf	Get hash	malicious	Unknown	Browse	95.184.102.145
SAUDINETSTC-ASSA	czEunnbk7b.elf	Get hash	malicious	Mirai	Browse	159.47.222.152
	Gq7FlDf6cE.elf	Get hash	malicious	Mirai	Browse	178.86.249.202
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	142.247.166.28
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	212.118.147.131
	vEnh6fr6F0.elf	Get hash	malicious	Unknown	Browse	159.42.98.189
	szBCKC8yTb.elf	Get hash	malicious	Mirai	Browse	37.105.134.66
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse	23.34.82.23
	d94i39z585.elf	Get hash	malicious	Mirai	Browse	170.101.238.219
	x86.elf	Get hash	malicious	Mirai	Browse	178.86.249.223
	2EFEN3j6ml.elf	Get hash	malicious	Unknown	Browse	95.184.102.145
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	2.jpg.exe	Get hash	malicious	CobaltStrike, Metasploit, ReflectiveLoader	Browse	8.218.236.5
	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	47.246.136.185
	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Get hash	malicious	Unknown	Browse	47.243.79.202
	PO_La-Tanerie04180240124.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	4XAsw9FSr5.elf	Get hash	malicious	Unknown	Browse	47.241.21.33
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	8.220.102.72
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	8.218.15.223
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	47.252.147.82
	16rBksY5gH.elf	Get hash	malicious	Mirai	Browse	8.222.72.244

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Documents\Wondershare\NFWCHK.exe	recoverit_setup_full4134.exe	Get hash	malicious	Unknown	Browse
	Filmora-Wondershare-Installer.exe	Get hash	malicious	SERVHELPER	Browse
	ViJoy.exe	Get hash	malicious	SERVHELPER	Browse
	filmora_64bit_setup_full1083.exe	Get hash	malicious	Unknown	Browse
	drfone_backup_setup_full3369.exe	Get hash	malicious	Unknown	Browse
	recoverit_setup_full4153.exe	Get hash	malicious	Unknown	Browse
	win-drfone_setup_full3360.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.201546276827661
Encrypted:	false
SSDEEP:	48:6xtpP1w73SSxzvevFTFaWuJkJS6WiSf8wp5THVe6VoVDV+VgIV2VrV6VZVClVRw+:s1G3Nz2tH1WT/+TuzyRv2/oqeD+zNt
MD5:	27CFB3990872CAA5930FA69D57AEFE7B
SHA1:	5E1C80D61E8DB0CDC0C9B9FA3B2E36D156D45F8F
SHA-256:	43881549228975C7506B050BCE4D9B671412D3CDC08C7516C9DBBB7F50C25146
SHA-512:	A1509024872C99C1CF63F42D9F3C5F063AFDE4E9490C21611551DDD2322D136CE9240256113C525305346CF7B66CCCA84C3DF67637C8FECBFEEBF14FFA373A2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: recoverit_setup_full4134.exe, Detection: malicious, Browse Filename: Filmora-Wondershare-Installer.exe, Detection: malicious, Browse Filename: ViJoy.exe, Detection: malicious, Browse Filename: filmora_64bit_setup_full1083.exe, Detection: malicious, Browse Filename: drfone_backup_setup_full3369.exe, Detection: malicious, Browse Filename: recoverit_setup_full4153.exe, Detection: malicious, Browse Filename: win-drfone_setup_full3360.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......U............................>0... ...@....@.. ....................................@................................../..K....@.......................`......h/............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ 0......H........!...............................................................0..W.......(....(....(....(....(....(....(....(....(....(....(.........r...p.o....(....(..................;;......V....s....&rA..p(....Fs....&r...p(....Fs....&r...p(....Fs....&rG..p(....Fs....&r...p(....Fs....&r...p(....Fs....&re..p(.....r...p(....Fs....&r...p(....Fs....&rm..p(....Fs....&rm..p(......(....*BSJB............v2.0.50727......l.......#~..4.......#Strings............#US.........#GUI

C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.885882229328509
Encrypted:	false
SSDEEP:	6:TMVBdTtdcIjkfVymRMT4/0xvFM7VNQAlk7V2b5DuACQIT:TMHdRd9ofVymhsvFKzlJ5D9CxT
MD5:	5BABF2A106C883A8E216F768DB99AD51
SHA1:	F39E84A226DBF563BA983C6F352E68D561523C8E
SHA-256:	9E676A617EB0D0535AC05A67C0AE0C0E12D4E998AB55AC786A031BFC25E28300
SHA-512:	D4596B0AAFE03673083EEF12F01413B139940269255D10256CF535853225348752499325A5DEF803FA1189E639F4A2966A0FBB18E32FE8D27E11C81C9E19A0BB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<configuration>. <startup useLegacyV2RuntimeActivationPolicy="true">. <supportedRuntime version="v2.0.50727"/>. <supportedRuntime version="v4.0"/>. </startup>.</configuration>

C:\Users\Public\Documents\Wondershare\WAE_DOWNTASK_1901.xml

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	XML 1.0 document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	231
Entropy (8bit):	5.057140645816762
Encrypted:	false
SSDEEP:	6:TMVBd//l4McSaXfvO6uRN23hZ384Lkb4Xu:TMHdHl4zvvL338pbWu
MD5:	5A524D7178A0AD7E93057AE4F6E4DEE1
SHA1:	A17B5AC52A0744754F4AD07508CF2ECD5D783F4C
SHA-256:	D66C1CB6C4136C49EABDA7414FE0D5F156ADBA0771C0C415375C4598C812D969
SHA-512:	2F841EE0D933CF83E6A4ECD384F39465AC3CED78023F7882F217B3569C7605E4CE127CC60F2420BC27CF4CE2C5FAEDB6DFC0EABAE4A02E3D01E9AC5911A06538
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<config>..<Status>1</Status>..<JoinExp>1</JoinExp>..<SelectLang>English</SelectLang>..<InstallPath>C:\Users\user\AppData\Local\</InstallPath>..<AgreeExtInstall>1</AgreeExtInstall>..</config>..

C:\Users\Public\Documents\Wondershare\filmora-idco_64bit_full1901.exe.~P2S

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	data
Category:	dropped
Size (bytes):	541451636
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D8CB2A263850170444C84A6040C49FD1
SHA1:	0FBE43E80C638AB0F8D80DB5CB0CB40FC5401FED
SHA-256:	D81923C8A9067E8633F59D0043913FB857720B9DF0FF75863BD6D38EC2D51200
SHA-512:	271124B961079258A7A141DFF6D8D4780696F18831713D40B09357E152058B48EE34F0AFD3539F55C399F235B689227DCA5293486297DB3E4446ACD1D8DBB43F
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Reputation:	low
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-04-19 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Reputation:	low
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-04-20 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Reputation:	low
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-04-24 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Reputation:	low
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-02 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Reputation:	low
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-02.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Reputation:	low
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-03 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Reputation:	low
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-04 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-05 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-06 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-07 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-09 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-13 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-14 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-15 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-16 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-17 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-18 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-19 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-22 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-24 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-25 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-26 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-27 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3126
Entropy (8bit):	5.268366129060765
Encrypted:	false
SSDEEP:	96:oLHQMqGpQbRSW71G5KjLOmVeQIGUlwLmrCrSGOD:QtqGpQFn71YKjPJIzlwLmeO/D
MD5:	16A55B1E259AB28A918D25A3A047B44C
SHA1:	CEF2457E47C8362C452BB9D585CBEC4C6E067F6A
SHA-256:	D0F4313058DAAD9B910E10033769216E464D28D276DEF180A9DC9637F306F739
SHA-512:	07F32B36F62D9DFEE53A8A538217B5D3C5202BC15C89121DD9F5334B1D0F774E37B16F56EEE18C048D54AD53FD11ED48394FC4BA76126970EEED8D47C701A62C
Malicious:	false
Preview:	[2024-04-24 7:29:42] [INFO] 7020 - OnClick install...[2024-04-24 7:29:42] [INFO] 7156 - sensors, event=[downloader_click]...[2024-04-24 7:29:42] [INFO] 7020 - server_ver=[], installed_ver=[], cmp=[0]..[2024-04-24 7:29:42] [INFO] 7020 - check install path, begin...[2024-04-24 7:29:42] [INFO] 7020 - check install path, end ret=[1]...[2024-04-24 7:29:42] [INFO] 7020 - install path=[C:\Users\user\AppData\Local]...[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, call wae mgr...[2024-04-24 7:39:43] [INFO] 3880 - lang_name=[English], lang_code=[ENG]..[2024-04-24 7:39:43] [INFO] 3880 - BuildInstallPara, product startup=[1]...[2024-04-24 7:39:43] [INFO] 3880 - WaeMgr StartDownTask: 1901, C:\Users\Public\Documents\Wondershare\, , ,..[2024-04-24 7:39:43] [INFO] 3880 - WriteRunConfig..[2024-04-24 7:39:43] [INFO] 7036 - handle type=[0], pid=[1901], taskid=[0]..[2024-04-24 7:39:43] [INFO] 3880 - WaeWnd Download, create install thread...[2024-04-

C:\Users\user\AppData\Local\Temp\wsduilib.log

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-19 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-20 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-21 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-22 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-23 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-24 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-25 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-25.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-28 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-28.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-29 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-29.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-30 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-04-30.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-02 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-02.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-02.2 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-03 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-03.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-04 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-05 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-06 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-07 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-07.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-08 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-09 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-09.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-12 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-13 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-13.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-14 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-14.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-15 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-16 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-16.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-17 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-17.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-19 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-22 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-22.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-23 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-24 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-24.1 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-25 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-26 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

C:\Users\user\AppData\Local\Temp\wsduilib.log.2024-05-27 (copy)

Download File

Process:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	34776
Entropy (8bit):	4.863728047712355
Encrypted:	false
SSDEEP:	48:ojctjX/N+S7Mk88mYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYXbbbq+Zut:oA7Mkdut
MD5:	C92E8F0A7ABE56FA9B3C79CB1C7F3CB2
SHA1:	74924219AB9668B8A79CA1898405A619D42A61DE
SHA-256:	CF6A166CB25AB3823AA379F28AAE976C7239266070F70842476FFA2C50CF5C9D
SHA-512:	EC87F57EA578B183B5B77334C9DC48ADAEC22D8D19F3CD3AE28287D776233A5EFF3B2E907D745D62935F138CC4351D373ADFD6F49CEC90B3F4412526826347DA
Malicious:	false
Preview:	[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 1..[2024-04-19 16:13:53] [INFO] 7020 - OnCreate 3..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 1..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:skin.xml, (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 2..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create:(null), (null)..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 4..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 6..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 7..[2024-04-19 16:13:53] [INFO] 7020 - CDialogBuilder::Create 9..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 0..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStdStringPtrMap::Find_: 83, 1..[2024-04-19 16:13:53] [INFO] 7020 - CStd

\Device\ConDrv

Download File

Process:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	531
Entropy (8bit):	4.535782341778288
Encrypted:	false
SSDEEP:	12:E29002CF2ukjF26K9P2yr2UO02im/e4/2q8326K9w26K97:f90PVvM6KYyiUGi5q8G6KR6Kl
MD5:	253AA8FA326429A98BF3147D3AF60BBD
SHA1:	483404DCC5C7BFCB7D78C4131042FA6961E9A6D8
SHA-256:	7B3077115D1C499F3D4CC121237500803CD0CC49C460595EE7CC5EBD9BAB7E1B
SHA-512:	06AC0B813F854DF3EDA775ABEB71D02251334BC7CA62A6A6E1C60B9B304BF64E307179F556956C0D08B36CB4C678A42EDC6DCC69F77007D5D034D938C948B97D
Malicious:	false
Preview:	.Net Framework 2.0 System.Drawing is well....Net Framework 2.0 System.Xml is well....Net Framework 2.0 System.Windows.Forms is well....Net Framework 2.0 System.Configuration is well....Net Framework 2.0 System.Management is well....Net Framework 2.0 System.Transactions is well....Net Framework 2.0 System.Data is well....Net Framework 2.0 Accessibility is well....Net Framework 2.0 System.ServiceProcess is well....Net Framework 2.0 System.Configuration.Install is well....Net Framework 2.0 System.Configuration.Install is well...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.856534738347142
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.72% Win32 Executable (generic) a (10002005/4) 49.68% Windows ActiveX control (116523/4) 0.58% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	filmora-idco_setup_full1901.exe
File size:	1'995'256 bytes
MD5:	aeb7797267cb552cf82e0348c985543e
SHA1:	a080667a17d09a4e6b333c6a99a528c75e9da468
SHA256:	b26919b9167cc1ac3c06ff8b2506ff50b23ffa346b9203cafce3972f702fe31e
SHA512:	7545e8cabe300d2f2588861de74addd68b046de1e033a9f91696d68674ea682f629341ad627fc60b95c462b29232fec34e567fa340887e9e93a631c1127c3891
SSDEEP:	49152:BFwWwzOx2YlkXEYTy0iTvTEaMKCTZQCoNTZYgi6T:DPwzOPD0cEaqoNt
TLSH:	6795BF12BBC2C0B3E6B20271487667295EB9BE70573085CBA3D45E1D1E31AD2BD39367
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................9y..............z&........,.......-.....z&......z&...............Dg.....z&................,......G(............

File Icon


Icon Hash:	1f1b33134d312b0e

Static PE Info

General

Entrypoint:	0x5069f0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65A247A2 [Sat Jan 13 08:19:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f82f221937e6ca9e120ffb597da1ae7d

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	20/04/2022 02:00:00 06/04/2025 01:59:59
Subject Chain	CN="Wondershare Technology Group Co.,Ltd", O="Wondershare Technology Group Co.,Ltd", L=\u62c9\u8428\u5e02, S=\u897f\u85cf\u81ea\u6cbb\u533a, C=CN, SERIALNUMBER=91540195754285145H, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=\u897f\u85cf\u81ea\u6cbb\u533a, OID.1.3.6.1.4.1.311.60.2.1.3=CN
Version:	3
Thumbprint MD5:	547A43E2E4A99883FE2E25952664247A
Thumbprint SHA-1:	F61CA74F7B4B27007B4AE9825131DD6FB675B1D0
Thumbprint SHA-256:	9FD4A0B764D38473638CB73E7826E3887CBDCBE0ED5B7E21E1ED2441E1199F3C
Serial:	03E3821761E35A96B454DE9E4D5A5012

Entrypoint Preview

Instruction
call 00007FAD5D3BEFAEh
jmp 00007FAD5D3A7FC5h
push 00000014h
push 0058A448h
call 00007FAD5D3B876Fh
call 00007FAD5D3B34F9h
movzx esi, ax
push 00000002h
call 00007FAD5D3BEF41h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007FAD5D3A7FC6h
xor ebx, ebx
jmp 00007FAD5D3A7FF5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FAD5D3A7FADh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FAD5D3A7F9Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007FAD5D3A7FCBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007FAD5D3B6480h
test eax, eax
jne 00007FAD5D3A7FCAh
push 0000001Ch
call 00007FAD5D3A80A1h
pop ecx
call 00007FAD5D3B4F0Dh
test eax, eax
jne 00007FAD5D3A7FCAh
push 00000010h
call 00007FAD5D3A8090h
pop ecx
call 00007FAD5D3BEFBAh
and dword ptr [ebp-04h], 00000000h
call 00007FAD5D3B8AF1h
test eax, eax
jns 00007FAD5D3A7FCAh
push 0000001Bh
call 00007FAD5D3A8076h
pop ecx
call dword ptr [0053A300h]
mov dword ptr [005968C4h], eax
call 00007FAD5D3BEFD5h
mov dword ptr [00594550h], eax
call 00007FAD5D3BEB92h
test eax, eax
jns 00007FAD5D3A7FCAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[ C ] VS2010 SP1 build 40219
[C++] VS2013 build 21005
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18aee4	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x199000	0x3e778	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1e1e00	0x53f8	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1d8000	0x119f4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13a960	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x177248	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x177200	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13a000	0x848	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13832d	0x138400	143f1b9b34f6caae72118e0748e28ffa	False	0.5342078350180144	data	6.64488854015202	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13a000	0x53ab0	0x53c00	4a551f04364b8bbed6467d7ef02b18c6	False	0.359404151119403	data	5.396343868291315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x18e000	0x98e8	0x5600	589e498b6179834b38991067d58da005	False	0.2195221656976744	Matlab v4 mat-file (little endian) \315\314\014@, text, rows 1, columns 180, imaginary	4.183639853872594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x198000	0x11	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x199000	0x3e778	0x3e800	5de8416726c5df42dbec67c957e845f5	False	0.83195703125	data	7.664206010264442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1d8000	0x119f4	0x11a00	9098db0702c112fbb8946ecda5edd65b	False	0.5646470523049646	data	6.615266166313139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
EXE	0x199410	0x1c00	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows	English	United States	0.3685825892857143
PNG	0x19b010	0x812	PNG image data, 111 x 10, 8-bit/color RGBA, non-interlaced	English	United States	0.861568247821878
PNG	0x19b824	0x12678	PNG image data, 600 x 400, 8-bit/color RGBA, non-interlaced	English	United States	1.0004112278467578
XML	0x1ade9c	0x81d	XML 1.0 document, Unicode text, UTF-8 text	English	United States	0.44294655753490614
XML	0x1ae6bc	0xdf	XML 1.0 document, ASCII text	English	United States	0.6771300448430493
XML	0x1ae79c	0x1706	XML 1.0 document, ASCII text	English	United States	0.32694265354597896
ZIPRES	0x1afea4	0xc951	Zip archive data, at least v2.0 to extract, compression method=deflate	English	United States	0.8493703552787318
RT_ICON	0x1bc7f8	0x8004	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9953924081533015
RT_ICON	0x1c47fc	0xa5df	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9977627581659327
RT_ICON	0x1ceddc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.2782157676348548
RT_ICON	0x1d1384	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3712655601659751
RT_ICON	0x1d392c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.3602251407129456
RT_ICON	0x1d49d4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4523921200750469
RT_ICON	0x1d5a7c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5514184397163121
RT_ICON	0x1d5ee4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.601063829787234
RT_GROUP_ICON	0x1d634c	0x3e	data			0.8064516129032258
RT_GROUP_ICON	0x1d638c	0x3e	data	English	United States	0.8064516129032258
RT_VERSION	0x1d63cc	0xa3c	data	English	United States	0.34083969465648856
RT_MANIFEST	0x1d6e08	0x970	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2356), with CRLF line terminators	English	United States	0.3220198675496689

Imports

DLL	Import
COMCTL32.dll	InitCommonControlsEx, _TrackMouseEvent
WLDAP32.dll
CRYPT32.dll	CertAddCertificateContextToStore, CryptQueryObject, CryptDecodeObjectEx, CertFindExtension, CertFreeCertificateChain, CertFreeCertificateChainEngine, CertGetCertificateChain, CertCreateCertificateChainEngine, CertEnumCertificatesInStore, CertOpenStore, CryptStringToBinaryA, CertFindCertificateInStore, PFXImportCertStore, CertCloseStore, CertFreeCertificateContext
KERNEL32.dll	ReleaseMutex, CreateMutexW, CreateDirectoryW, GetFileAttributesW, LocalFileTimeToFileTime, SetFilePointer, SetFileTime, SystemTimeToFileTime, LocalFree, FormatMessageW, VerSetConditionMask, GetLocalTime, lstrcmpiW, lstrcpynW, lstrcpyW, SetLastError, FreeLibrary, GetSystemDirectoryA, LoadLibraryA, GetModuleHandleA, QueryPerformanceFrequency, SleepEx, QueryPerformanceCounter, VerifyVersionInfoA, GetEnvironmentVariableA, PeekNamedPipe, WaitForMultipleObjects, GetFileType, GetStdHandle, MoveFileExA, GetFileSizeEx, CreateFileA, GetDriveTypeW, GetCurrentProcess, GetLogicalDriveStringsW, GetDiskFreeSpaceExW, GetEnvironmentVariableW, SetErrorMode, CreateProcessW, LoadLibraryExW, GetExitCodeProcess, TerminateProcess, lstrcmpW, SetEndOfFile, TerminateThread, GetFileAttributesExW, CreateThread, SetFilePointerEx, SetFileAttributesW, EnterCriticalSection, SetEnvironmentVariableA, WriteConsoleW, InitializeSListHead, MulDiv, GetThreadTimes, GetFullPathNameW, SetStdHandle, ReadConsoleW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetModuleFileNameA, FlushFileBuffers, GetConsoleMode, GetConsoleCP, GetModuleHandleExW, GetCurrentThread, GetOEMCP, IsValidCodePage, EnumSystemLocalesW, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetStartupInfoW, UnhandledExceptionFilter, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, MoveFileExW, SystemTimeToTzSpecificLocalTime, FindClose, FindNextFileW, FindFirstFileExW, FileTimeToSystemTime, GetFileInformationByHandle, FileTimeToLocalFileTime, AreFileApisANSI, RtlUnwind, GetCommandLineA, GetCPInfo, ExitThread, IsProcessorFeaturePresent, IsDebuggerPresent, GetStringTypeW, EncodePointer, WideCharToMultiByte, GlobalAlloc, lstrlenW, GlobalUnlock, GlobalLock, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, GetSystemTimeAsFileTime, CloseHandle, SetEvent, WaitForSingleObject, GetTimeZoneInformation, GetProcAddress, GetCurrentThreadId, FindResourceW, LoadResource, SizeofResource, LockResource, FindResourceExW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, GetSystemDefaultLCID, GetModuleHandleW, GetTickCount, ReadFile, GetFileSize, GetCurrentDirectoryW, ExitProcess, GetACP, OutputDebugStringW, MultiByteToWideChar, Process32NextW, Process32FirstW, CreateToolhelp32Snapshot, DeleteFileW, CreateSemaphoreW, SetUnhandledExceptionFilter, FreeResource, OpenProcess, GetCurrentProcessId, GetModuleFileNameW, VirtualQuery, WriteFile, CreateFileW, lstrcatW, GetTempPathW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, Sleep, CreateEventW, GetNativeSystemInfo, GetVersionExW, LoadLibraryW, GetUserDefaultLCID
USER32.dll	DrawTextW, CharPrevW, AdjustWindowRectEx, GetPropW, SetPropW, GetMenu, EnableWindow, GetWindowRgn, GetClassInfoExW, RegisterClassExW, FillRect, SetRect, EqualRect, SetWindowTextW, GetWindowTextW, GetWindowTextLengthW, DestroyMenu, IsWindowEnabled, UpdateWindow, wsprintfA, DrawTextA, GetKeyboardLayout, GetKeyNameTextW, MapVirtualKeyExW, GetShellWindow, SendMessageW, ScreenToClient, GetWindowRect, SetWindowPos, GetDC, ReleaseDC, GetSystemMetrics, wsprintfW, MessageBoxW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, UpdateLayeredWindow, GetGUIThreadInfo, InvalidateRgn, CreateAcceleratorTableW, MoveWindow, ClientToScreen, GetCaretPos, SetCaretPos, GetWindowThreadProcessId, FindWindowW, GetLastActivePopup, PtInRect, LoadIconW, IsWindow, GetClassNameW, PostQuitMessage, GetCursorPos, IsIconic, ShowWindow, BringWindowToTop, SetForegroundWindow, SetActiveWindow, SetCursor, InflateRect, UnionRect, OffsetRect, LoadCursorW, IsZoomed, SetWindowRgn, GetClientRect, GetWindowLongW, SetWindowLongW, MonitorFromWindow, GetMonitorInfoW, GetMessageW, TranslateMessage, DispatchMessageW, PostMessageW, CreateWindowExW, DestroyWindow, IsWindowVisible, CharNextW, SetFocus, GetActiveWindow, GetFocus, GetKeyState, SetCapture, ReleaseCapture, SetTimer, KillTimer, BeginPaint, EndPaint, GetUpdateRect, InvalidateRect, MapWindowPoints, GetSysColor, IntersectRect, IsRectEmpty, GetParent, GetWindow, LoadImageW, DefWindowProcW, ShowCaret, HideCaret, GetCaretBlinkTime, CreateCaret, CallWindowProcW, RegisterClassW, EnableMenuItem
GDI32.dll	SetBitmapBits, GetBitmapBits, GetTextExtentPointA, PtInRegion, CreateRectRgn, CreatePatternBrush, GdiFlush, TextOutW, MoveToEx, GetObjectA, CreateDIBSection, SetTextColor, SetStretchBltMode, StretchBlt, SetBkMode, SetBkColor, ExtSelectClipRgn, SelectClipRgn, LineTo, GetClipBox, GetCharABCWidthsW, CreateSolidBrush, CreateRectRgnIndirect, CreatePenIndirect, CombineRgn, SetWindowOrgEx, GetObjectW, GetTextMetricsW, PlayEnhMetaFile, GetEnhMetaFileHeader, CreateEnhMetaFileW, CloseEnhMetaFile, SelectObject, SaveDC, RestoreDC, Rectangle, RemoveFontMemResourceEx, AddFontMemResourceEx, GetStockObject, GetDeviceCaps, DeleteDC, CreatePen, CreateFontIndirectW, CreateDIBitmap, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, DeleteObject, CreateRoundRectRgn, GetTextExtentPoint32W
ADVAPI32.dll	RegCreateKeyExW, CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, CryptAcquireContextW, RegEnumKeyExW, CheckTokenMembership, FreeSid, RevertToSelf, AllocateAndInitializeSid, RegDeleteValueW, ImpersonateLoggedOnUser, RegQueryInfoKeyW, OpenProcessToken, RegSetValueExW, RegOpenKeyExW, CryptImportKey, CryptEncrypt, CryptDestroyKey, CryptCreateHash, CryptHashData, CryptGetHashParam, RegCloseKey, RegQueryValueExW, CryptDestroyHash
SHELL32.dll	ShellExecuteW, Shell_NotifyIconW, SHGetFolderLocation, ShellExecuteExW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, SHGetSpecialFolderLocation, SHFileOperationW, CommandLineToArgvW, DragQueryFileW, SHGetFolderPathW
ole32.dll	ReleaseStgMedium, OleLockRunning, CLSIDFromProgID, CLSIDFromString, CreateStreamOnHGlobal, OleDuplicateData, DoDragDrop, CoCreateInstance, CoUninitialize, CoInitialize
OLEAUT32.dll	SysAllocString, VariantClear, GetErrorInfo, SysFreeString, VariantChangeType, VariantInit, VariantCopy
SHLWAPI.dll	wnsprintfW, PathFileExistsW
gdiplus.dll	GdipRotateWorldTransform, GdipTranslateWorldTransform, GdipDrawImageRectI, GdipGetPropertyItem, GdipGetPropertyItemSize, GdipImageGetFrameCount, GdipImageGetFrameDimensionsList, GdipImageGetFrameDimensionsCount, GdipGetImageHeight, GdipGetImageWidth, GdipSetStringFormatTrimming, GdipImageSelectActiveFrame, GdipSetStringFormatAlign, GdipSetStringFormatFlags, GdipCloneStringFormat, GdipDeleteStringFormat, GdipStringFormatGetGenericTypographic, GdipMeasureString, GdipDrawString, GdipDeleteFont, GdipCreateFontFromLogfontA, GdipCreateFontFromDC, GdipFillPath, GdipFillRectangleI, GdipDrawPath, GdipDrawRectangleI, GdipSetInterpolationMode, GdipSetTextRenderingHint, GdipSetSmoothingMode, GdipDeleteGraphics, GdipCreateFromHDC, GdipDisposeImage, GdipCloneImage, GdipLoadImageFromStreamICM, GdipLoadImageFromStream, GdipSetPenMode, GdipDeletePen, GdipCreatePen1, GdipCreateSolidFill, GdipDeleteBrush, GdipCloneBrush, GdipAddPathArc, GdipAddPathLine, GdipDeletePath, GdipCreatePath, GdipFree, GdipAlloc, GdiplusShutdown, GdiplusStartup, GdipSetStringFormatLineAlign
IMM32.dll	ImmGetContext, ImmSetCompositionWindow, ImmReleaseContext
dbghelp.dll	MiniDumpWriteDump
PSAPI.DLL	GetModuleFileNameExW
WS2_32.dll	ntohl, inet_ntoa, inet_addr, ioctlsocket, __WSAFDIsSet, select, WSACreateEvent, WSAEventSelect, WSACloseEvent, WSAEnumNetworkEvents, recvfrom, sendto, htonl, listen, accept, getaddrinfo, freeaddrinfo, WSASetLastError, connect, socket, getpeername, getsockopt, htons, bind, ntohs, getsockname, setsockopt, WSAIoctl, recv, WSACleanup, WSAGetLastError, send, WSAStartup, gethostname, gethostbyname, closesocket
WINHTTP.dll	WinHttpQueryHeaders, WinHttpOpen, WinHttpCloseHandle, WinHttpCrackUrl, WinHttpAddRequestHeaders, WinHttpConnect, WinHttpSendRequest, WinHttpSetTimeouts, WinHttpOpenRequest, WinHttpReceiveResponse
VERSION.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:38:53
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\filmora-idco_setup_full1901.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\filmora-idco_setup_full1901.exe"
Imagebase:	0x290000
File size:	1'995'256 bytes
MD5 hash:	AEB7797267CB552CF82E0348C985543E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:38:57
Start date:	19/04/2024
Path:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Imagebase:	0xc10000
File size:	7'168 bytes
MD5 hash:	27CFB3990872CAA5930FA69D57AEFE7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:38:57
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFEC92C90B0 Relevance: 3.4, Strings: 2, Instructions: 909COMMON

Download Yara Rule

Strings

z#S', xrefs: 00007FFEC92C92B3
z#S', xrefs: 00007FFEC92C9449

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID: z#S'$z#S'
API String ID: 0-3267196045
Opcode ID: 00c12d911bd3a363dc5066dea4dc5176f0a580be4203f14895bac49bcdfa624a
Instruction ID: e6a69bb4a8aba1fe44393ca2cac6e240cbe344606e3a7e3b0c947f458ce23faa
Opcode Fuzzy Hash: 00c12d911bd3a363dc5066dea4dc5176f0a580be4203f14895bac49bcdfa624a
Instruction Fuzzy Hash: 49626030A1C6894FFBA99F2894557AD7BE0EF59300F5440ADF88ECB2A3DE34A945C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C6DF4 Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78625b6fb62668aecd669d621a0655923dacda88851ff03591468ae242590916
Instruction ID: 0975abd2af93233f27ff191ad3ef596228d2bb126570e08cb04d2474b8b60416
Opcode Fuzzy Hash: 78625b6fb62668aecd669d621a0655923dacda88851ff03591468ae242590916
Instruction Fuzzy Hash: 62F16D30A0CA494FEB99AF2894557B97BD1EF96301F5540AEF4CEC72A3CF289845C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C6ADA Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

z#S', xrefs: 00007FFEC92C6BA3

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID: z#S'
API String ID: 0-726785185
Opcode ID: 45700cd09e17ebe62242afd9b8296d4968c3a08dcf715222856706446b61168d
Instruction ID: 0440ac19d3503e5c7ef4d92afa508a3c0c4ef3620d8ea166a149d0b6addb4e1c
Opcode Fuzzy Hash: 45700cd09e17ebe62242afd9b8296d4968c3a08dcf715222856706446b61168d
Instruction Fuzzy Hash: 20415530A0D54A4FFB89AF289465B793BE1EF56301F5540BAF48ECB1A3CE29A805C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C01A4 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

75', xrefs: 00007FFEC92C01C5

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID: 75'
API String ID: 0-222332350
Opcode ID: a89d4e6fc4dad90fd596bb6c699186ce00f23ca56a02028f131b3f4b244f4aa2
Instruction ID: da2ec625049999dcf5a181a4c8f96a34159c9f2f98f3ecd08927bcdb098c582b
Opcode Fuzzy Hash: a89d4e6fc4dad90fd596bb6c699186ce00f23ca56a02028f131b3f4b244f4aa2
Instruction Fuzzy Hash: F4D0A95510A39A0FC34BDB3884E04903F609F8B18038100EAC08ACF2A3DA160C0AC325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CCD49 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2238f974f8106bc396a459a81416a8b579624ea8d64e6c2aeee9be0dfb098f89
Instruction ID: a55bc52490cf199b9ade4a569e9bb007aa6c7ab8406567c87b4d2348eb25e6c4
Opcode Fuzzy Hash: 2238f974f8106bc396a459a81416a8b579624ea8d64e6c2aeee9be0dfb098f89
Instruction Fuzzy Hash: 1322732061CA994EFBA9DF1894517BD3BD1EF99300F54017AF8CEC7292DE28E941C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CB193 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613b42a7fb74b575d9c6e11aedd898786ae859854071c915a54db1649c47b2dc
Instruction ID: e9031dde180a97b0b8c6d5fb5b145fa64dafb3365d4516886552e0076c5865d2
Opcode Fuzzy Hash: 613b42a7fb74b575d9c6e11aedd898786ae859854071c915a54db1649c47b2dc
Instruction Fuzzy Hash: 7EA13E3170C6458FE789EF289495A797BE1EF9A305F5504BDF88AC72A3CE28A805C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CD4C2 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452d764811ed8dba6e3fe8a57206d1b50055ad8503720807579d7e45f6997efa
Instruction ID: b04ca211af50436e6c87f144e22dd72889a0498951a9f7c15e3ddf3c77e67ef7
Opcode Fuzzy Hash: 452d764811ed8dba6e3fe8a57206d1b50055ad8503720807579d7e45f6997efa
Instruction Fuzzy Hash: B081B030518A894FEB59DF28D8857A97FE1FF5A300F5441EAF889CB192DB38E845C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C73B0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94db97646cccf2e65d3f70efe66f4df17728db9e91b92fdaf87723df4bf731b
Instruction ID: 50142beedc0b083e4a40c898a2674b7d1989a3b916aa1547483a2a2fd6141189
Opcode Fuzzy Hash: d94db97646cccf2e65d3f70efe66f4df17728db9e91b92fdaf87723df4bf731b
Instruction Fuzzy Hash: D1913E3061CA894FEB599F289451BB97BE1EF56300F5500AEF8CAC72A3DF24A945C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C3934 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdbd47761edc11efcb76f19b87efb52208d48e273b1bc5ef5f712e106591266
Instruction ID: 87464a0d0f510f40d5a50325b3e4f05dd2c71664474a335beaa7686fe5077f39
Opcode Fuzzy Hash: 7bdbd47761edc11efcb76f19b87efb52208d48e273b1bc5ef5f712e106591266
Instruction Fuzzy Hash: 81716920A1894A9FFB58EF189851ABC7BD1FF98341F50447AF84EC7592DF38A851C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C49A1 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143ebb912b3e48fa5e343698cca336179b095c68d3954c7e77a451a72ca2878f
Instruction ID: 82b02f772c2346aab5b723f501174773c4934c1b5a7574cc086be55badef7c5f
Opcode Fuzzy Hash: 143ebb912b3e48fa5e343698cca336179b095c68d3954c7e77a451a72ca2878f
Instruction Fuzzy Hash: 85613D30A1C94A4EFB99AF2894557BD7AD1FF89301F9500BAF44EC72A2DF28E841D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C9BBC Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6e847eb6a740fab20ce24300b3bf357c756455d63080ca69c01b6092408e8e
Instruction ID: 4a3a19a7e42a912736533df23b720584352688e3dfc275fa62510f3c5436ed60
Opcode Fuzzy Hash: 4a6e847eb6a740fab20ce24300b3bf357c756455d63080ca69c01b6092408e8e
Instruction Fuzzy Hash: 7851733061CA9A4EFFB99F2898117FD3BD1EF59700F144169E88ECB292DE34A941D781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C4A34 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e9cfe634308fbd7458248eabb9ec41fe192be4add86a7d524e5bfa8c99ead0
Instruction ID: 285619dea8e03bee7ba9b72b61c96953f712e1d3030c241d47e2db7b57d83633
Opcode Fuzzy Hash: 99e9cfe634308fbd7458248eabb9ec41fe192be4add86a7d524e5bfa8c99ead0
Instruction Fuzzy Hash: 57412450B18A461EFB9AAF2854567BC69C2AF8D301F9541BAF44ECB2E3DF286C41C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C33A0 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9514ab24955e2345ed1dc6140a74316e49d9939151dd4fdf884d7aef0507bc5e
Instruction ID: 0f83599879aa093ee8238ea7b10cfca56a9ecbadb54eedb714c43ca3717ed632
Opcode Fuzzy Hash: 9514ab24955e2345ed1dc6140a74316e49d9939151dd4fdf884d7aef0507bc5e
Instruction Fuzzy Hash: A431B22061CA894FFF959F2898913B93FE0FF5A315F4411BAF88DC7192DA28D848C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CB019 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a09c8a3cad5776cd1d94fda911acbf6f3a21120d517ae74409543ecced253b7
Instruction ID: 47e10028eb46ec4a2b1ac87bf5784a0aec5ed978ed7a728d932726b6d3188e24
Opcode Fuzzy Hash: 4a09c8a3cad5776cd1d94fda911acbf6f3a21120d517ae74409543ecced253b7
Instruction Fuzzy Hash: 16214A20709A484FEB98DF3C9499B793BE1EF9A311F5500F9F449CB2A7CA249C45C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C5EE8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e3b3722c9b2d82f3f192359f90aea62ba8d6f4351c90f8677595645a76b945
Instruction ID: f1abec60a08a673a5a25af893d9ad169618d8aee266b9c4fbc9196235d03131d
Opcode Fuzzy Hash: 20e3b3722c9b2d82f3f192359f90aea62ba8d6f4351c90f8677595645a76b945
Instruction Fuzzy Hash: C721F175A1CB484FE784EF38D49866ABBE1EBD9341F45447EF889C7265DA34D8808701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C688F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc946fb67cf303ef3627ef3ca36afac7eacf7c6d75ae30fc75ef3f5de2e6ecca
Instruction ID: 45f233bdbf2b44c5b3cd3bff21b6c3c827092bc0183bb4e3b3f73e3fb5178284
Opcode Fuzzy Hash: dc946fb67cf303ef3627ef3ca36afac7eacf7c6d75ae30fc75ef3f5de2e6ecca
Instruction Fuzzy Hash: 9921603061890B8EF7A8EF249894BBA77D1FF95305F50057EE08BC69A2DE29F845C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C4B6C Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c79acfe2d017d39644fca7d861ea6f33de6c6a680ed4a5ceb24c6f5bfca434
Instruction ID: 70b28c14a19d9c563cff473150ef7e96024d61d54164bb61546086560b0e734b
Opcode Fuzzy Hash: 98c79acfe2d017d39644fca7d861ea6f33de6c6a680ed4a5ceb24c6f5bfca434
Instruction Fuzzy Hash: B6212F20B1CD4A4FFBA8AF2860557BD6AD1EF99305F954479F44EC72E2CE28A940C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C4C7B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da2e5be2dad108b4f7c763aee3f4d68c83009f58f3ac00fe4b489aa3ab8875a
Instruction ID: 0f742d3fc15fc232f43dbf17c50cd83a6e04604834acbaee1d65aea3fd1632fb
Opcode Fuzzy Hash: 9da2e5be2dad108b4f7c763aee3f4d68c83009f58f3ac00fe4b489aa3ab8875a
Instruction Fuzzy Hash: 99216B50A186461EFB96AF3854553BC6AC1AF8D301F9540BAF44DCB2E3CF6C6C41C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CA900 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d6ec1e23870ff955ffe96a0983eda984bd95b95a287b0ec5a96e4f4893ccd1
Instruction ID: fae7b7036b10ea435e3df03be1b73566345b51662d4965af53f5dc42fb028e98
Opcode Fuzzy Hash: f8d6ec1e23870ff955ffe96a0983eda984bd95b95a287b0ec5a96e4f4893ccd1
Instruction Fuzzy Hash: C511A120B1C5160BFB6D5D6D649A3792AC1EB98346F24107EF5CBC7292E91998869240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C9EB9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffc25597a169d5f54041e7456635d6ba90da0527568059da565347f6e4388f2
Instruction ID: db99fa36ed6c1a08a1ef7371ae41af0b01d5f2d165270e04a13f4f10bc44b104
Opcode Fuzzy Hash: 6ffc25597a169d5f54041e7456635d6ba90da0527568059da565347f6e4388f2
Instruction Fuzzy Hash: 8421EA30A08A9D8FEBA5DF1C94557A97BE1FB6C300F50055AF88DC7351CB30A981CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C3890 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd18252bb7eea541d9be54f2e3556d368ef489871f454f3bc3d8d463b6a4a2e
Instruction ID: 231c97a771cca1bfc726c9b463f6b46f961dbfea7104c18bf49ab35fbb82e0df
Opcode Fuzzy Hash: 0dd18252bb7eea541d9be54f2e3556d368ef489871f454f3bc3d8d463b6a4a2e
Instruction Fuzzy Hash: 581161B0518A4C6FEB94CF08C889BEA7EE0FB49314F94015DF489CB292C7B89915C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CC5C0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8ac0afb59631340627bd454beee256c6e1963e242e93a13c162fb569c27b96
Instruction ID: fec0aed13c73015079eb3288f8e93487cacf50a796c166fd96823e63b2935bd4
Opcode Fuzzy Hash: 1c8ac0afb59631340627bd454beee256c6e1963e242e93a13c162fb569c27b96
Instruction Fuzzy Hash: B101A9306048098FDF8CEF18D499E3937E1EFA5306B5515F9F44ACB666CA25DC95CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C5858 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7dcdb0a39154d42e64aa7f8f2699e34dc92334039a92bee1b6f9daa8ca5367
Instruction ID: 7234db708a6689fc545c07d63332b0adf2c5d54706d951655f6d098fd2a1ae7b
Opcode Fuzzy Hash: cc7dcdb0a39154d42e64aa7f8f2699e34dc92334039a92bee1b6f9daa8ca5367
Instruction Fuzzy Hash: 61018115A2DB894FEB86E73848606587BE19F5B24075A44E7E44CCB2A3E928DC458325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CC690 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832e48059b84ef1a3f1b4cabd4b14a5a61c64492344c2ca866ef41986dcc8e5a
Instruction ID: 5204e12ee393c6113102018badc46ff769bb62e6d7a15754b4b552bd98879d02
Opcode Fuzzy Hash: 832e48059b84ef1a3f1b4cabd4b14a5a61c64492344c2ca866ef41986dcc8e5a
Instruction Fuzzy Hash: 8C019670218A098BEF58DF59D4C8B647BE0FB68305F5511B8E84DCB296CA64D844CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C6D90 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f47b1b6bbe9ebac7d1010dc699c36dee697524ef6c18a11376a09dfd87dec25
Instruction ID: bbadbf72d9ea1d568af512cc850b6695021db6aed0cc697bf674a453eee65d2f
Opcode Fuzzy Hash: 0f47b1b6bbe9ebac7d1010dc699c36dee697524ef6c18a11376a09dfd87dec25
Instruction Fuzzy Hash: CAF01D3060540A8FEF8CEE29E499E3937E1EF9531675501B9F44ACB276CA65DC54C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C6D3F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22b750cf35ae9d115b75f16d8640704d8d8fbf44434381e81a6f3c0bda37d64
Instruction ID: b479ef522e3244a1d3d608476ae58251e99cce010b500a3ca72cd012bb9cf1f0
Opcode Fuzzy Hash: e22b750cf35ae9d115b75f16d8640704d8d8fbf44434381e81a6f3c0bda37d64
Instruction Fuzzy Hash: 70F0E7306094068FEF88EE29E098A793BD1EF9531275404B9E44ACA266CE25EC55C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C0E55 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ceac3e2ce9eb6c19cb99e06623247ef4423a73c008591aa7fdb49ec4f671f3
Instruction ID: f8676533d8b2f40f25040bbbdd4eb165ab5cb9a1d1c22d4b06f1bb128446e8b7
Opcode Fuzzy Hash: 50ceac3e2ce9eb6c19cb99e06623247ef4423a73c008591aa7fdb49ec4f671f3
Instruction Fuzzy Hash: C4E04815758E0E4BEA545F5C7885378B7C1FFCD311F4445BAF50CC3256CE289845C281

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CCCF0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee387779ac6d5f0e8e678e19c74e80d35531438028f4e07af7e327a2c57160df
Instruction ID: e8868ce017216266cc86faafcf49f00d99a32cc3a21c6adaac32fed7d2df6fbb
Opcode Fuzzy Hash: ee387779ac6d5f0e8e678e19c74e80d35531438028f4e07af7e327a2c57160df
Instruction Fuzzy Hash: 7EF0DA7041CB888FD781EF2C804874ABBE0FB99304F50091EF589C2251EB76C1848742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92CA37D Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ff6d89ededf603e26d168db3416c0aed1719e72b07b7f03ba0f5010592605ec
Instruction ID: 52c463cc4bf97e842459bc13209e36df8ab13abe68025b26726ed439c2ce673e
Opcode Fuzzy Hash: 0ff6d89ededf603e26d168db3416c0aed1719e72b07b7f03ba0f5010592605ec
Instruction Fuzzy Hash: 77E0D810B58E1B4AFB96DEA958D037825C4EF88352F841075FC4EC62A3CE5CDC81C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C2AF0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de83ad08bcda85b8474c686df4235b1b88ff435305f36fd16b1ac01912ff283
Instruction ID: 784c071282e3b9a2c3dc927747a13e465539320089da6999f2e971412a0f8d39
Opcode Fuzzy Hash: 1de83ad08bcda85b8474c686df4235b1b88ff435305f36fd16b1ac01912ff283
Instruction Fuzzy Hash: 17E04F21718D4E0BAF89EF2C88D5A7A37E5EFAC31574101B6EC08D7256DE14ECA1C381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C0131 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50cde5259f9a802497b7bf3de9d0f038ff9b73f328bbd92276cd797ed7ce905
Instruction ID: 0214589eec2a3cb6df0bffdb9f086b7d8d18cbbefbed4265028654d0f61be5b4
Opcode Fuzzy Hash: e50cde5259f9a802497b7bf3de9d0f038ff9b73f328bbd92276cd797ed7ce905
Instruction Fuzzy Hash: 86E0C215A2E7CA0FE347922898652A42FA19F47254B6940FBD09ACB6E7D81C1D098726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C90D0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95aeb7b1a6263ee919768be01bed2be1ce9a93cd6a3425bba16285678609a4ea
Instruction ID: a6228cce0f2eb32b11f8fe4da597e7c14c360d318fb52cd88fd7d496613ffb59
Opcode Fuzzy Hash: 95aeb7b1a6263ee919768be01bed2be1ce9a93cd6a3425bba16285678609a4ea
Instruction Fuzzy Hash: D5E012A451DBC84FD7469B288515B097FF0AF1B394F4A15CAE4C8CB3A3C668C9488726

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C5FC9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f27c4fa48cf4221b26f49181512aeccf0d7dfbbb90463ff0595329f07dcbfe1
Instruction ID: c9cb12fc9cd826971c49a6ab125e44f5ea786424f10ba560a43c4e026a1d3ed5
Opcode Fuzzy Hash: 9f27c4fa48cf4221b26f49181512aeccf0d7dfbbb90463ff0595329f07dcbfe1
Instruction Fuzzy Hash: AAE0C21231CB490B9780EA5D8489A7877C1FBD8133B50003FF989C3352CB19E8868391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C660A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2506861ff43c9b0232580c916a140079dc826aae685864091535ead8eb65ccc
Instruction ID: 859efae0bbb0dc5d53efeced8968e831c364ff078c10104abb318eeed78427c7
Opcode Fuzzy Hash: d2506861ff43c9b0232580c916a140079dc826aae685864091535ead8eb65ccc
Instruction Fuzzy Hash: 1CD0A711B285080BE3449A5CA8403E443C1F7CC319F50013EF14DC23C3C96D49464205

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C1C3F Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8683b94becc4715cf07ed628cc9c33526d08ae8ce67c043eb0e0f64197c83cda
Instruction ID: bded0113ce2a6bc91eb4500557202af8278b5e97c5c1343b99c5ed930a56f378
Opcode Fuzzy Hash: 8683b94becc4715cf07ed628cc9c33526d08ae8ce67c043eb0e0f64197c83cda
Instruction Fuzzy Hash: 0CD09277A1CA0989FA2C6D48B8031FC2780DF82372E10013BF58B454AB6D1B321690CE

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C2C03 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b1c3713544fa11c9fbb60c350c5f8333d483ad5337bc45aaa77a3e15cec3a1
Instruction ID: 613a2f0f803cf3abb3e90a7d7e1f7f7ea6f582190d2b2e286217daa673aa6955
Opcode Fuzzy Hash: 89b1c3713544fa11c9fbb60c350c5f8333d483ad5337bc45aaa77a3e15cec3a1
Instruction Fuzzy Hash: 8FD01742A3DB880EE64A6B390C6516C69D69B9E24135644BBA08ACB2E7DC189C098329

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C0248 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6f8023d8e152f5632006d80a1345a6d6988d5f04e8bf2c52bc80421447b711
Instruction ID: fb98e630620bab2287d5e575981c3c76db1ace4b49d13186d71f5ce13be03fcf
Opcode Fuzzy Hash: 6f6f8023d8e152f5632006d80a1345a6d6988d5f04e8bf2c52bc80421447b711
Instruction Fuzzy Hash: BAE04F5651DBCA0FD34AD73848701D43FA19F5B19835540EAC1CADB6F3D90A5C09C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C01CD Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e918e39a19b61db663428f4cb0fdaa5f52d165499a1477dd1925fc179e7be1
Instruction ID: 500b3f073386d6770e07574d1ec1db57011df78280ecad5bed0ea15f5d8d09b3
Opcode Fuzzy Hash: 35e918e39a19b61db663428f4cb0fdaa5f52d165499a1477dd1925fc179e7be1
Instruction Fuzzy Hash: D5D0220924978E4FC28AA22868B02A47BE0CB471A038100D7C28BCF7A3CC0A1C85C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C0A73 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55db9e537ff00e63615f2fd00db331995bcf469d8bc6f5a03f4ad6b91444e364
Instruction ID: c72e9902c7d2f9fec65cfdee6175fa05ef621ba72f45d21e54edc2c0af3cdda3
Opcode Fuzzy Hash: 55db9e537ff00e63615f2fd00db331995bcf469d8bc6f5a03f4ad6b91444e364
Instruction Fuzzy Hash: 5EC09223754B080B9A0419EEBC8B0F4B3C0D68E47332110B7E209C2A01E69B688652C3

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C5E73 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13df9a95f5a7b8d8f750089e10d3eb7fa9b7b47a77bc6b757f92cf7967439a40
Instruction ID: 854ad3bc3129b2f2333c32b51562453fa7159ad0daeb7fe5d9b4be5b171d6b36
Opcode Fuzzy Hash: 13df9a95f5a7b8d8f750089e10d3eb7fa9b7b47a77bc6b757f92cf7967439a40
Instruction Fuzzy Hash: 2CC0126260BB880BCB020AB55C89008BFA09E4B02274815FBD144CE263D6AA4889C302

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C021F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64977a5655ba214a34d8f6bb1cad6943303a68ac849da77aac09312f310c5618
Instruction ID: e0b06a19c9ff1b94e51675910266a944bf9c03ad11a2e5783a7d4621195b21ab
Opcode Fuzzy Hash: 64977a5655ba214a34d8f6bb1cad6943303a68ac849da77aac09312f310c5618
Instruction Fuzzy Hash: A8D0A73180F3D14FE743E77558D12843FE08F0622039804DFC0618B553C8143402C396

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C017C Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93fc85374e80d9d17bd96b2ca5ef77a1f0212a7af84598e2fdbad3639f5e527
Instruction ID: d5f8e0ee3fa5ba0142b4cf299ac962d1276d251ee052e203c65fa30e84efa1e2
Opcode Fuzzy Hash: b93fc85374e80d9d17bd96b2ca5ef77a1f0212a7af84598e2fdbad3639f5e527
Instruction Fuzzy Hash: 12D0C946A2D68A0EE249A73848212E85AE2AF4760478544FA904ADB2E3EC1C1C048715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C01F7 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f059faac66da9074f65203acb62c1819ca1a00a7a0ca1decd65e2a75af90022a
Instruction ID: 4858b153037168b030cbc3112c0ffb39b6fc10218f490a01faefebd21b3ee465
Opcode Fuzzy Hash: f059faac66da9074f65203acb62c1819ca1a00a7a0ca1decd65e2a75af90022a
Instruction Fuzzy Hash: C3D01251E3DA8A0FE659E73848321F81EE19F4F24579140FA948ED76E3CC0E2D08C315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C5E5D Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d23777aebb6fcbc0f685575fca9e490cf6d21e0675fc6c0635629fb7e3fcd4
Instruction ID: ec60c872997ce9cfd37579405f658f378369c22a81739ed6396de80f2d923a7d
Opcode Fuzzy Hash: 62d23777aebb6fcbc0f685575fca9e490cf6d21e0675fc6c0635629fb7e3fcd4
Instruction Fuzzy Hash: 67C0122124D2488FF7064A5868504043B70CF8721535B00D2D544DB173C35959969751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C02B1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5550dde5651244d613b55a6e2baab6b0e12c20d2c7d3b26fa0514d99ab9bee29
Instruction ID: d5d1c327c74312ce3373716064c96c0589c45f7966d0ea8cdb58a2c3ee2aea16
Opcode Fuzzy Hash: 5550dde5651244d613b55a6e2baab6b0e12c20d2c7d3b26fa0514d99ab9bee29
Instruction Fuzzy Hash: EFD0120171DA890FE249D73C49322B81AE19F8F11474144FBD04ED76E3CC0C1C058751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C0283 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f1f983cb34f112835995e48a8bc7c436b542c22518f42aeb64c0cdee8d847f
Instruction ID: 758e08ffb33b0a8408b9b1a674351dea99dafb59582f198e5027a2e09472ddd7
Opcode Fuzzy Hash: 94f1f983cb34f112835995e48a8bc7c436b542c22518f42aeb64c0cdee8d847f
Instruction Fuzzy Hash: A9D0221281D98E0FC24A97244C230F41BA0DF4B14070700EA880EDBAE3CC082C0A8312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C34AE Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7dab142cc7ae811e4433dd61896f3f49236ef749f599cf001a38e340b220217
Instruction ID: 8a717301c58d34669cdf89470d29635b20fbd4d66e8edfb7809849b5476e5446
Opcode Fuzzy Hash: b7dab142cc7ae811e4433dd61896f3f49236ef749f599cf001a38e340b220217
Instruction Fuzzy Hash: 7EC00265A28A089F8F49FBB8849A59532D2FF6E30471109A5A84FC7296DD64E8008741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C435E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a67841b842bdeceda0eeb2d045d2719fcc908c1c6edf0abee64ed86939f14a
Instruction ID: 73adb45d9050eb430c8501881a602597503f53a579f5c1ae6e92e42be2de19c7
Opcode Fuzzy Hash: b4a67841b842bdeceda0eeb2d045d2719fcc908c1c6edf0abee64ed86939f14a
Instruction Fuzzy Hash: 91B0121378060C07890011E8BC49094B380C58A03334100B3DA08C6110D69B04425181

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C4C1B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f7a3823140b73787486afe331efff312c79bf059298c06837f231fe2c9626e6
Instruction ID: 141cac0387eb475c177094b27963b87f7a9b7f65eb1bdedbc92e67b3ef121bd9
Opcode Fuzzy Hash: 7f7a3823140b73787486afe331efff312c79bf059298c06837f231fe2c9626e6
Instruction Fuzzy Hash: E8C08C20728E0A8FFFAC8E6960646BD36A0AF88306F400074B04FC3160CE24E9008340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C0A58 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3704b53b904c14bd42ba78cd0a2d8c5dcea9fde558a573c6690fd792e31970
Instruction ID: 19032f7269c32003240b3be0876c34edac53c497bae9b5eccd89d6d88b7e6ef8
Opcode Fuzzy Hash: 8a3704b53b904c14bd42ba78cd0a2d8c5dcea9fde558a573c6690fd792e31970
Instruction Fuzzy Hash: E4C04830310A08CF8B80EAA884A9616B3E1EB6D3013164551942ACB214DA60E8408B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C02AC Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde422273ac1cd0e40b2d929bda289d9b90c8f782b9899d8ad367ba884d3e76d
Instruction ID: f058ec46c9349649805110a1e6f114c8e5785c190149850b319dd9ef6e89c27e
Opcode Fuzzy Hash: bde422273ac1cd0e40b2d929bda289d9b90c8f782b9899d8ad367ba884d3e76d
Instruction Fuzzy Hash: 20C012608092968FF74ADB2888A16A42BA19F8734070A08E6A089CB0A3C8182806C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C57BB Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e70de5cb085e6f9144c6326bb1a2c6bad4f760101262df209501c7bb9b14792
Instruction ID: b092ccea5ab4be5ae21d1b9e217ffb1f6351d684beda4f9fe9621bca3e8048da
Opcode Fuzzy Hash: 8e70de5cb085e6f9144c6326bb1a2c6bad4f760101262df209501c7bb9b14792
Instruction Fuzzy Hash: 4DA012304454094784009270881109037C05B43100B910068840CC2571C88A19088501

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFEC92C23F3 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1174413092.00007FFEC92C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEC92C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffec92c0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd6bc0c6fe7cce099ee522633639a31bdd222a8308319fa60fd6b2bd56e3210
Instruction ID: 6d75819123fb9d27f734314547bceed372e979fd8e0ac40501e64ff6ddd307cc
Opcode Fuzzy Hash: 4cd6bc0c6fe7cce099ee522633639a31bdd222a8308319fa60fd6b2bd56e3210
Instruction Fuzzy Hash: 75A01120B00E088F8A002AEC200A20232C08B2C2003000028A02EC3202C8A0C8808282

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report filmora-idco_setup_full1901.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Documents\Wondershare\NFWCHK.exe

C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

C:\Users\Public\Documents\Wondershare\WAE_DOWNTASK_1901.xml

C:\Users\Public\Documents\Wondershare\filmora-idco_64bit_full1901.exe.~P2S

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-04-19 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-04-20 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-04-24 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-02 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-02.1 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-03 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-04 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-05 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-06 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-07 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-09 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-13 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-14 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-15 (copy)

C:\Users\user\AppData\Local\Temp\Wondershare\WAE\wsWAE.log.2024-05-16 (copy)

Windows Analysis Report
filmora-idco_setup_full1901.exe