Windows Analysis Report
DouWan-Video-Setup-En-4.3.0.3-x64.exe

Overview

General Information

Sample name: DouWan-Video-Setup-En-4.3.0.3-x64.exe
Analysis ID: 1467120
MD5: 54f1dfbda1d18a3cdb6055546d45dc84
SHA1: 3ff5de326326a96db424dd27df20d1d855a61570
SHA256: d6916e1f1e375b82dcdde615a6fdadeadda98788ce084812ccd6ba133b8a447c
Infos:

Detection

Score: 26
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Compliance

Score: 36
Range: 0 - 100

Signatures

Modifies the windows firewall
Query firmware table information (likely to detect VMs)
Uses netsh to modify the Windows network and firewall settings
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates driver files
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
One or more processes crash
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Classes Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_c6108e29-5
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe EXE: netsh.exe Jump to behavior

Compliance
barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe EXE: netsh.exe Jump to behavior
Uses 32bit PE files
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Window detected: < &Back&Next >CancelNullsoft Install System v3.06.1 Nullsoft Install System v3.06.1License AgreementPlease review the license terms before installing DouWan 4.3.0.3.Press Page Down to see the rest of the agreement.END-USER LICENSE AGREEMENTIMPORTANT: PLEASE READ THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT CAREFULLY BEFORE CONTINUING WITH THIS PROGRAM INSTALL:This End-User License Agreement ("EULA") is a binding legal agreement between You the "User" (an individual or single entity) and XinDawn(the "Company") concerning its Software Products such as DouWan for Mac OS DouWan Universal for Windows or DouWan for Linux including associated software components media printed and electronic documentation. By installing copying or otherwise using the Company's Software Products you agree to be bound by the terms and conditions of this EULA. IF YOU DO NOT AGREE TO THE TERMS OF THIS EULA DO NOT INSTALL OR USE ANY OF THE COMPANY'S SOFTWARE PRODUCTS.Date of EULA - June 8 20201. LICENSE GRANT. A. The Software Products are licensed not sold.B.Subject to the terms of this EULA You are granted a limited personal revocable worldwide non-assignable non-sublicenseable non-transferable and non-exclusive license to install and use the Software Products. C.You may install and use 1 copy of a Software Product on 1 computer that belongs to You and you may make 1 copy of a Software Product for backup and archival purposes. You are not permitted any other rights concerning distribution of a Software Product.D. You agree not to translate modify sell lease rent loan redistribute sub-lease sub-license make copies of (unless expressly permitted under this License) or create derivative works from a Software Product or any part of a Software Product. Any such unauthorized works developed by You and any Intellectual Property Rights embodied therein shall be the sole and exclusive property of the Company; and End User hereby assigns all rights in them (including moral rights) the Company. To the extent Intellectual Property Rights embodied therein are not eligible to be transferred by operation of the law the Company shall be granted exclusive rights to use to the widest extent lawfully possible.E. You agree not to alter merge modify adapt or translate a Software Product or decompile reverse engineer disassemble or otherwise reduce a Software Product to a human-perceivable form. F. This license does NOT guarantee you the right to future upgrades or updates of a Software Product and the Company reserves the right to charge for future upgrades or updates of a Software Product.2. TYPES OF LICENSESThe Company sells and distributes each Software Product under different types of licenses (e.g. education consumer business enterprise etc.) and each type of license contains additional use restrictions. When You purchase a license You agree that at the time of purchase You qualify for that version of the license. If Your representation is inaccurate or false the Compan
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\AdbWinApi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\AdbWinUsbApi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\AirPlayInput.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\DouWan.exe Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\EndUserLicenseAgreement.rtf Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Core.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Gui.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Network.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Svg.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Widgets.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\SDL2.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\SoftwareLicence.txt Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\adb.exe Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-console-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-datetime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-debug-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-errorhandling-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-file-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-file-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-file-l2-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-handle-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-interlocked-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-libraryloader-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-localization-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-memory-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-namedpipe-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-processenvironment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-profile-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-synch-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-sysinfo-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-timezone-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-util-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-conio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-convert-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-environment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-filesystem-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-locale-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-math-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-multibyte-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-private-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-process-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-runtime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-stdio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-time-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-utility-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\avcodec-58.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\avformat-58.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\avutil-56.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\concrt140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\d3dx9_43.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\douwan.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\douwanaudio.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libEGL.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libGLESv2.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libairplay.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libcrypto-1_1-x64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libssl-1_1-x64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libyuv.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\mDNSResponder.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp120.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_2.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_atomic_wait.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_codecvt_ids.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcr120.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcrt.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\opengl32sw.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\swresample-3.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\swscale-5.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\ucrtbase.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\updater.exe Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vcam.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vccorlib140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\w32-pthreads.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\zlib.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\default.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\default_p.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualaud32.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualaud64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualcam32.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualcam64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\bearer Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\bearer\qgenericbearer.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\dashboard.css Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\dashboard.html Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon\details.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon\edit.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon\group.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\DlgDeviceGroupEditor.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\DlgDevicePreview.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\DlgGroupEditor.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\api.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\app.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceGrid.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceGridItem.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceGroupServ.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceServ.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\ws.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\CORS Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\eleTree.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\css Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\css\icon.css Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.eot Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.ttf Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.woff Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\checkFull.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\checkHalf.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\checkNone.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\dropdownOff.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\dropdownOn.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\fold.jpg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\fold.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\leaf.jpg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\leaf.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\radioCheck.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\radioCheckNone.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\iconengines Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\iconengines\qsvgicon.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qgif.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qicns.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qico.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qjpeg.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qpdf.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qsvg.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qtga.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qtiff.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qwbmp.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qwebp.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\platforms Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\platforms\qwindows.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit\win-wasapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit\xindawn-audio.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit\xindawn-output.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful\api.html Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful\api.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful\help.html Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\styles Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\styles\qwindowsvistastyle.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ar.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_bg.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ca.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_cs.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_da.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_de.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_en.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_es.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_fi.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_fr.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_gd.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_he.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_hu.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_it.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ja.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ko.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_lv.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_pl.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ru.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_sk.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_tr.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_uk.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_zh_TW.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\uninst.exe Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\EndUserLicenseAgreement.rtf Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\EndUserLicenseAgreement.rtf Jump to behavior
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1973926819.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d3dx9_43.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1987242741.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2026176484.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1954389433.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1952159816.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\qtscrcpy\win_updater\bin\x64\Release\Updater.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcrt.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2009613605.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1966796857.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\install-filter.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1969876451.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2005869200.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\sys\amd64\libusbK.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Android\libairplay\iRecorder\src\main\cpp\build-64\LibAirPlay\Release\libairplay.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\install-filter.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1956289930.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1969291087.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86_64\gallium\targets\libgl-gdi\opengl32.pdbu source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\concrt140.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1981616576.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1960125828.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1950528544.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_atomic_wait.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2007148156.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-private-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1972586201.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr120.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2008620374.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\dll\amd64\libusbK.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2006507143.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1961200502.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975555251.0000000002764000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\dll\amd64\libusbK.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1955770091.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: sfxcab.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1959537310.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\Temp\openssl-1.1.1g\libcrypto-1_1-x64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1958028208.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1960704021.0000000002764000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1971962294.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\qtscrcpy-new-new\output\win\x64\release\DouWan.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1961731915.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Android\libairplay\iRecorder\src\main\cpp\build-64\LibAirPlay\Release\libairplay.pdb} source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1973073432.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libswscale\swscale-5.pdb''' source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86_64\gallium\targets\libgl-gdi\opengl32.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Z:\airparrot-windows\dependencies\mdnsresponder\mDNSResponder\mDNSWindows\SystemService\x64\Release\mDNSResponder.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2029501912.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1970380215.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975064291.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1970961082.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\install-filter.pdbp source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\Temp\openssl-1.1.1g\libssl-1_1-x64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2005336941.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: `OTHER`TEMP`PACKED<%s return value>internal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1985016363.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1958336058.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1974462657.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2028977593.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libswscale\swscale-5.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1967927887.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp120.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2004495885.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1963965499.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavutil\avutil-56.pdbggg source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1952925751.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1953634392.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1985016363.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1968718763.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbRR source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb** source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2026176484.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\dll\i386\libusbK.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d3dx9_43.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1987242741.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavformat\avformat-58.pdb{{{ source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980040599.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1951145726.0000000002764000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1968211264.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1971477190.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\Temp\openssl-1.1.1g\libcrypto-1_1-x64.pdbj source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\install-filter.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb2 source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975833286.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1985016363.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavutil\avutil-56.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1967370015.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1962649521.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1954930161.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\hudun\AirPlayInput\x64\Release\AirPlayInput.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1957395280.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\SDK\Qt\5.15.2\Src\qtwebengine\build_x64\plugins\imageformats\qpdf.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2061092199.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g 21 Apr 2020built on: Tue Apr 21 14:24:00 2020 UTCplatform: VC-WIN64A-rttOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavformat\avformat-58.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980040599.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdbP source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2007460777.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00406739 FindFirstFileW,FindClose, 0_2_00406739
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00405AED GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405AED
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00402902 FindFirstFileW, 0_2_00402902
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /v1/app/checkVersion?uuid=w61f0b7401cce31b61af8ef16887023fb&softversion=4.3.0.3&limituse=1&language=en-us&lang=en HTTP/1.1Host: api.douwan.videoContent-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0
Source: global traffic HTTP traffic detected: POST /v1/app/getMessage?uuid=w61f0b7401cce31b61af8ef16887023fb&softversion=4.3.0.3&limituse=1&language=en-us&lang=en HTTP/1.1Host: api.douwan.videoContent-Type: application/x-www-form-urlencodedCookie: airServer=995da025b8a84f29c1aa3ab92d8dcd3fContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: POST /ppsecure/deviceaddcredential.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 7642Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: global traffic HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4775Host: login.live.com
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 151.101.66.133
Source: unknown TCP traffic detected without corresponding DNS query: 151.101.130.133
Source: unknown TCP traffic detected without corresponding DNS query: 151.101.66.133
Source: unknown TCP traffic detected without corresponding DNS query: 151.101.130.133
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.31.73
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2PgZmmtPrgnHHEs&MD=vwNG4BCV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2PgZmmtPrgnHHEs&MD=vwNG4BCV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: api.douwan.video
Source: global traffic DNS traffic detected: DNS query: usbserver.douwan.video
Source: unknown HTTP traffic detected: POST /v1/app/checkVersion?uuid=w61f0b7401cce31b61af8ef16887023fb&softversion=4.3.0.3&limituse=1&language=en-us&lang=en HTTP/1.1Host: api.douwan.videoContent-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/_q_receiveReplyensureClientPrefaceSentMicrosoft-IIS/4.Microsoft-IIS/5.Netsca
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/Timestamping1.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/primobject.crl0N
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0B
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1949855131.000000000276E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://developer.android.com/tools/device.html
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1949855131.000000000276E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://developer.android.com/tools/device.htmlinsufficient
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://fsf.org/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://libusb-win32.sourceforge.net
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://libusb-win32.sourceforge.netN
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://libusb-win32.sourceforge.netb
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://libusb-win32.sourceforge.netd
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1949855131.000000000276E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://libusb.info
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://libwdi-cps.akeo.ie
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://libwdi.akeo.ie1.3.6.1.5.5.7.2.1http://libwdi-cps.akeo.ieCryptEncodeObjectCreateSelfSignedCert
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://llvm.org/):
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2099682729.0000000003551000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000000.1749727484.000000000040A000.00000008.00000001.01000000.00000003.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000002.2149538277.000000000040A000.00000004.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0I
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0O
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0P
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2089440667.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://qt-project.org/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2089440667.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://qt.io/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2089440667.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://qt.io/licensing/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/encodingStyle(res
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/(res
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.net/cacert/ObjectSign.crt09
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.net/cacert/PrimObject.crt0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://sensics.com/osvr
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://subca.ocsp-certum.com01
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.certum.pl/CPS0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.color.org)
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.dns-sd.org/ServiceTypes.html
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.globalsign.net/repository/0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.globalsign.net/repository/03
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.globalsign.net/repository09
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/licenses/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.gnu.org/philosophy/why-not-lgpl.html
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.plutinosoft.com
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.plutinosoft.com/blog/projects/platinum
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.plutinosoft.com/blog/projects/platinumDMR-1.50urn:schemas-upnp-org:metadata-1-0/AVT/urn:u
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.plutinosoft.comDevice
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zlib.net/D
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bugs.freedesktop.org/enter_bug.cgi?product=Mesa
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2039883635.0000000002769000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.staticfile.org/axios/1.4.0/axios.min.js
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2039883635.0000000002769000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.staticfile.org/layui/2.8.11/css/layui.min.css
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2039883635.0000000002769000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.staticfile.org/layui/2.8.11/layui.js
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2072473118.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.staticfile.org/layui/2.8.3/css/layui.min.css
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2072473118.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.staticfile.org/layui/2.8.3/layui.js
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.freescale.com/message/493287#493287
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000002.2149947105.0000000000591000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1752250340.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1925391754.000000000276E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://douwan.video/compatibility
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1960046524.00000000005CD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://douwan.video/compatibility.html
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000002.2149947105.0000000000591000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1752250340.0000000002767000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://douwan.videoPublisher
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2047407200.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/hsiangleev/eleTree.git
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://streams.videolan.org/upload/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.certum.pl/CPS0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.douwan.video
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.douwan.video/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.douwan.video/https://www.douwan.video
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991137382.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1990132241.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2069552452.0000000002765000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027698850.0000000002764000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070158162.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030065014.000000000276D000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2070785688.000000000276C000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2002612781.0000000002768000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.globalsign.com/repository/0
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp, DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.openssl.org/H
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.openssl.org/docs/faq.html
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://xindawn.douwan.video/
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://xindawn.douwan.video/0000000012345678TEST
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.31.73:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49758 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00405582 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405582
Installs a raw input device (often for capturing keystrokes)
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_393c1d4b-b
Yara detected Keylogger Generic
Source: Yara match File source: Process Memory Space: DouWan-Video-Setup-En-4.3.0.3-x64.exe PID: 6552, type: MEMORYSTR
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_0040348F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040348F
Creates driver files
Source: C:\Program Files\douwan\DouWan.exe File created: C:\Users\user\AppData\Local\Temp\libusb0.sys Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00406AFA 0_2_00406AFA
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_665A96B0 13_2_665A96B0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_6AD02285 13_2_6AD02285
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_6AD03B22 13_2_6AD03B22
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_6AD0BC8D 13_2_6AD0BC8D
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_6AD01CA2 13_2_6AD01CA2
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83380A0 13_2_00007FFDF83380A0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83130C0 13_2_00007FFDF83130C0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF832B8D0 13_2_00007FFDF832B8D0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF833F060 13_2_00007FFDF833F060
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF832D890 13_2_00007FFDF832D890
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82FA0A0 13_2_00007FFDF82FA0A0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8316130 13_2_00007FFDF8316130
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF830D140 13_2_00007FFDF830D140
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8323950 13_2_00007FFDF8323950
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF834E0F0 13_2_00007FFDF834E0F0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF833E110 13_2_00007FFDF833E110
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF834F9A0 13_2_00007FFDF834F9A0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83521B0 13_2_00007FFDF83521B0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83399D0 13_2_00007FFDF83399D0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF834A1D0 13_2_00007FFDF834A1D0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82F2960 13_2_00007FFDF82F2960
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8349980 13_2_00007FFDF8349980
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8313190 13_2_00007FFDF8313190
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8309A20 13_2_00007FFDF8309A20
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF830A220 13_2_00007FFDF830A220
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82F7A10 13_2_00007FFDF82F7A10
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8341230 13_2_00007FFDF8341230
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8334A50 13_2_00007FFDF8334A50
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83389E0 13_2_00007FFDF83389E0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83449E0 13_2_00007FFDF83449E0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82F6A50 13_2_00007FFDF82F6A50
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83439F0 13_2_00007FFDF83439F0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8309200 13_2_00007FFDF8309200
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83432A0 13_2_00007FFDF83432A0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83482A0 13_2_00007FFDF83482A0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8348AB0 13_2_00007FFDF8348AB0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83072C0 13_2_00007FFDF83072C0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF832FA90 13_2_00007FFDF832FA90
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8320A90 13_2_00007FFDF8320A90
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8324290 13_2_00007FFDF8324290
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8345350 13_2_00007FFDF8345350
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8344310 13_2_00007FFDF8344310
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8306B70 13_2_00007FFDF8306B70
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF830BB80 13_2_00007FFDF830BB80
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8339390 13_2_00007FFDF8339390
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83213F0 13_2_00007FFDF83213F0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83253F0 13_2_00007FFDF83253F0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8306440 13_2_00007FFDF8306440
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF830EC60 13_2_00007FFDF830EC60
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8305CD0 13_2_00007FFDF8305CD0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF831C480 13_2_00007FFDF831C480
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8351490 13_2_00007FFDF8351490
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8344520 13_2_00007FFDF8344520
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF831D530 13_2_00007FFDF831D530
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8330540 13_2_00007FFDF8330540
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8321D40 13_2_00007FFDF8321D40
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8325D40 13_2_00007FFDF8325D40
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83354E0 13_2_00007FFDF83354E0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF833BCF0 13_2_00007FFDF833BCF0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8336CF0 13_2_00007FFDF8336CF0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF831CCF0 13_2_00007FFDF831CCF0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82F7D40 13_2_00007FFDF82F7D40
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF833DDB0 13_2_00007FFDF833DDB0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF831DDB0 13_2_00007FFDF831DDB0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF830FDC0 13_2_00007FFDF830FDC0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8342D60 13_2_00007FFDF8342D60
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF834AD60 13_2_00007FFDF834AD60
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8309570 13_2_00007FFDF8309570
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF833A620 13_2_00007FFDF833A620
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF832F630 13_2_00007FFDF832F630
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8343650 13_2_00007FFDF8343650
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8308DF0 13_2_00007FFDF8308DF0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8315E10 13_2_00007FFDF8315E10
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83226A0 13_2_00007FFDF83226A0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82F7680 13_2_00007FFDF82F7680
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF831E6C0 13_2_00007FFDF831E6C0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82F9660 13_2_00007FFDF82F9660
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF832CE60 13_2_00007FFDF832CE60
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82F1EC0 13_2_00007FFDF82F1EC0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF82FB6B0 13_2_00007FFDF82FB6B0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83A58A0 13_2_00007FFDF83A58A0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83908B0 13_2_00007FFDF83908B0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83830D0 13_2_00007FFDF83830D0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF839F880 13_2_00007FFDF839F880
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83A6090 13_2_00007FFDF83A6090
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83AB9C0 13_2_00007FFDF83AB9C0
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8382A60 13_2_00007FFDF8382A60
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83992F0 13_2_00007FFDF83992F0
Found potential string decryption / allocating functions
Source: C:\Program Files\douwan\DouWan.exe Code function: String function: 665B5C00 appears 63 times
Source: C:\Program Files\douwan\DouWan.exe Code function: String function: 00007FFDF8395B40 appears 91 times
One or more processes crash
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 488 -p 6016 -ip 6016
PE file contains executable resources (Code or Archives)
Source: ucrtbase.dll.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: winusbcoinstaller2.dll.13.dr Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Microsoft Standalone Update, 256987 bytes, 4 files, at 0x44 +A "WSUSSCAN.cab" +A "Windows6.0-KB971286-x64.cab", flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1 compression
Source: winusbcoinstaller2.dll.13.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
PE file contains more sections than normal
Source: zlib.dll.0.dr Static PE information: Number of sections : 20 > 10
Source: libyuv.dll.0.dr Static PE information: Number of sections : 11 > 10
Source: SDL2.dll.0.dr Static PE information: Number of sections : 12 > 10
PE file does not import any functions
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1946757341.0000000002768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSDL2.dllR vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2061092199.000000000276D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqpdf.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1974462657.0000000002768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Svg.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemDNSResponder.exe0 vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqico.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1970961082.0000000002767000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Core.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1967927887.000000000539F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Gui.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1950528544.000000000539F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqgenericbearer.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwebp.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975833286.0000000002760000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2026176484.0000000002765000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqjpeg.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1966796857.0000000002767000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1952159816.0000000002763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1960704021.0000000002764000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975555251.0000000002764000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Widgets.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2008620374.0000000002763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcr120.dll^ vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035023796.0000000002767000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDouWan-VcamD vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibsslH vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2005869200.0000000002763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140_1.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2029501912.0000000002768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibEGL.dll. vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1971477190.0000000002765000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqtga.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqgif.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqsvg.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980040599.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WM/OriginalFilename vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980040599.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WM/AlbumArtistalbum_artistWM/AlbumTitlealbumAuthorartistDescriptioncommentWM/ComposercomposerWM/EncodedByencoded_byWM/EncodingSettingsencoderWM/GenregenreWM/LanguagelanguageWM/OriginalFilenamefilenameWM/PartOfSetdiscWM/PublisherpublisherWM/ToolWM/TrackNumbertrackWM/MediaStationCallSignservice_providerWM/MediaStationNameservice_name vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1962649521.0000000002769000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1969291087.0000000002766000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2007148156.0000000002776000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140_atomic_wait.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2006507143.0000000002765000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140_2.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2007460777.0000000002760000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140_codecvt_ids.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwbmp.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2035809160.000000000276A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDouWan-VcamD vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUpdater.exe> vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1957395280.0000000002763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975064291.0000000002767000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibcryptoH vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1961200502.000000000276D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2005336941.0000000002766000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqsvgicon.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1968718763.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1958028208.0000000002763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1958336058.0000000002760000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2028977593.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevcruntime140.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1951145726.0000000002764000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwindows.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1967370015.000000000539F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1953634392.0000000002768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1954389433.000000000276E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1959537310.0000000002766000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1972586201.0000000002762000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqicns.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2004495885.0000000002763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp120.dll^ vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1968211264.0000000002760000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1956289930.000000000539F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1981616576.0000000002769000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameconcrt140.dllT vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2009613605.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcrt.dllj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1973073432.000000000276A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1973926819.0000000002765000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqtiff.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSFXCAB.EXEj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameWUDF_UPDATE_PACKAGE_NAME.dllj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibusb0.dllF vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameinstall-filter.exe\ vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibusb0.sysZ vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibusbK.sys8 vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibusbK.dll8 vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1955770091.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1970380215.000000000276E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1961731915.0000000002767000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1960125828.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1971962294.000000000539F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Network.dll( vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1963965499.000000000276E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1954930161.0000000002769000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1969876451.000000000276B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2030842122.0000000002761000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamezlib1.dll* vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1952925751.0000000002769000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs DouWan-Video-Setup-En-4.3.0.3-x64.exe
Uses 32bit PE files
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Qt5Core.dll.0.dr Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
Source: adb.exe.0.dr Static PE information: Section: .data ZLIB complexity 0.989382571585903
Source: classification engine Classification label: sus26.evad.winEXE@24/194@2/5
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_0040348F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040348F
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00404822 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404822
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_004021A2 CoCreateInstance, 0_2_004021A2
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DouWan Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4520:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Program Files\douwan\DouWan.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\wdi_destroy_list
Source: C:\Program Files\douwan\DouWan.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\wdi_create_list
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6016
Source: C:\Program Files\douwan\DouWan.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\wdi_register_logger
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Local\Temp\nsfFCB5.tmp Jump to behavior
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File read: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe "C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe"
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="DouWan" dir=in action=allow program="C:\Program Files\douwan\DouWan.exe"
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualcam32.dll"
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualaud32.dll"
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualcam64.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /i /s "C:\Program Files\douwan\VCam\douwan-virtualcam64.dll"
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualaud64.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /i /s "C:\Program Files\douwan\VCam\douwan-virtualaud64.dll"
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Program Files\douwan\DouWan.exe "C:\Program Files\douwan\DouWan.exe"
Source: C:\Program Files\douwan\DouWan.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\wbem\WMIC.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 488 -p 6016 -ip 6016
Source: C:\Program Files\douwan\DouWan.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6016 -s 3156
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="DouWan" dir=in action=allow program="C:\Program Files\douwan\DouWan.exe" Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualcam32.dll" Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualaud32.dll" Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualcam64.dll" Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualaud64.dll" Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Program Files\douwan\DouWan.exe "C:\Program Files\douwan\DouWan.exe" Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /i /s "C:\Program Files\douwan\VCam\douwan-virtualcam64.dll" Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe /i /s "C:\Program Files\douwan\VCam\douwan-virtualaud64.dll" Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ifmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasmontr.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: authfwcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcmonitor.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3cfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3api.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: onex.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappprxy.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: hnetmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netshell.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netsetupapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netiohlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshipsec.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: polstore.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winipsec.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshwfp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2pnetsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2p.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rpcnsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: whhelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlancfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wshelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: peerdistsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wcmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mobilenetworking.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprmsg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: quartz.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: devenum.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: quartz.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: devenum.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: quartz.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: devenum.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: quartz.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: devenum.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: avformat-58.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: avcodec-58.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: avutil-56.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: swresample-3.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: libairplay.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcam.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: sdl2.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: libyuv.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: opengl32.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: d3dx9_43.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: douwanaudio.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: avutil-56.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: mfplat.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: douwan.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: glu32.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: w32-pthreads.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: swscale-5.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: zlib.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: rtworkq.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: quserex.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: libcrypto-1_1-x64.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: mmdevapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: avrt.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: wscapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: airplayinput.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.devices.radios.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.devices.bluetooth.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.networking.hostname.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.networking.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: biwinrt.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.networking.connectivity.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: mdnsresponder.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: capabilityaccessmanagerclient.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.devices.enumeration.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: structuredquery.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: windows.globalization.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: bcp47mrm.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: icu.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: mswb7.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: devdispitemprovider.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5pdf.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sxs.dll
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: DouWan.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\douwan\DouWan.exe
Source: DouWan.lnk0.0.dr LNK file: ..\..\..\Program Files\douwan\DouWan.exe
Source: Uninstall DouWan.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\douwan\uninst.exe
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File written: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\ioSpecial.ini Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Automated click: Next >
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Automated click: I accept the terms of the License Agreement
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Automated click: Next >
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Window detected: < &Back&Next >CancelNullsoft Install System v3.06.1 Nullsoft Install System v3.06.1License AgreementPlease review the license terms before installing DouWan 4.3.0.3.Press Page Down to see the rest of the agreement.END-USER LICENSE AGREEMENTIMPORTANT: PLEASE READ THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT CAREFULLY BEFORE CONTINUING WITH THIS PROGRAM INSTALL:This End-User License Agreement ("EULA") is a binding legal agreement between You the "User" (an individual or single entity) and XinDawn(the "Company") concerning its Software Products such as DouWan for Mac OS DouWan Universal for Windows or DouWan for Linux including associated software components media printed and electronic documentation. By installing copying or otherwise using the Company's Software Products you agree to be bound by the terms and conditions of this EULA. IF YOU DO NOT AGREE TO THE TERMS OF THIS EULA DO NOT INSTALL OR USE ANY OF THE COMPANY'S SOFTWARE PRODUCTS.Date of EULA - June 8 20201. LICENSE GRANT. A. The Software Products are licensed not sold.B.Subject to the terms of this EULA You are granted a limited personal revocable worldwide non-assignable non-sublicenseable non-transferable and non-exclusive license to install and use the Software Products. C.You may install and use 1 copy of a Software Product on 1 computer that belongs to You and you may make 1 copy of a Software Product for backup and archival purposes. You are not permitted any other rights concerning distribution of a Software Product.D. You agree not to translate modify sell lease rent loan redistribute sub-lease sub-license make copies of (unless expressly permitted under this License) or create derivative works from a Software Product or any part of a Software Product. Any such unauthorized works developed by You and any Intellectual Property Rights embodied therein shall be the sole and exclusive property of the Company; and End User hereby assigns all rights in them (including moral rights) the Company. To the extent Intellectual Property Rights embodied therein are not eligible to be transferred by operation of the law the Company shall be granted exclusive rights to use to the widest extent lawfully possible.E. You agree not to alter merge modify adapt or translate a Software Product or decompile reverse engineer disassemble or otherwise reduce a Software Product to a human-perceivable form. F. This license does NOT guarantee you the right to future upgrades or updates of a Software Product and the Company reserves the right to charge for future upgrades or updates of a Software Product.2. TYPES OF LICENSESThe Company sells and distributes each Software Product under different types of licenses (e.g. education consumer business enterprise etc.) and each type of license contains additional use restrictions. When You purchase a license You agree that at the time of purchase You qualify for that version of the license. If Your representation is inaccurate or false the Compan
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\AdbWinApi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\AdbWinUsbApi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\AirPlayInput.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\DouWan.exe Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\EndUserLicenseAgreement.rtf Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Core.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Gui.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Network.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Svg.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\Qt5Widgets.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\SDL2.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\SoftwareLicence.txt Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\adb.exe Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-console-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-datetime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-debug-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-errorhandling-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-file-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-file-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-file-l2-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-handle-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-interlocked-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-libraryloader-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-localization-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-memory-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-namedpipe-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-processenvironment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-profile-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-synch-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-sysinfo-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-timezone-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-core-util-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-conio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-convert-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-environment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-filesystem-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-locale-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-math-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-multibyte-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-private-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-process-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-runtime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-stdio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-time-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\api-ms-win-crt-utility-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\avcodec-58.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\avformat-58.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\avutil-56.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\concrt140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\d3dx9_43.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\douwan.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\douwanaudio.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libEGL.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libGLESv2.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libairplay.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libcrypto-1_1-x64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libssl-1_1-x64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\libyuv.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\mDNSResponder.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp120.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_2.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_atomic_wait.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcp140_codecvt_ids.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcr120.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\msvcrt.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\opengl32sw.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\swresample-3.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\swscale-5.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\ucrtbase.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\updater.exe Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vcam.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vccorlib140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\vcruntime140_1.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\w32-pthreads.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\zlib.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\default.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\default_p.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualaud32.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualaud64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualcam32.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\VCam\douwan-virtualcam64.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\bearer Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\bearer\qgenericbearer.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\dashboard.css Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\dashboard.html Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon\details.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon\edit.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\icon\group.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\DlgDeviceGroupEditor.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\DlgDevicePreview.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\DlgGroupEditor.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\api.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\app.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceGrid.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceGridItem.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceGroupServ.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\deviceServ.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\js\ws.min.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\CORS Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\eleTree.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\css Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\css\icon.css Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.eot Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.svg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.ttf Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\fonts\eletree_icon.woff Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\checkFull.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\checkHalf.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\checkNone.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\dropdownOff.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\dropdownOn.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\fold.jpg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\fold.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\leaf.jpg Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\leaf.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\radioCheck.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\dashboard\vendors\eleTree\images\radioCheckNone.png Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\iconengines Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\iconengines\qsvgicon.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qgif.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qicns.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qico.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qjpeg.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qpdf.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qsvg.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qtga.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qtiff.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qwbmp.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\imageformats\qwebp.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\platforms Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\platforms\qwindows.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit\win-wasapi.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit\xindawn-audio.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\plugins\64bit\xindawn-output.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful\api.html Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful\api.js Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\restful\help.html Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\styles Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\styles\qwindowsvistastyle.dll Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ar.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_bg.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ca.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_cs.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_da.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_de.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_en.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_es.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_fi.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_fr.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_gd.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_he.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_hu.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_it.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ja.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ko.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_lv.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_pl.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_ru.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_sk.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_tr.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_uk.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\translations\qt_zh_TW.qm Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Directory created: C:\Program Files\douwan\uninst.exe Jump to behavior
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static PE information: certificate valid
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static file information: File size 46547184 > 1048576
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1973926819.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2063026937.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d3dx9_43.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1987242741.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2026176484.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1954389433.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1952159816.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\qtscrcpy\win_updater\bin\x64\Release\Updater.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2027026799.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcrt.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2009613605.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1937267938.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1966796857.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\install-filter.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1969876451.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2005869200.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\sys\amd64\libusbK.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Android\libairplay\iRecorder\src\main\cpp\build-64\LibAirPlay\Release\libairplay.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\install-filter.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1956289930.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1969291087.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86_64\gallium\targets\libgl-gdi\opengl32.pdbu source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2067024729.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2059564165.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\concrt140.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1981616576.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1960125828.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1950528544.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_atomic_wait.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2007148156.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-private-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1972586201.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr120.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2008620374.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\dll\amd64\libusbK.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2006507143.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1961200502.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975555251.0000000002764000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\dll\amd64\libusbK.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1955770091.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: sfxcab.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058236702.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1959537310.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2064503548.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\Temp\openssl-1.1.1g\libcrypto-1_1-x64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1958028208.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1960704021.0000000002764000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2058945176.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1971962294.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\qtscrcpy-new-new\output\win\x64\release\DouWan.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1961731915.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Android\libairplay\iRecorder\src\main\cpp\build-64\LibAirPlay\Release\libairplay.pdb} source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1997876465.0000000002762000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1973073432.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libswscale\swscale-5.pdb''' source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\work\mesa\git\mesa\build\windows-x86_64\gallium\targets\libgl-gdi\opengl32.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Z:\airparrot-windows\dependencies\mdnsresponder\mDNSResponder\mDNSWindows\SystemService\x64\Release\mDNSResponder.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2003555293.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2068735910.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2029501912.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1991642582.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1970380215.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975064291.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1970961082.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\install-filter.pdbp source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2057603547.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\Temp\openssl-1.1.1g\libssl-1_1-x64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2001723181.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2005336941.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: `OTHER`TEMP`PACKED<%s return value>internal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1985016363.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1958336058.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\amd64\libusb0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1974462657.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2028977593.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libswscale\swscale-5.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2025081385.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1967927887.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp120.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2004495885.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1963965499.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavutil\avutil-56.pdbggg source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1952925751.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1953634392.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2036460974.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbT source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1930517129.0000000002BE0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1985016363.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1968718763.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbRR source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb** source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1938693832.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2026176484.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\svnmain\googlecode\usb-travis\trunk\libusbk\bin\dll\i386\libusbK.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d3dx9_43.pdbH source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1987242741.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2065331964.000000000276A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavformat\avformat-58.pdb{{{ source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980040599.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1951145726.0000000002764000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1968211264.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1971477190.0000000002765000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\Temp\openssl-1.1.1g\libcrypto-1_1-x64.pdbj source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\install-filter.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libGLESv2.pdb2 source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1994133238.0000000002767000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1975833286.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1985016363.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavutil\avutil-56.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980844814.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1967370015.000000000539F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1962649521.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1954930161.0000000002769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\hudun\AirPlayInput\x64\Release\AirPlayInput.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1898729932.000000000276E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1957395280.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\SDK\Qt\5.15.2\Src\qtwebengine\build_x64\plugins\imageformats\qpdf.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2061092199.000000000276D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MT /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g 21 Apr 2020built on: Tue Apr 21 14:24:00 2020 UTCplatform: VC-WIN64A-rttOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2000530367.0000000002768000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1945133125.0000000002763000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Dev\XindawnGit\ffmpeg\build_sdk-win-x64-clvs2017\libavformat\avformat-58.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1980040599.000000000276B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: z:\projects\libusb-win32-stage\ddk_make\output\i386\libusb0.pdbP source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2060362109.00000000027C9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2066028695.0000000002766000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_codecvt_ids.amd64.pdb source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2007460777.0000000002760000.00000004.00000020.00020000.00000000.sdmp
Binary contains a suspicious time stamp
Source: msvcrt.dll.0.dr Static PE information: 0xF5BDEFD7 [Wed Aug 25 08:27:03 2100 UTC]
PE file contains an invalid checksum
Source: qpdf.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x9d25
Source: FindProcDLL.dll.0.dr Static PE information: real checksum: 0x0 should be: 0xf1e2
Source: System.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x82fd
Source: nsExec.dll.0.dr Static PE information: real checksum: 0x0 should be: 0xc5ea
Source: uninst.exe.0.dr Static PE information: real checksum: 0x2c6f39c should be: 0x6a125
Source: douwan-virtualaud32.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x5f3e6
Source: avformat-58.dll.0.dr Static PE information: real checksum: 0x0 should be: 0xacaca
Source: douwan-virtualaud64.dll.0.dr Static PE information: real checksum: 0x0 should be: 0x72f39
Source: InstallOptions.dll.0.dr Static PE information: real checksum: 0x0 should be: 0xf13f
PE file contains sections with non-standard names
Source: Qt5Core.dll.0.dr Static PE information: section name: .qtmimed
Source: SDL2.dll.0.dr Static PE information: section name: .xdata
Source: adb.exe.0.dr Static PE information: section name: .buildid
Source: adb.exe.0.dr Static PE information: section name: .gcc_exc
Source: qsvgicon.dll.0.dr Static PE information: section name: .qtmetad
Source: qgif.dll.0.dr Static PE information: section name: .qtmetad
Source: qicns.dll.0.dr Static PE information: section name: .qtmetad
Source: qico.dll.0.dr Static PE information: section name: .qtmetad
Source: qjpeg.dll.0.dr Static PE information: section name: .qtmetad
Source: qpdf.dll.0.dr Static PE information: section name: .qtmetad
Source: qsvg.dll.0.dr Static PE information: section name: .qtmetad
Source: qtga.dll.0.dr Static PE information: section name: .qtmetad
Source: qtiff.dll.0.dr Static PE information: section name: .qtmetad
Source: qwbmp.dll.0.dr Static PE information: section name: .qtmetad
Source: qwebp.dll.0.dr Static PE information: section name: .qtmetad
Source: qwindows.dll.0.dr Static PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.0.dr Static PE information: section name: .qtmetad
Source: douwan.dll.0.dr Static PE information: section name: _RDATA
Source: libyuv.dll.0.dr Static PE information: section name: .00cfg
Source: libyuv.dll.0.dr Static PE information: section name: .gehcont
Source: libyuv.dll.0.dr Static PE information: section name: .gxfg
Source: libyuv.dll.0.dr Static PE information: section name: .voltbl
Source: libyuv.dll.0.dr Static PE information: section name: _RDATA
Source: opengl32sw.dll.0.dr Static PE information: section name: _RDATA
Source: vcam.dll.0.dr Static PE information: section name: _RDATA
Source: vcruntime140.dll.0.dr Static PE information: section name: _RDATA
Source: zlib.dll.0.dr Static PE information: section name: .xdata
Source: zlib.dll.0.dr Static PE information: section name: /4
Source: zlib.dll.0.dr Static PE information: section name: /19
Source: zlib.dll.0.dr Static PE information: section name: /31
Source: zlib.dll.0.dr Static PE information: section name: /45
Source: zlib.dll.0.dr Static PE information: section name: /57
Source: zlib.dll.0.dr Static PE information: section name: /70
Source: zlib.dll.0.dr Static PE information: section name: /81
Source: zlib.dll.0.dr Static PE information: section name: /92
Source: douwan-virtualcam64.dll.0.dr Static PE information: section name: _RDATA
Source: qgenericbearer.dll.0.dr Static PE information: section name: .qtmetad
Registers a DLL
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /i /s "C:\Program Files\douwan\VCam\douwan-virtualcam32.dll"
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_6AD1844E push rbx; ret 13_2_6AD1844F
Drops PE files
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\libairplay.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcp140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\libcrypto-1_1-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\avcodec-58.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcp120.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\vcruntime140_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\SDL2.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcr120.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\Qt5Network.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\mDNSResponder.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\w32-pthreads.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\VCam\douwan-virtualcam64.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\bearer\qgenericbearer.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\plugins\64bit\win-wasapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\AdbWinUsbApi.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\libEGL.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\Qt5Svg.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\FindProcDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\AdbWinApi.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\swscale-5.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\adb.exe Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\douwan.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\Qt5Gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qgif.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\Qt5Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\VCam\douwan-virtualcam32.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\plugins\64bit\xindawn-audio.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\VCam\douwan-virtualaud32.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Program Files\douwan\DouWan.exe File created: C:\Users\user\AppData\Local\Temp\libusbK.sys Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qpdf.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\libyuv.dll Jump to dropped file
Source: C:\Program Files\douwan\DouWan.exe File created: C:\Users\user\AppData\Local\Temp\winusbcoinstaller2.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\VCam\douwan-virtualaud64.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\vcam.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\DouWan.exe Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\uninst.exe Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\swresample-3.dll Jump to dropped file
Source: C:\Program Files\douwan\DouWan.exe File created: C:\Users\user\AppData\Local\Temp\libusb0.sys Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcrt.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\libssl-1_1-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\opengl32sw.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\zlib.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\d3dx9_43.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\douwanaudio.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\Qt5Widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\plugins\64bit\xindawn-output.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\avutil-56.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\avformat-58.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\AirPlayInput.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\EndUserLicenseAgreement.rtf Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Program Files\douwan\EndUserLicenseAgreement.rtf Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DouWan Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DouWan\DouWan.lnk Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DouWan\Uninstall DouWan.lnk Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Program Files\douwan\DouWan.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe System information queried: FirmwareTableInformation Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\VCam\douwan-virtualcam32.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\msvcp120.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\plugins\64bit\xindawn-audio.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\msvcr120.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qwebp.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\VCam\douwan-virtualcam64.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\bearer\qgenericbearer.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\VCam\douwan-virtualaud32.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\plugins\64bit\win-wasapi.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Program Files\douwan\DouWan.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\libusbK.sys Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\AdbWinUsbApi.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\InstallOptions.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qpdf.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\libEGL.dll Jump to dropped file
Source: C:\Program Files\douwan\DouWan.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\winusbcoinstaller2.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\VCam\douwan-virtualaud64.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qtiff.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\uninst.exe Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\FindProcDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Program Files\douwan\DouWan.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\libusb0.sys Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\AdbWinApi.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qsvg.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qico.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\libssl-1_1-x64.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\opengl32sw.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qtga.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\libGLESv2.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsaFD81.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\adb.exe Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qicns.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\plugins\64bit\xindawn-output.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\msvcp140_2.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\d3dcompiler_47.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Dropped PE file which has not been started: C:\Program Files\douwan\imageformats\qgif.dll Jump to dropped file
Queries disk information (often used to detect virtual machines)
Source: C:\Program Files\douwan\DouWan.exe File opened: PhysicalDrive0 Jump to behavior
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File Volume queried: C:\Program Files FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe File Volume queried: C:\Program Files FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00406739 FindFirstFileW,FindClose, 0_2_00406739
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00405AED GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405AED
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_00402902 FindFirstFileW, 0_2_00402902
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware, Inc.
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: LLVMX86_FP80TypeKind
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: invalid PARAM usage_mesa_symbol_table_push_scope_mesa_symbol_table_add_global_symbol_mesa_symbol_table_add_symbolARB_ARB_position_invariantexpfog_linearexp2nicestprecision_hint_draw_buffersfastestfragment_coord_fragment_program_shadowpixel_center_integerorigin_upper_leftATI_fatal flex scanner internal error--no action foundfatal error - scanner input buffer overflowfatal flex scanner internal error--end of buffer missedout of dynamic memory in yy_get_next_buffer()input in flex scanner failedout of dynamic memory in _mesa_program_lexer__create_buffer()flex scanner push-back overflowout of dynamic memory in _mesa_program_lexer__scan_buffer()out of dynamic memory in _mesa_program_lexer_ensure_buffer_stack()bad buffer in _mesa_program_lexer__scan_bytes()out of dynamic memory in _mesa_program_lexer__scan_bytes()_mesa_program_lexer_set_column called with no buffer_mesa_program_lexer_set_lineno called with no bufferVMware, Inc.SOFTPIPE_USE_LLVMUnexpected PIPE_CAP %d query
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.2022852168.0000000002837000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: t2t1dst0t3dst2dst1dst3LLVMVoidTypeKindLLVMDoubleTypeKindLLVMFloatTypeKindLLVMFP128TypeKindLLVMX86_FP80TypeKindLLVMLabelTypeKindLLVMPPC_FP128TypeKindLLVMFunctionTypeKindLLVMIntegerTypeKindLLVMArrayTypeKindLLVMStructTypeKindLLVMVectorTypeKindLLVMPointerTypeKindunknown LLVMTypeKindLLVMMetadataTypeKindVector [%u] of %s
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1924613470.000000000276C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMWare, Inc.
Source: DouWan-Video-Setup-En-4.3.0.3-x64.exe, 00000000.00000003.1935438601.000000000539F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .?AVQEmulationPaintEngine@@
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8354A60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00007FFDF8354A60
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_6AD13D30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 13_2_6AD13D30
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8354A60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00007FFDF8354A60
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF8354BAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 13_2_00007FFDF8354BAC
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83B30D4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00007FFDF83B30D4
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_00007FFDF83B3220 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 13_2_00007FFDF83B3220
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="DouWan" dir=in action=allow program="C:\Program Files\douwan\DouWan.exe" Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid Jump to behavior
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Program Files\douwan\DouWan.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\platforms\qwindows.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\styles\qwindowsvistastyle.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\bearer\qgenericbearer.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\Qt5Network.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\Qt5Network.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\Qt5Network.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\imageformats\qgif.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\imageformats\qicns.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\imageformats\qico.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\imageformats\qjpeg.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\imageformats\qpdf.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\imageformats\qtga.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\imageformats\qwbmp.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Queries volume information: C:\Program Files\douwan\iconengines\qsvgicon.dll VolumeInformation Jump to behavior
Source: C:\Program Files\douwan\DouWan.exe Code function: 13_2_6AD13C50 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 13_2_6AD13C50
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Code function: 0_2_0040348F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040348F
Source: C:\Program Files\douwan\DouWan.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies the windows firewall
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="DouWan" dir=in action=allow program="C:\Program Files\douwan\DouWan.exe"
Uses netsh to modify the Windows network and firewall settings
Source: C:\Users\user\Desktop\DouWan-Video-Setup-En-4.3.0.3-x64.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="DouWan" dir=in action=allow program="C:\Program Files\douwan\DouWan.exe"
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467120 Sample: DouWan-Video-Setup-En-4.3.0... Startdate: 03/07/2024 Architecture: WINDOWS Score: 26 51 usbserver.douwan.video 2->51 53 api.douwan.video 2->53 8 DouWan-Video-Setup-En-4.3.0.3-x64.exe 7 230 2->8         started        process3 file4 37 C:\Program Files\douwan\DouWan.exe, PE32+ 8->37 dropped 39 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->39 dropped 41 C:\Users\user\AppData\Local\...\System.dll, PE32 8->41 dropped 43 108 other files (none is malicious) 8->43 dropped 61 Uses netsh to modify the Windows network and firewall settings 8->61 63 Modifies the windows firewall 8->63 12 DouWan.exe 23 8->12         started        17 netsh.exe 2 8->17         started        19 regsvr32.exe 8->19         started        21 3 other processes 8->21 signatures5 process6 dnsIp7 55 api.douwan.video 101.200.59.29, 443, 49738, 49747 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd China 12->55 57 usbserver.douwan.video 47.104.158.224, 49740, 49741, 80 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd China 12->57 59 3 other IPs or domains 12->59 45 C:\Users\user\...\winusbcoinstaller2.dll, PE32+ 12->45 dropped 47 C:\Users\user\AppData\Local\...\libusbK.sys, PE32+ 12->47 dropped 49 C:\Users\user\AppData\Local\...\libusb0.sys, PE32+ 12->49 dropped 65 Query firmware table information (likely to detect VMs) 12->65 23 WMIC.exe 12->23         started        25 WerFault.exe 12->25         started        27 conhost.exe 17->27         started        29 regsvr32.exe 48 19->29         started        31 regsvr32.exe 9 21->31         started        file8 signatures9 process10 process11 33 conhost.exe 23->33         started        35 WerFault.exe 27->35         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
47.104.158.224
 usbserver.douwan.video China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
239.255.255.250
 unknown Reserved
unknown unknown false
101.200.59.29
 api.douwan.video China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false

Private

IP
192.168.2.4
127.0.0.1

Contacted Domains

Name IP Active
usbserver.douwan.video 47.104.158.224 true
api.douwan.video 101.200.59.29 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.douwan.video/v1/app/getMessage?uuid=w61f0b7401cce31b61af8ef16887023fb&softversion=4.3.0.3&limituse=1&language=en-us&lang=en false
  • Avira URL Cloud: safe
 unknown
https://api.douwan.video/v1/app/checkVersion?uuid=w61f0b7401cce31b61af8ef16887023fb&softversion=4.3.0.3&limituse=1&language=en-us&lang=en false
  • Avira URL Cloud: safe
 unknown