5199f4e0d80f7c7445ddf120ec17f05dd94e3c9293a87024f1ab41a4eb60279d

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2022 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03091132.exe
Size

68.3MB
MD5

d2457793c05186062eb3aa6d7ab0797c
SHA1

456b732d643e792e977ba6f440969b5ec5e56b01
SHA256

5199f4e0d80f7c7445ddf120ec17f05dd94e3c9293a87024f1ab41a4eb60279d
SHA512

bab22acd3a0faddf25d880038ec29242982e1c64dcbd394cd2cc3dbace6f2a39cfe1dc56244c8c18d56e4c9605ae7b19c46dba4fb10862c70e6ab46017412099
SSDEEP

1572864:k6pfZnJiBolI39FtdGdLATNInXE2YP/OsGtYBs14K:kg1JdlI3DDGdExuKOsGtY+1X

Score

8^/10

discovery evasion exploit persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 12 IoCs

Processes:

regsvr32.exeregsvr32.exej_filejo_setup.exej_filejo_setup.tmpnatsvc.exesmmgr_setup.exesmmgr_setup.tmpsmmgr.exeFileJoPlayer_setup.exeFileJoPlayer_setup.tmpFileJoService.exeFileJoLauncher.exe

pid	process
2972	regsvr32.exe
1496	regsvr32.exe
224	j_filejo_setup.exe
1956	j_filejo_setup.tmp
4700	natsvc.exe
2360	smmgr_setup.exe
1396	smmgr_setup.tmp
1340	smmgr.exe
4508	FileJoPlayer_setup.exe
1592	FileJoPlayer_setup.tmp
4752	FileJoService.exe
5056	FileJoLauncher.exe

Possible privilege escalation attempt 5 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid process

4160 icacls.exe
2836 icacls.exe
4276 icacls.exe
4596 takeown.exe
1596 icacls.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
4160	icacls.exe
2836	icacls.exe
4276	icacls.exe
4596	takeown.exe
1596	icacls.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

j_filejo_setup.tmpsmmgr_setup.tmpFileJoLauncher.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	j_filejo_setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	smmgr_setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	FileJoLauncher.exe

Loads dropped DLL 13 IoCs

Processes:

03091132.exeregsvr32.exej_filejo_setup.tmpFileJoLauncher.exenatsvc.exe

pid	process
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
2972	regsvr32.exe
1956	j_filejo_setup.tmp
1956	j_filejo_setup.tmp
5056	FileJoLauncher.exe
5056	FileJoLauncher.exe
4700	natsvc.exe
4700	natsvc.exe

Modifies file permissions 1 TTPs 5 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid process

4276 icacls.exe
4596 takeown.exe
1596 icacls.exe
4160 icacls.exe
2836 icacls.exe

pid	process
4276	icacls.exe
4596	takeown.exe
1596	icacls.exe
4160	icacls.exe
2836	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in System32 directory 1 IoCs

Processes:

03091132.exe

description ioc process

File created C:\Windows\SysWOW64\FileJo.ico 03091132.exe

description	ioc	process
File created	C:\Windows\SysWOW64\FileJo.ico	03091132.exe

Drops file in Program Files directory 64 IoCs

Processes:

FileJoPlayer_setup.tmp03091132.exesmmgr_setup.tmp

description	ioc	process
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-NBJNN.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\FileJoPlayer_setup.exe	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\access\is-T88T0.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-0EEOU.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\packetizer\is-72BVA.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\OpenFileJo.exe	03091132.exe
File created	C:\Program Files (x86)\FileJo\TachionLive\ENGS\BWT.dll	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-97OL2.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-QN8CP.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\packetizer\is-UVDVM.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-DPVPH.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\FileJoUp.exe	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-0HTS4.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-ROFQ8.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_output\is-91HK7.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-31I3I.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\ArkZip32.dll	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\audio_filter\is-5LDER.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-LN595.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-GADLN.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\audio_filter\is-UDTR9.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-9OSC2.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\misc\is-T3AG4.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\stream_out\is-69TLE.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\access\is-HGE8M.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\spu\is-EUGPB.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-31NCN.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-61QRU.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\is-G5SS3.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\audio_filter\is-H13K7.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-L8SAK.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\audio_filter\is-G6SRB.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-8U3JP.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-ECC2S.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\access_output\is-BS1H2.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\audio_filter\is-GP53V.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\msvcr100.dll	03091132.exe
File created	C:\Program Files (x86)\SManager\is-43Q3O.tmp	smmgr_setup.tmp
File created	C:\Program Files (x86)\FileJo\mfc100.dll	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\audio_filter\is-SRBTG.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-TRJ24.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\is-A4CFO.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\is-INKGB.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\access\is-JRJ5R.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-REV2Q.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-LHUTA.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-4PLIC.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\CandleCopyright.dll	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\stream_out\is-U8U2N.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_chroma\is-MI8K3.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-JL5SB.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\stream_filter\is-AHADM.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\MCheck.dll	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-6OK9M.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\stream_filter\is-HPS4P.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_chroma\is-1ML01.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\codec\is-V3Q0P.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\demux\is-KJLI6.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\video_filter\is-K812M.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\FileJo\FileJoLauncher.exe	03091132.exe
File created	C:\Program Files (x86)\FileJo\ckpcodec.dll	03091132.exe
File created	C:\Program Files (x86)\FileJo\ssmimbc.exe	03091132.exe
File created	C:\Program Files (x86)\filejo\player\plugins\audio_filter\is-BEG7J.tmp	FileJoPlayer_setup.tmp
File created	C:\Program Files (x86)\filejo\player\plugins\services_discovery\is-QTFVR.tmp	FileJoPlayer_setup.tmp

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4224 sc.exe
4920 sc.exe
3256 sc.exe
2548 sc.exe
4328 sc.exe
2340 sc.exe
540 sc.exe
2352 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4288 timeout.exe

pid	process
4224	sc.exe
4920	sc.exe
3256	sc.exe
2548	sc.exe
4328	sc.exe
2340	sc.exe
540	sc.exe
2352	sc.exe

pid	process
4288	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2576 taskkill.exe
2468 taskkill.exe

pid	process
2576	taskkill.exe
2468	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

FileJoPlayer_setup.tmp03091132.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\FileJoPlayer\WarnOnOpen = "0"	FileJoPlayer_setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	03091132.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth = "1"	03091132.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\FileJoPlayer	FileJoPlayer_setup.tmp

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

03091132.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.FileJo.com"	03091132.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

natsvc.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\Software\GExperts natsvc.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\GExperts	natsvc.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe03091132.exeFileJoPlayer_setup.tmp

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\TypeLib\ = "{8402234F-5087-47FE-AC06-6255D78E2675}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filejo\shell\open	03091132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\Elevation	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\TypeLib\ = "{8402234F-5087-47FE-AC06-6255D78E2675}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\ = "_IWebBBSEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filejo	03091132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FCF9C839-34AD-499C-A9CE-CE4226E66EE9}\ = "FileJoControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\VersionIndependentProgID\ = "FileJoControl.WebBBS"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoControl.WebBBS\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoControl.WebBBS\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8402234F-5087-47FE-AC06-6255D78E2675}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoPlayer\shell	FileJoPlayer_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filejo\DefaultIcon	03091132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoControl.WebBBS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427F-884B-EA27E858010E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\ = "_IWebBBSEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoPlayer	FileJoPlayer_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filejo\shell	03091132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\MiscStatus	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\Elevation\Enabled = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427F-884B-EA27E858010E}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\ = "IWebBBS"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoControl.WebBBS.1\ = "FileJo Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoControl.WebBBS\ = "FileJo Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427F-884B-EA27E858010E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8402234F-5087-47FE-AC06-6255D78E2675}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8402234F-5087-47FE-AC06-6255D78E2675}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoPlayer\shell\open	FileJoPlayer_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoPlayer\shell\open\command	FileJoPlayer_setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Filejo\shell\open\command\ = "C:\\Program Files (x86)\\FileJo\\OpenFileJo.exe \"%1\""	03091132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FileJoControl.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\InprocServer32\ = "C:\\Program Files (x86)\\FileJo\\FileJoControl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\ = "FileJo Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FE97D14-B9D4-427f-884B-EA27E858010E}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8402234F-5087-47FE-AC06-6255D78E2675}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53479A23-C3FE-4A1F-AA82-8FB1F9ED4CF4}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	FileJoPlayer_setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fjo	03091132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filejo\shell\open\command	03091132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FileJoControl.DLL\AppID = "{FCF9C839-34AD-499C-A9CE-CE4226E66EE9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileJoControl.WebBBS\CLSID\ = "{8FE97D14-B9D4-427f-884B-EA27E858010E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8402234F-5087-47FE-AC06-6255D78E2675}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\TypeLib\ = "{8402234F-5087-47FE-AC06-6255D78E2675}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5EF6DEFB-23A6-49FC-AA08-D0A64BEE9670}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FCF9C839-34AD-499C-A9CE-CE4226E66EE9}	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

03091132.exej_filejo_setup.tmpsmmgr_setup.tmpFileJoService.exeFileJoLauncher.exemsedge.exemsedge.exenatsvc.exeidentity_helper.exe

pid	process
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
3488	03091132.exe
1956	j_filejo_setup.tmp
1956	j_filejo_setup.tmp
1396	smmgr_setup.tmp
1396	smmgr_setup.tmp
4752	FileJoService.exe
4752	FileJoService.exe
5056	FileJoLauncher.exe
5056	FileJoLauncher.exe
5056	FileJoLauncher.exe
5056	FileJoLauncher.exe
1700	msedge.exe
1700	msedge.exe
1092	msedge.exe
1092	msedge.exe
4700	natsvc.exe
4700	natsvc.exe
4700	natsvc.exe
4700	natsvc.exe
4316	identity_helper.exe
4316	identity_helper.exe
4752	FileJoService.exe
4752	FileJoService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1092 msedge.exe
1092 msedge.exe
1092 msedge.exe
1092 msedge.exe
1092 msedge.exe
1092 msedge.exe
1092 msedge.exe

pid	process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	992	WMIC.exe
Token: SeSecurityPrivilege	992	WMIC.exe
Token: SeTakeOwnershipPrivilege	992	WMIC.exe
Token: SeLoadDriverPrivilege	992	WMIC.exe
Token: SeSystemProfilePrivilege	992	WMIC.exe
Token: SeSystemtimePrivilege	992	WMIC.exe
Token: SeProfSingleProcessPrivilege	992	WMIC.exe
Token: SeIncBasePriorityPrivilege	992	WMIC.exe
Token: SeCreatePagefilePrivilege	992	WMIC.exe
Token: SeBackupPrivilege	992	WMIC.exe
Token: SeRestorePrivilege	992	WMIC.exe
Token: SeShutdownPrivilege	992	WMIC.exe
Token: SeDebugPrivilege	992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	992	WMIC.exe
Token: SeRemoteShutdownPrivilege	992	WMIC.exe
Token: SeUndockPrivilege	992	WMIC.exe
Token: SeManageVolumePrivilege	992	WMIC.exe
Token: 33	992	WMIC.exe
Token: 34	992	WMIC.exe
Token: 35	992	WMIC.exe
Token: 36	992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	992	WMIC.exe
Token: SeSecurityPrivilege	992	WMIC.exe
Token: SeTakeOwnershipPrivilege	992	WMIC.exe
Token: SeLoadDriverPrivilege	992	WMIC.exe
Token: SeSystemProfilePrivilege	992	WMIC.exe
Token: SeSystemtimePrivilege	992	WMIC.exe
Token: SeProfSingleProcessPrivilege	992	WMIC.exe
Token: SeIncBasePriorityPrivilege	992	WMIC.exe
Token: SeCreatePagefilePrivilege	992	WMIC.exe
Token: SeBackupPrivilege	992	WMIC.exe
Token: SeRestorePrivilege	992	WMIC.exe
Token: SeShutdownPrivilege	992	WMIC.exe
Token: SeDebugPrivilege	992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	992	WMIC.exe
Token: SeRemoteShutdownPrivilege	992	WMIC.exe
Token: SeUndockPrivilege	992	WMIC.exe
Token: SeManageVolumePrivilege	992	WMIC.exe
Token: 33	992	WMIC.exe
Token: 34	992	WMIC.exe
Token: 35	992	WMIC.exe
Token: 36	992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4968	WMIC.exe
Token: SeSecurityPrivilege	4968	WMIC.exe
Token: SeTakeOwnershipPrivilege	4968	WMIC.exe
Token: SeLoadDriverPrivilege	4968	WMIC.exe
Token: SeSystemProfilePrivilege	4968	WMIC.exe
Token: SeSystemtimePrivilege	4968	WMIC.exe
Token: SeProfSingleProcessPrivilege	4968	WMIC.exe
Token: SeIncBasePriorityPrivilege	4968	WMIC.exe
Token: SeCreatePagefilePrivilege	4968	WMIC.exe
Token: SeBackupPrivilege	4968	WMIC.exe
Token: SeRestorePrivilege	4968	WMIC.exe
Token: SeShutdownPrivilege	4968	WMIC.exe
Token: SeDebugPrivilege	4968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4968	WMIC.exe
Token: SeRemoteShutdownPrivilege	4968	WMIC.exe
Token: SeUndockPrivilege	4968	WMIC.exe
Token: SeManageVolumePrivilege	4968	WMIC.exe
Token: 33	4968	WMIC.exe
Token: 34	4968	WMIC.exe
Token: 35	4968	WMIC.exe
Token: 36	4968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4968	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

j_filejo_setup.tmpsmmgr_setup.tmpFileJoPlayer_setup.tmpmsedge.exe

pid process

1956 j_filejo_setup.tmp
1396 smmgr_setup.tmp
1592 FileJoPlayer_setup.tmp
1092 msedge.exe
1092 msedge.exe
1092 msedge.exe

pid	process
1956	j_filejo_setup.tmp
1396	smmgr_setup.tmp
1592	FileJoPlayer_setup.tmp
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03091132.exej_filejo_setup.exej_filejo_setup.tmpcmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3488 wrote to memory of 4224	3488	03091132.exe	sc.exe
PID 3488 wrote to memory of 4224	3488	03091132.exe	sc.exe
PID 3488 wrote to memory of 4224	3488	03091132.exe	sc.exe
PID 3488 wrote to memory of 4920	3488	03091132.exe	sc.exe
PID 3488 wrote to memory of 4920	3488	03091132.exe	sc.exe
PID 3488 wrote to memory of 4920	3488	03091132.exe	sc.exe
PID 3488 wrote to memory of 2972	3488	03091132.exe	regsvr32.exe
PID 3488 wrote to memory of 2972	3488	03091132.exe	regsvr32.exe
PID 3488 wrote to memory of 2972	3488	03091132.exe	regsvr32.exe
PID 3488 wrote to memory of 1496	3488	03091132.exe	regsvr32.exe
PID 3488 wrote to memory of 1496	3488	03091132.exe	regsvr32.exe
PID 3488 wrote to memory of 1496	3488	03091132.exe	regsvr32.exe
PID 3488 wrote to memory of 224	3488	03091132.exe	j_filejo_setup.exe
PID 3488 wrote to memory of 224	3488	03091132.exe	j_filejo_setup.exe
PID 3488 wrote to memory of 224	3488	03091132.exe	j_filejo_setup.exe
PID 224 wrote to memory of 1956	224	j_filejo_setup.exe	j_filejo_setup.tmp
PID 224 wrote to memory of 1956	224	j_filejo_setup.exe	j_filejo_setup.tmp
PID 224 wrote to memory of 1956	224	j_filejo_setup.exe	j_filejo_setup.tmp
PID 1956 wrote to memory of 3700	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 3700	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 3700	1956	j_filejo_setup.tmp	cmd.exe
PID 3700 wrote to memory of 4596	3700	cmd.exe	takeown.exe
PID 3700 wrote to memory of 4596	3700	cmd.exe	takeown.exe
PID 3700 wrote to memory of 4596	3700	cmd.exe	takeown.exe
PID 3700 wrote to memory of 1596	3700	cmd.exe	icacls.exe
PID 3700 wrote to memory of 1596	3700	cmd.exe	icacls.exe
PID 3700 wrote to memory of 1596	3700	cmd.exe	icacls.exe
PID 3700 wrote to memory of 4160	3700	cmd.exe	icacls.exe
PID 3700 wrote to memory of 4160	3700	cmd.exe	icacls.exe
PID 3700 wrote to memory of 4160	3700	cmd.exe	icacls.exe
PID 1956 wrote to memory of 2484	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 2484	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 2484	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 3484	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 3484	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 3484	1956	j_filejo_setup.tmp	cmd.exe
PID 3484 wrote to memory of 4288	3484	cmd.exe	timeout.exe
PID 3484 wrote to memory of 4288	3484	cmd.exe	timeout.exe
PID 3484 wrote to memory of 4288	3484	cmd.exe	timeout.exe
PID 1956 wrote to memory of 540	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 540	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 540	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 5020	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 5020	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 5020	1956	j_filejo_setup.tmp	cmd.exe
PID 5020 wrote to memory of 3256	5020	cmd.exe	sc.exe
PID 5020 wrote to memory of 3256	5020	cmd.exe	sc.exe
PID 5020 wrote to memory of 3256	5020	cmd.exe	sc.exe
PID 1956 wrote to memory of 2548	1956	j_filejo_setup.tmp	sc.exe
PID 1956 wrote to memory of 2548	1956	j_filejo_setup.tmp	sc.exe
PID 1956 wrote to memory of 2548	1956	j_filejo_setup.tmp	sc.exe
PID 1956 wrote to memory of 4328	1956	j_filejo_setup.tmp	sc.exe
PID 1956 wrote to memory of 4328	1956	j_filejo_setup.tmp	sc.exe
PID 1956 wrote to memory of 4328	1956	j_filejo_setup.tmp	sc.exe
PID 1956 wrote to memory of 2204	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 2204	1956	j_filejo_setup.tmp	cmd.exe
PID 1956 wrote to memory of 2204	1956	j_filejo_setup.tmp	cmd.exe
PID 2204 wrote to memory of 992	2204	cmd.exe	WMIC.exe
PID 2204 wrote to memory of 992	2204	cmd.exe	WMIC.exe
PID 2204 wrote to memory of 992	2204	cmd.exe	WMIC.exe
PID 2204 wrote to memory of 2244	2204	cmd.exe	more.com
PID 2204 wrote to memory of 2244	2204	cmd.exe	more.com
PID 2204 wrote to memory of 2244	2204	cmd.exe	more.com
PID 1956 wrote to memory of 1716	1956	j_filejo_setup.tmp	cmd.exe

C:\Users\Admin\AppData\Local\Temp\03091132.exe
"C:\Users\Admin\AppData\Local\Temp\03091132.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\sc.exe
sc stop FileJoSvc
2⤵
- Launches sc.exe
PID:4224

C:\Windows\SysWOW64\sc.exe
sc delete FileJoSvc
2⤵
- Launches sc.exe
PID:4920

C:\Program Files (x86)\FileJo\regsvr32.exe
"C:\Program Files (x86)\FileJo\regsvr32.exe" "C:\Program Files (x86)\FileJo\FileJoControl.dll" /s
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2972

C:\Program Files (x86)\FileJo\regsvr32.exe
"C:\Program Files (x86)\FileJo\regsvr32.exe" "C:\Program Files (x86)\FileJo\..\..\BUILD\FileJo\Temp\FileJo64.dll" /s
2⤵
- Executes dropped EXE
PID:1496

C:\Program Files (x86)\FileJo\j_filejo_setup.exe
"C:\Program Files (x86)\FileJo\j_filejo_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224

C:\Users\Admin\AppData\Local\Temp\is-KFV9H.tmp\j_filejo_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-KFV9H.tmp\j_filejo_setup.tmp" /SL5="$901BC,1675564,57856,C:\Program Files (x86)\FileJo\j_filejo_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\41a8c5f7991b9357ad40b5ea8be35b67.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\takeown.exe
takeown /f "C:\Program Files (x86)\NAT Service" /R /D Y
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4596

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\NAT Service" /reset /T
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1596

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\NAT Service" /grant Admin:F /T
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\a8cd4d627988b06ba74f633c7b520cc7.bat" "
4⤵
PID:2484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\a8cd4d627988b06ba74f633c7b520cc7.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\timeout.exe
timeout 5
5⤵
- Delays execution with timeout.exe
PID:4288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\4207f3e54c11a1beff966348827fd31e.bat" "
4⤵
PID:540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\4207f3e54c11a1beff966348827fd31e.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\SysWOW64\sc.exe
sc start NATService
5⤵
- Launches sc.exe
PID:3256

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" create NATService start= auto binPath= "\"C:\Program Files (x86)\NAT Service\natsvc.exe\""
4⤵
- Launches sc.exe
PID:2548

C:\Windows\SysWOW64\sc.exe
"C:\Windows\system32\sc.exe" start NATService
4⤵
- Launches sc.exe
PID:4328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic service NATService get state | more> C:\Users\Admin\AppData\Local\Temp\is-VJBSC.tmp\temp_cmd_result.txt
4⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic service NATService get state
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\SysWOW64\more.com
more
5⤵
PID:2244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C wmic service NATService get PathName | more> C:\Users\Admin\AppData\Local\Temp\is-VJBSC.tmp\temp_cmd_result.txt
4⤵
PID:1716

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic service NATService get PathName
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\SysWOW64\more.com
more
5⤵
PID:4740

C:\Program Files (x86)\FileJo\smmgr_setup.exe
"C:\Program Files (x86)\FileJo\smmgr_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
2⤵
- Executes dropped EXE
PID:2360

C:\Users\Admin\AppData\Local\Temp\is-GPVAV.tmp\smmgr_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GPVAV.tmp\smmgr_setup.tmp" /SL5="$A01BC,763801,58368,C:\Program Files (x86)\FileJo\smmgr_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1396

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\SManager\smmgr.exe" /grant Administrators:(OI)(CI)F /T
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2836

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\System32\icacls.exe" "C:\Program Files (x86)\SManager\sm.cnf" /grant Administrators:(OI)(CI)F /T
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4276

C:\Windows\SysWOW64\cmd.exe
"cmd" /c taskkill /f /im smmgr.exe
4⤵
PID:4336

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im smmgr.exe
5⤵
- Kills process with taskkill
PID:2576

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im smmgr.exe
4⤵
- Kills process with taskkill
PID:2468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c sc.exe create SmMgrDaemon binPath= "C:\Program Files (x86)\SManager\smmgr.exe" start= auto
4⤵
PID:4052

C:\Windows\SysWOW64\sc.exe
sc.exe create SmMgrDaemon binPath= "C:\Program Files (x86)\SManager\smmgr.exe" start= auto
5⤵
- Launches sc.exe
PID:2340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c net start SmMgrDaemon
4⤵
PID:4216

C:\Windows\SysWOW64\net.exe
net start SmMgrDaemon
5⤵
PID:4012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start SmMgrDaemon
6⤵
PID:4524

C:\Windows\SysWOW64\cmd.exe
"cmd" /c
4⤵
PID:1864

C:\Program Files (x86)\FileJo\FileJoPlayer_setup.exe
"C:\Program Files (x86)\FileJo\FileJoPlayer_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
2⤵
- Executes dropped EXE
PID:4508

C:\Users\Admin\AppData\Local\Temp\is-6R81A.tmp\FileJoPlayer_setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6R81A.tmp\FileJoPlayer_setup.tmp" /SL5="$B01BC,35900036,58368,C:\Program Files (x86)\FileJo\FileJoPlayer_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1592

C:\Windows\SysWOW64\sc.exe
sc create FileJoSvc start= "auto" binpath= "C:\Program Files (x86)\FileJo\FileJoService.exe"
2⤵
- Launches sc.exe
PID:540

C:\Windows\SysWOW64\sc.exe
sc start FileJoSvc
2⤵
- Launches sc.exe
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.filejo.com/
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8836f46f8,0x7ff8836f4708,0x7ff8836f4718
3⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
3⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
3⤵
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
3⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
3⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5160 /prefetch:8
3⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
3⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1
3⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
3⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6280 /prefetch:8
3⤵
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
3⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
3⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6712 /prefetch:8
3⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff7d2035460,0x7ff7d2035470,0x7ff7d2035480
4⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12489393331102530890,5721555969083027006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6712 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4316

C:\Program Files (x86)\NAT Service\natsvc.exe
"C:\Program Files (x86)\NAT Service\natsvc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4700

C:\Program Files (x86)\SManager\smmgr.exe
"C:\Program Files (x86)\SManager\smmgr.exe"
1⤵
- Executes dropped EXE
PID:1340

C:\Program Files (x86)\FileJo\FileJoService.exe
"C:\Program Files (x86)\FileJo\FileJoService.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4752

C:\Program Files (x86)\FileJo\FileJoLauncher.exe
"C:\Program Files (x86)\FileJo\FileJoLauncher.exe" ""
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5056

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c certutil -addstore "Root" "C:\Program Files (x86)\FileJo\rootCA.pem"
3⤵
PID:5028

C:\Windows\SysWOW64\certutil.exe
certutil -addstore "Root" "C:\Program Files (x86)\FileJo\rootCA.pem"
4⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.filejo.com/intro.php?joinid=simfile
1⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff8836f46f8,0x7ff8836f4708,0x7ff8836f4718
2⤵
PID:3620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FileJo\FileJoControl.dll

Filesize
2.1MB

MD5
2d1acdc1f8394e01693fd08028e21aba

SHA1
f25010f7d939be4c0eb24403733fa2d5a23cef86

SHA256
117865a6bd89f0200a496de3daf86226235a3a45c91837b3e3fe5bcf4fbecfa0

SHA512
c377f71454ee8cd696485e9e7a2c26133d595c704bef713d26316656279f9d1ed7149fd3ff8bf26cd80d523fee689e2b73a07bbd18ff236d3ee4ff226f03f086

Download Submit
C:\Program Files (x86)\FileJo\FileJoControl.dll

Filesize
2.1MB

MD5
2d1acdc1f8394e01693fd08028e21aba

SHA1
f25010f7d939be4c0eb24403733fa2d5a23cef86

SHA256
117865a6bd89f0200a496de3daf86226235a3a45c91837b3e3fe5bcf4fbecfa0

SHA512
c377f71454ee8cd696485e9e7a2c26133d595c704bef713d26316656279f9d1ed7149fd3ff8bf26cd80d523fee689e2b73a07bbd18ff236d3ee4ff226f03f086

Download Submit
C:\Program Files (x86)\FileJo\FileJoLauncher.exe

Filesize
3.1MB

MD5
232c02a546718a5fdb3e270bf15b355d

SHA1
90d2fed8df7aa9b0cefdf2a7d991445201c7f278

SHA256
ed82261d20b421ec97ecd3a3330627d9d44ba724014ff49f76f0a5c36b4529be

SHA512
fa4e73d89784a5f3d7611a346453db5be2d64752327a1cc8215c553e27a473389942465f3cce155e215366f47717f5f4b5fbed2428601ed4e90bd104f7125daa

Download Submit
C:\Program Files (x86)\FileJo\FileJoLauncher.exe

Filesize
3.1MB

MD5
232c02a546718a5fdb3e270bf15b355d

SHA1
90d2fed8df7aa9b0cefdf2a7d991445201c7f278

SHA256
ed82261d20b421ec97ecd3a3330627d9d44ba724014ff49f76f0a5c36b4529be

SHA512
fa4e73d89784a5f3d7611a346453db5be2d64752327a1cc8215c553e27a473389942465f3cce155e215366f47717f5f4b5fbed2428601ed4e90bd104f7125daa

Download Submit
C:\Program Files (x86)\FileJo\FileJoPlayer_setup.exe

Filesize
34.5MB

MD5
bd884a0754b2044a3a19cd7c959950a0

SHA1
216f0fe5273ca36bceda278311ec959afa8c3b43

SHA256
cf5bc40388d710f1731f3f72ce1421596c12d8ebe5e815d1dda94d46d448a907

SHA512
fd8f517709cdb92d4147ed85652f937caa948c33dabd6f43d997157ca55fdb89ce8ed23ac8f0ba947368f2c7f66cbfef3319403a27f4447ae2d4c8664b0db77d

Download Submit
C:\Program Files (x86)\FileJo\FileJoPlayer_setup.exe

Filesize
34.5MB

MD5
bd884a0754b2044a3a19cd7c959950a0

SHA1
216f0fe5273ca36bceda278311ec959afa8c3b43

SHA256
cf5bc40388d710f1731f3f72ce1421596c12d8ebe5e815d1dda94d46d448a907

SHA512
fd8f517709cdb92d4147ed85652f937caa948c33dabd6f43d997157ca55fdb89ce8ed23ac8f0ba947368f2c7f66cbfef3319403a27f4447ae2d4c8664b0db77d

Download Submit
C:\Program Files (x86)\FileJo\FileJoService.exe

Filesize
2.2MB

MD5
28c2a0405d4fd93880fd3f6d1375506e

SHA1
74c38aa619c8d7b8d7ab2c92af7925b4febfb0e3

SHA256
ff205d7dd88912aa9dc760457a2952a7dcd9b553ca1934fc2d3ac732bf1a8821

SHA512
c39a0563ad2f321d530f6bac886c67718fb831569623fd34ae684f4980abacb2d2ee0c95a5361ac79483951b32f66286e4075b03e09c84310b47dcc1fd15c862

Download Submit
C:\Program Files (x86)\FileJo\j_filejo_setup.exe

Filesize
1.8MB

MD5
4bce83f0e6b532b23f922a8b08b92320

SHA1
3faa7ef49a54cafd280aaeac8fdf41171aaa5747

SHA256
e8e7ba538dc5ca0dffdf3764abca71508b2878044da73b4595e6e4634841d9bb

SHA512
33abf52c133bf12d2bef417fbb624cdd966e6c80573b001c9da5bba51530a6839e6258c8d4a662966a52ddeb98d5827592478ad2f07475bc12d82611424c2aeb

Download Submit
C:\Program Files (x86)\FileJo\j_filejo_setup.exe

Filesize
1.8MB

MD5
4bce83f0e6b532b23f922a8b08b92320

SHA1
3faa7ef49a54cafd280aaeac8fdf41171aaa5747

SHA256
e8e7ba538dc5ca0dffdf3764abca71508b2878044da73b4595e6e4634841d9bb

SHA512
33abf52c133bf12d2bef417fbb624cdd966e6c80573b001c9da5bba51530a6839e6258c8d4a662966a52ddeb98d5827592478ad2f07475bc12d82611424c2aeb

Download Submit
C:\Program Files (x86)\FileJo\regsvr32.exe

Filesize
13KB

MD5
b34c14e51281dc05c19740556ac2b0bc

SHA1
0216d1d82452b752ae7594ab8a2921ec2dc01659

SHA256
6d7bcff6bf116b76dd41ce06342c5f1bc50d332f03e0fc39e3a09f6d7a158a9b

SHA512
26c79a36f43a602c1a22cd8a35d98298c9ed3667595919044c59f40c38b8a25835a1a2efef57f8d7ec38a4961bfd2d52b909b7f50a83a4a5ab4738efd9c60d13

Download Submit
C:\Program Files (x86)\FileJo\regsvr32.exe

Filesize
13KB

MD5
b34c14e51281dc05c19740556ac2b0bc

SHA1
0216d1d82452b752ae7594ab8a2921ec2dc01659

SHA256
6d7bcff6bf116b76dd41ce06342c5f1bc50d332f03e0fc39e3a09f6d7a158a9b

SHA512
26c79a36f43a602c1a22cd8a35d98298c9ed3667595919044c59f40c38b8a25835a1a2efef57f8d7ec38a4961bfd2d52b909b7f50a83a4a5ab4738efd9c60d13

Download Submit
C:\Program Files (x86)\FileJo\regsvr32.exe

Filesize
13KB

MD5
b34c14e51281dc05c19740556ac2b0bc

SHA1
0216d1d82452b752ae7594ab8a2921ec2dc01659

SHA256
6d7bcff6bf116b76dd41ce06342c5f1bc50d332f03e0fc39e3a09f6d7a158a9b

SHA512
26c79a36f43a602c1a22cd8a35d98298c9ed3667595919044c59f40c38b8a25835a1a2efef57f8d7ec38a4961bfd2d52b909b7f50a83a4a5ab4738efd9c60d13

Download Submit
C:\Program Files (x86)\FileJo\rootCA.pem

Filesize
1KB

MD5
d7cfb93d2379cfe229feffc7804d07c9

SHA1
c9e2ff9694795e2a732883f99ba2ff40d9fe556f

SHA256
b38443f514187e54ae506b3118bacd68da3cc0fb5628ba3dbbf2ee74e0688ba9

SHA512
702de71bd61a38519f7c5b602e95a7e029dc68ded10a46e9ff9b9dcf144e424f4619ebcc811f531dc3eac880cab0775130664c1d61abd3bf59918f3834bfb70a

Download Submit
C:\Program Files (x86)\FileJo\smmgr_setup.exe

Filesize
996KB

MD5
409255e1571810494132733ff18bac85

SHA1
7fec32e1f212e31f4eba5c7aa165909c10a63438

SHA256
b1d2b8b52aea94ca53f48f56fcaa0aa96a9b29c97f24cc1721904e3dffed7f93

SHA512
b3f2f02066cfd15090b48dc573e0f9c3d61c1bf73db98b697bf6128b0122baace470cf17054c7c63b397bcfbd2d63550b65f475e404bf05b9f7e212f6facf04a

Download Submit
C:\Program Files (x86)\FileJo\smmgr_setup.exe

Filesize
996KB

MD5
409255e1571810494132733ff18bac85

SHA1
7fec32e1f212e31f4eba5c7aa165909c10a63438

SHA256
b1d2b8b52aea94ca53f48f56fcaa0aa96a9b29c97f24cc1721904e3dffed7f93

SHA512
b3f2f02066cfd15090b48dc573e0f9c3d61c1bf73db98b697bf6128b0122baace470cf17054c7c63b397bcfbd2d63550b65f475e404bf05b9f7e212f6facf04a

Download Submit
C:\Program Files (x86)\NAT Service\libeay32.dll

Filesize
1.3MB

MD5
c99622fa718ca4c7212d83deec3f8fcc

SHA1
b09bbc7f5f010ab1d750b5290cf331b372cd7fae

SHA256
b3c8ebdefa0ac64ef123b360627001322af4e21e97e20df86ea16168877e5119

SHA512
3a2d0f9c35f019eebe25c7c4507c8c3764abbefab414555f111b08842cd6dc034cd2437d39d58620ce2c18ab0124317c552d1146beebc7e8f68465670d1d55fd

Download Submit
C:\Program Files (x86)\NAT Service\libeay32.dll

Filesize
1.3MB

MD5
c99622fa718ca4c7212d83deec3f8fcc

SHA1
b09bbc7f5f010ab1d750b5290cf331b372cd7fae

SHA256
b3c8ebdefa0ac64ef123b360627001322af4e21e97e20df86ea16168877e5119

SHA512
3a2d0f9c35f019eebe25c7c4507c8c3764abbefab414555f111b08842cd6dc034cd2437d39d58620ce2c18ab0124317c552d1146beebc7e8f68465670d1d55fd

Download Submit
C:\Program Files (x86)\NAT Service\libeay32.dll

Filesize
1.3MB

MD5
c99622fa718ca4c7212d83deec3f8fcc

SHA1
b09bbc7f5f010ab1d750b5290cf331b372cd7fae

SHA256
b3c8ebdefa0ac64ef123b360627001322af4e21e97e20df86ea16168877e5119

SHA512
3a2d0f9c35f019eebe25c7c4507c8c3764abbefab414555f111b08842cd6dc034cd2437d39d58620ce2c18ab0124317c552d1146beebc7e8f68465670d1d55fd

Download Submit
C:\Program Files (x86)\NAT Service\natsvc.exe

Filesize
4.4MB

MD5
39dc5d4f2ebbedfc73b9f8fbbfd63653

SHA1
7d160d580364eb9553c1dbdd28ee2ea9e572fefd

SHA256
e5ad1ba4458e6ad759c53dc292636af66774bb8487eb3859c42fb5816fd978a5

SHA512
ae5ebc04aa7f17913f7fa51bb8829015838f3ca4e2e103570f495efd4761de8cb4e53987a0b2190d639e550a1b9cd588edb136c89bb1d12b329f55fe90c96584

Download Submit
C:\Program Files (x86)\NAT Service\natsvc.exe

Filesize
4.4MB

MD5
39dc5d4f2ebbedfc73b9f8fbbfd63653

SHA1
7d160d580364eb9553c1dbdd28ee2ea9e572fefd

SHA256
e5ad1ba4458e6ad759c53dc292636af66774bb8487eb3859c42fb5816fd978a5

SHA512
ae5ebc04aa7f17913f7fa51bb8829015838f3ca4e2e103570f495efd4761de8cb4e53987a0b2190d639e550a1b9cd588edb136c89bb1d12b329f55fe90c96584

Download Submit
C:\Program Files (x86)\NAT Service\ssleay32.dll

Filesize
330KB

MD5
16b5d4d7641cddfc28748f48ae46ae4b

SHA1
9b4b30d36e816212da72313854dbabde80d2034a

SHA256
f82e938935108f9ed8411f8b567a618e24a0e25c63e36435538f3ac4f49822dc

SHA512
88c0e07ae26bf7d2e5fc1671cd37180089709416064b488d68e1700b9f5e2c7472a368baf96a60f369373612ca9d1d503b8d0a5ffe050862f306d8174a1ef7ef

Download Submit
C:\Program Files (x86)\NAT Service\ssleay32.dll

Filesize
330KB

MD5
16b5d4d7641cddfc28748f48ae46ae4b

SHA1
9b4b30d36e816212da72313854dbabde80d2034a

SHA256
f82e938935108f9ed8411f8b567a618e24a0e25c63e36435538f3ac4f49822dc

SHA512
88c0e07ae26bf7d2e5fc1671cd37180089709416064b488d68e1700b9f5e2c7472a368baf96a60f369373612ca9d1d503b8d0a5ffe050862f306d8174a1ef7ef

Download Submit
C:\Program Files (x86)\NAT Service\ssleay32.dll

Filesize
330KB

MD5
16b5d4d7641cddfc28748f48ae46ae4b

SHA1
9b4b30d36e816212da72313854dbabde80d2034a

SHA256
f82e938935108f9ed8411f8b567a618e24a0e25c63e36435538f3ac4f49822dc

SHA512
88c0e07ae26bf7d2e5fc1671cd37180089709416064b488d68e1700b9f5e2c7472a368baf96a60f369373612ca9d1d503b8d0a5ffe050862f306d8174a1ef7ef

Download Submit
C:\Program Files (x86)\SManager\smmgr.exe

Filesize
2.3MB

MD5
70517332e2fee9209a1f3ca2d03c0e5c

SHA1
74fdc4a444ef5383d0497967127fd85e4706f736

SHA256
250e229051ce2f9167a7019a43efe54b828038357c0732f5dd8279199667085e

SHA512
b93ea71011a0b51eef52ef10a281835417d7aef38a959942bed680fb78c4a7d24d797f5037d80801a9bf11073224a8f8bb53bd297dd8d84c5a9dad9046c97361

Download Submit
C:\Program Files (x86)\SManager\smmgr.exe

Filesize
2.3MB

MD5
70517332e2fee9209a1f3ca2d03c0e5c

SHA1
74fdc4a444ef5383d0497967127fd85e4706f736

SHA256
250e229051ce2f9167a7019a43efe54b828038357c0732f5dd8279199667085e

SHA512
b93ea71011a0b51eef52ef10a281835417d7aef38a959942bed680fb78c4a7d24d797f5037d80801a9bf11073224a8f8bb53bd297dd8d84c5a9dad9046c97361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8be9513fd38b94d4f6b5011b68b60326

SHA1
47feef421fe8de09e36ca685e9cf19d404aa8917

SHA256
5bf3203e8be948e62917ebab13e1b21aec105c473089b233874fac8e5748bb2d

SHA512
cb3dbfa46f3ee28956deab38fefa8276f9efa6ea978ff6b7f810f7f9ba106ed569f017cf5c840ae90fc5f83a1e6dbe50efef8e3412f4f38452a00915b2cc58bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6R81A.tmp\FileJoPlayer_setup.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6R81A.tmp\FileJoPlayer_setup.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GPVAV.tmp\smmgr_setup.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GPVAV.tmp\smmgr_setup.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KFV9H.tmp\j_filejo_setup.tmp

Filesize
697KB

MD5
832dab307e54aa08f4b6cdd9b9720361

SHA1
ebd007fb7482040ecf34339e4bf917209c1018df

SHA256
cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

SHA512
358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KFV9H.tmp\j_filejo_setup.tmp

Filesize
697KB

MD5
832dab307e54aa08f4b6cdd9b9720361

SHA1
ebd007fb7482040ecf34339e4bf917209c1018df

SHA256
cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

SHA512
358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VJBSC.tmp\insproc.dll

Filesize
1.0MB

MD5
be15b33cf62c3c7cee0abc8aa4c85048

SHA1
3371b48ac7625f9310dcb499027e013fd0a50546

SHA256
3069e91d1dba8e76416cc9a6281275c7a7275c96d6d9ff8f0cf7a9b5c8ea4e47

SHA512
57ee30c8458c78b3284333b7ef2bf32c40fdbf1c092f94a6f053f84b1ce578e277cd0176922a986283eba413db9f917e89207317fe8e98f212a648f0e906db1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VJBSC.tmp\insproc.dll

Filesize
1.0MB

MD5
be15b33cf62c3c7cee0abc8aa4c85048

SHA1
3371b48ac7625f9310dcb499027e013fd0a50546

SHA256
3069e91d1dba8e76416cc9a6281275c7a7275c96d6d9ff8f0cf7a9b5c8ea4e47

SHA512
57ee30c8458c78b3284333b7ef2bf32c40fdbf1c092f94a6f053f84b1ce578e277cd0176922a986283eba413db9f917e89207317fe8e98f212a648f0e906db1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VJBSC.tmp\temp_cmd_result.txt

Filesize
29B

MD5
e10468f29ada02cfdf46c43eb08f9184

SHA1
57e187278e35eb37407e53e372efae9f613dab01

SHA256
f7aedcb8d1ba35408e27d6ea406a266a091b2556abf04f9c1618879bb8ae5693

SHA512
e976c43c08da601b0dd91bfad2f5634f2adce0edbd1eaffda7b191e2e74691c274dd6de95ffdaf3c63c5319c617a76adb9ed8794346f1e5d92a01a2d2b7ddc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VJBSC.tmp\temp_cmd_result.txt

Filesize
109B

MD5
fecee4ec4769dbc908b7f506e8d35e82

SHA1
558e27aaf941092f852aaeaec03059abf814ce21

SHA256
d4ff7b03fd9fb4a201efb69519abc26d77520c1d2fe18ecc5ae23ffff32ddaef

SHA512
c19e42a0c9eb1f463496853e79765a75d792d5b284faf88d1817f25ae474f0c86341c64b6d1b36048f8dcada78b83ad8ebec6921f1ce6660a074d585bde106ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj79F9.tmp\FindProcDLL.dll

Filesize
31KB

MD5
83cd62eab980e3d64c131799608c8371

SHA1
5b57a6842a154997e31fab573c5754b358f5dd1c

SHA256
a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294

SHA512
91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj79F9.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj79F9.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj79F9.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj79F9.tmp\nsProcess.dll

Filesize
4KB

MD5
05450face243b3a7472407b999b03a72

SHA1
ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

SHA256
95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

SHA512
f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj79F9.tmp\termsDialog.dll

Filesize
12KB

MD5
e4fc52619a2c96a2e3340e778d44d034

SHA1
9d67a65b807439e4192649e3873371f138d403e4

SHA256
78aa52e6c1df91d9a5466c457d50321a446644f0e4dab6648ced9d8eb9a7bbc7

SHA512
24023e46665e344c6cbe580196ce29c7171c823279e26e1a3bea0c95ed879c810a8926bf2c1bc70b060a340cbe892546c674398915fff5236452b485252d2d8f

Download Submit
C:\Users\Admin\AppData\Roaming\41a8c5f7991b9357ad40b5ea8be35b67.bat

Filesize
180B

MD5
c694b6cca9500262bf41e4956a516fd9

SHA1
b47909bb9d7e4f0d41dd5dc7a956ff3ba427430f

SHA256
9e7588f8d30fdfbc23ce1bf48a6cf81e0d914cb200e0191c78a3f62b960cd467

SHA512
475bbc55c10af39e078786c3e7ed5b993e6705f52d160038c03ffde4953f16efcd0391cfbd74453a9185dec3fbdc9a9997520e2890d67e31ee21c11de44a75bd

Download Submit
C:\Users\Admin\AppData\Roaming\4207f3e54c11a1beff966348827fd31e.bat

Filesize
62B

MD5
d2189475ad941d2a2578e553143ebe73

SHA1
94b3c3829a5d0a489fda8b1453436104ca3f3ba9

SHA256
6da8e271ed5e2a0fc0947857bc1391efd2718082d0150023fd462c849c07fa0e

SHA512
b12506c0f514dcab72ace03a7b9822c192415a87b9196fbb85dbda7ae680a39c47f1f332c593888d088fe7482a6ed5a0a5c5b3700d6025c61a2afa432d08cf91

Download Submit
C:\Users\Admin\AppData\Roaming\4207f3e54c11a1beff966348827fd31e.bat

Filesize
21B

MD5
27ac015a9f8af8ccef64d955d21d1174

SHA1
004c2bb22540c544f042640e41d8d8305c429849

SHA256
8a278c1ea22969857fe614bb5bcdd3edfc085b40f60d0d5c198e22e229a86771

SHA512
42b3af5a8441b2e548e7243012d3e707e58e74e17a7dfca67493df8ef69a92ce2a5f33dac048812ee76b72d24f97115d3f188053562ee0abb055e6d6bc52cc9e

Download Submit
C:\Users\Admin\AppData\Roaming\a8cd4d627988b06ba74f633c7b520cc7.bat

Filesize
11B

MD5
db4ab8278cc5bacf4c54f658cb5613c0

SHA1
ba6ee96f2e5b876c3ca7ec35c880fca532b635e0

SHA256
9a180fff0ba28ef0972d09e89e40096e51038ea5a0089e3417d78dfff720566f

SHA512
167ae29061ad0b21653eadadca0e467d5e262f07961578ae45a74fe40de6833ec02bc1e5b7232fbaa8dc610b9943f306d1d391500cbf239c3c847c254e2212ab

Download Submit
C:\Users\Admin\AppData\Roaming\a8cd4d627988b06ba74f633c7b520cc7.bat

Filesize
105B

MD5
ee905332eb5d4b7c0300411614af8f95

SHA1
395357b2e5f5866d989ca63c1169a6103fd33734

SHA256
6ff79a4240ce92aa6b94241e39da3b43c1effd68f1d2760229628aa4217f7c70

SHA512
6478168b740c657369fd056c2d05dcc0665873604bd7de2fbb4b8e4f017cf866243e04b482633d995d5c82a65b6448ee64f7efdef38222ceecbe933a880f5503

Download Submit
\??\pipe\LOCAL\crashpad_1092_WIJXIENSFOOPHETL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/224-186-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/224-157-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/224-149-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/224-147-0x0000000000000000-mapping.dmp

Download
memory/516-242-0x0000000000000000-mapping.dmp

Download
memory/540-169-0x0000000000000000-mapping.dmp

Download
memory/540-220-0x0000000000000000-mapping.dmp

Download
memory/552-248-0x0000000000000000-mapping.dmp

Download
memory/992-179-0x0000000000000000-mapping.dmp

Download
memory/1092-233-0x0000000000000000-mapping.dmp

Download
memory/1288-234-0x0000000000000000-mapping.dmp

Download
memory/1396-193-0x0000000000000000-mapping.dmp

Download
memory/1496-145-0x0000000000000000-mapping.dmp

Download
memory/1592-216-0x0000000000000000-mapping.dmp

Download
memory/1596-161-0x0000000000000000-mapping.dmp

Download
memory/1700-237-0x0000000000000000-mapping.dmp

Download
memory/1716-182-0x0000000000000000-mapping.dmp

Download
memory/1864-208-0x0000000000000000-mapping.dmp

Download
memory/1924-263-0x0000000000000000-mapping.dmp

Download
memory/1932-244-0x0000000000000000-mapping.dmp

Download
memory/1956-152-0x0000000000000000-mapping.dmp

Download
memory/1956-156-0x0000000003920000-0x0000000003A30000-memory.dmp

Filesize
1.1MB

Download
memory/1984-254-0x0000000000000000-mapping.dmp

Download
memory/2204-178-0x0000000000000000-mapping.dmp

Download
memory/2244-180-0x0000000000000000-mapping.dmp

Download
memory/2340-202-0x0000000000000000-mapping.dmp

Download
memory/2352-221-0x0000000000000000-mapping.dmp

Download
memory/2352-260-0x0000000000000000-mapping.dmp

Download
memory/2360-209-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2360-189-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2360-192-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2360-187-0x0000000000000000-mapping.dmp

Download
memory/2468-199-0x0000000000000000-mapping.dmp

Download
memory/2484-163-0x0000000000000000-mapping.dmp

Download
memory/2520-236-0x0000000000000000-mapping.dmp

Download
memory/2544-240-0x0000000000000000-mapping.dmp

Download
memory/2548-174-0x0000000000000000-mapping.dmp

Download
memory/2576-198-0x0000000000000000-mapping.dmp

Download
memory/2776-246-0x0000000000000000-mapping.dmp

Download
memory/2836-195-0x0000000000000000-mapping.dmp

Download
memory/2880-258-0x0000000000000000-mapping.dmp

Download
memory/2972-140-0x0000000000000000-mapping.dmp

Download
memory/3124-231-0x0000000000000000-mapping.dmp

Download
memory/3256-173-0x0000000000000000-mapping.dmp

Download
memory/3484-166-0x0000000000000000-mapping.dmp

Download
memory/3620-251-0x0000000000000000-mapping.dmp

Download
memory/3700-158-0x0000000000000000-mapping.dmp

Download
memory/4012-204-0x0000000000000000-mapping.dmp

Download
memory/4052-201-0x0000000000000000-mapping.dmp

Download
memory/4064-264-0x0000000000000000-mapping.dmp

Download
memory/4160-162-0x0000000000000000-mapping.dmp

Download
memory/4216-203-0x0000000000000000-mapping.dmp

Download
memory/4224-135-0x0000000000000000-mapping.dmp

Download
memory/4276-196-0x0000000000000000-mapping.dmp

Download
memory/4288-168-0x0000000000000000-mapping.dmp

Download
memory/4316-265-0x0000000000000000-mapping.dmp

Download
memory/4328-175-0x0000000000000000-mapping.dmp

Download
memory/4336-197-0x0000000000000000-mapping.dmp

Download
memory/4508-210-0x0000000000000000-mapping.dmp

Download
memory/4508-219-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4508-215-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4508-212-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4524-205-0x0000000000000000-mapping.dmp

Download
memory/4548-262-0x0000000000000000-mapping.dmp

Download
memory/4596-160-0x0000000000000000-mapping.dmp

Download
memory/4740-184-0x0000000000000000-mapping.dmp

Download
memory/4768-256-0x0000000000000000-mapping.dmp

Download
memory/4920-136-0x0000000000000000-mapping.dmp

Download
memory/4968-183-0x0000000000000000-mapping.dmp

Download
memory/5020-171-0x0000000000000000-mapping.dmp

Download
memory/5028-226-0x0000000000000000-mapping.dmp

Download
memory/5056-223-0x0000000000000000-mapping.dmp

Download