99842928d56ef4c03fa17ec47538b1527d25d4b4644e157628475426cdb7acde

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
26-01-2023 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup_File_Magic_2020.exe
Size

1.2MB
MD5

8f2c8356efa99b8b91b11741f6834602
SHA1

c2a4bb8ef0c785e14e624f0a27045803c9aeb03b
SHA256

99842928d56ef4c03fa17ec47538b1527d25d4b4644e157628475426cdb7acde
SHA512

333bca23e0fe61d2b35bfb383bfaf9aa6582e58b18365c395eeaa90b00482ad13ebf09039e6f9c9dc9e82e13bb4d16991a23a5b477b24f7359403dec808ed421
SSDEEP

24576:eoyyzDBXE5OljBjauSRJZXCi2GpnXZK1PMUOcIa3oz4Yk45cIpBss:tyIdtvBGpn01ucVA4Y7Bss

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

FileMagic-S-1.9.8.19.exeFileMagic-S-1.9.8.19.tmpFileMagic.exeFileMagic.exe

pid process

1296 FileMagic-S-1.9.8.19.exe
1136 FileMagic-S-1.9.8.19.tmp
968 FileMagic.exe
2888 FileMagic.exe

pid	process
1296	FileMagic-S-1.9.8.19.exe
1136	FileMagic-S-1.9.8.19.tmp
968	FileMagic.exe
2888	FileMagic.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup_File_Magic_2020.exeFileMagic.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Setup_File_Magic_2020.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	FileMagic.exe

Loads dropped DLL 33 IoCs

Processes:

FileMagic-S-1.9.8.19.tmpFileMagic.exeFileMagic.exe

pid	process
1136	FileMagic-S-1.9.8.19.tmp
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
968	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe
2888	FileMagic.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

FileMagic-S-1.9.8.19.tmpsetup.exe

description	ioc	process
File opened for modification	C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-OI9CB.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-9BLHF.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.Pdf.v18.1.Drawing.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-TO14U.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-HT8ET.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.DataAccess.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-0MH1G.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-PSKBN.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\PaintDotNet.Resources.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-2IIOF.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-UTOEL.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-S4V12.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3a80ed56-6b7f-4b60-93f6-3db0f946d42e.tmp	setup.exe
File opened for modification	C:\Program Files\File Magic\DevExpress.XtraRichEdit.v18.1.Extensions.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-POMUK.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.XtraBars.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\PaintDotNet.Core.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-BK766.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\language\typescript\src\is-KN7DD.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Resources.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-R6N9K.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\editor\is-4ONIJ.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\ICSharpCode.SharpZipLib.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Views.Document.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-L5M23.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Views.Mime.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-1A98P.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-TKVI6.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-1JD92.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-JEQI1.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-21FDN.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-QG9K5.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-R5FHS.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-RES6O.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\Word.Resources.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\editor\is-E7MRJ.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Views.Wps.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\QlmLicenseLib.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-ENR1T.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-Q7OBS.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-UHD9J.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Views.Media.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-6A06R.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\editor\contrib\suggest\browser\is-7VC58.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-5H016.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SDL.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-R6SM3.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-TC28E.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-6NMG6.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-NL1IB.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-R86B9.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.XtraPrinting.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Licensing.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-28601.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-16AIL.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\editor\is-2D59T.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-3T611.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.Office.v18.1.Core.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-DAH56.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\is-CUJO7.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\O2S.Components.PDFRender4NET.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-NH8BS.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\language\html\is-QDSTJ.tmp	FileMagic-S-1.9.8.19.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

FileMagic.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	FileMagic.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	FileMagic.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	FileMagic.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

FileMagic-S-1.9.8.19.tmpmsedge.exemsedge.exeidentity_helper.exe

pid	process
1136	FileMagic-S-1.9.8.19.tmp
1136	FileMagic-S-1.9.8.19.tmp
804	msedge.exe
804	msedge.exe
1932	msedge.exe
1932	msedge.exe
2764	identity_helper.exe
2764	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

FileMagic.exe

pid process

2888 FileMagic.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1932 msedge.exe
1932 msedge.exe
1932 msedge.exe
1932 msedge.exe
1932 msedge.exe
1932 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FileMagic.exe

description pid process

Token: SeDebugPrivilege 2888 FileMagic.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

FileMagic-S-1.9.8.19.tmpmsedge.exe

pid process

1136 FileMagic-S-1.9.8.19.tmp
1932 msedge.exe
1932 msedge.exe

pid	process
2888	FileMagic.exe

pid	process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

description	pid	process
Token: SeDebugPrivilege	2888	FileMagic.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

Setup_File_Magic_2020.exeFileMagic.exe

pid	process
1732	Setup_File_Magic_2020.exe
1732	Setup_File_Magic_2020.exe
1732	Setup_File_Magic_2020.exe
1732	Setup_File_Magic_2020.exe
1732	Setup_File_Magic_2020.exe
2888	FileMagic.exe
2888	FileMagic.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup_File_Magic_2020.exeFileMagic-S-1.9.8.19.exeFileMagic-S-1.9.8.19.tmpmsedge.exe

description	pid	process	target process
PID 1732 wrote to memory of 1296	1732	Setup_File_Magic_2020.exe	FileMagic-S-1.9.8.19.exe
PID 1732 wrote to memory of 1296	1732	Setup_File_Magic_2020.exe	FileMagic-S-1.9.8.19.exe
PID 1732 wrote to memory of 1296	1732	Setup_File_Magic_2020.exe	FileMagic-S-1.9.8.19.exe
PID 1296 wrote to memory of 1136	1296	FileMagic-S-1.9.8.19.exe	FileMagic-S-1.9.8.19.tmp
PID 1296 wrote to memory of 1136	1296	FileMagic-S-1.9.8.19.exe	FileMagic-S-1.9.8.19.tmp
PID 1296 wrote to memory of 1136	1296	FileMagic-S-1.9.8.19.exe	FileMagic-S-1.9.8.19.tmp
PID 1136 wrote to memory of 1932	1136	FileMagic-S-1.9.8.19.tmp	msedge.exe
PID 1136 wrote to memory of 1932	1136	FileMagic-S-1.9.8.19.tmp	msedge.exe
PID 1136 wrote to memory of 968	1136	FileMagic-S-1.9.8.19.tmp	FileMagic.exe
PID 1136 wrote to memory of 968	1136	FileMagic-S-1.9.8.19.tmp	FileMagic.exe
PID 1136 wrote to memory of 968	1136	FileMagic-S-1.9.8.19.tmp	FileMagic.exe
PID 1932 wrote to memory of 3468	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 3468	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 4012	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 804	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 804	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe
PID 1932 wrote to memory of 368	1932	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Setup_File_Magic_2020.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_File_Magic_2020.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\{F7B1CC79-0983-4864-953C-092B34445C3F}\FileMagic-S-1.9.8.19.exe
"C:\Users\Admin\AppData\Local\Temp\{F7B1CC79-0983-4864-953C-092B34445C3F}\FileMagic-S-1.9.8.19.exe" /verysilent /norestart /LANG es
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296

C:\Users\Admin\AppData\Local\Temp\is-32N0C.tmp\FileMagic-S-1.9.8.19.tmp
"C:\Users\Admin\AppData\Local\Temp\is-32N0C.tmp\FileMagic-S-1.9.8.19.tmp" /SL5="$4017C,60285589,131584,C:\Users\Admin\AppData\Local\Temp\{F7B1CC79-0983-4864-953C-092B34445C3F}\FileMagic-S-1.9.8.19.exe" /verysilent /norestart /LANG es
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.solvusoft.com/es/file-magic/install/?utm_source=file-magic&utm_campaign=version_1.9.8.19_06042019&utm_medium=file-magic-standalone
4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffd352446f8,0x7ffd35244708,0x7ffd35244718
5⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
5⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=3048 /prefetch:8
5⤵
PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
5⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
5⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5308 /prefetch:8
5⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
5⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
5⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5768 /prefetch:8
5⤵
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
5⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --disable-gpu-compositing --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
5⤵
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
5⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
- Drops file in Program Files directory
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1e8,0x22c,0x7ff62f4d5460,0x7ff62f4d5470,0x7ff62f4d5480
6⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=1280 /prefetch:8
5⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
5⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,9262823664419992963,17218498905630549802,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
5⤵
PID:4168

C:\Program Files\File Magic\FileMagic.exe
"C:\Program Files\File Magic\FileMagic.exe" /restartWithNoAdminRights lang=sp
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
PID:968

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe" C:\Program Files\File Magic\FileMagic.exe
5⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2808

C:\Program Files\File Magic\FileMagic.exe
"C:\Program Files\File Magic\FileMagic.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\FileMagic.exe

Filesize
693KB

MD5
9d39755e575708ff21df4eef3c2f8c8a

SHA1
4c53bbf1ccfb764b07627fdea4bb48d405bcf609

SHA256
3c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118

SHA512
2b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed

Download Submit
C:\Program Files\File Magic\FileMagic.exe

Filesize
693KB

MD5
9d39755e575708ff21df4eef3c2f8c8a

SHA1
4c53bbf1ccfb764b07627fdea4bb48d405bcf609

SHA256
3c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118

SHA512
2b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed

Download Submit
C:\Program Files\File Magic\FileMagic.exe

Filesize
693KB

MD5
9d39755e575708ff21df4eef3c2f8c8a

SHA1
4c53bbf1ccfb764b07627fdea4bb48d405bcf609

SHA256
3c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118

SHA512
2b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed

Download Submit
C:\Program Files\File Magic\FileMagic.exe.config

Filesize
3KB

MD5
4e73c4ff8ea09cdc528e5eea378b9c89

SHA1
e3974580154b5897441a68b3a14bae74fbfab14d

SHA256
7c90b0bbb693a95518b394ff9fe96f975b1290cf51c017a4a8b5ef669d91e916

SHA512
155962cd814ded2d3d4d4120e8f5774fc381fdb8bf2aecc04e2c0ac84ea2079428f34f60890ad78c627164d33c7f82517750a116e70b00e1aea6e79ae8c32ce3

Download Submit
C:\Program Files\File Magic\IsLicense50.dll

Filesize
2.2MB

MD5
5949dea9a38e8bbc54db0144c705f966

SHA1
5ee6e072d548d27fd6fceddecbf26efc2f8debb5

SHA256
28dfb39347dc485290a0a2a59d6fa7d9a4ea5842b835191fd80bd85326c912f6

SHA512
f28d8987b2a78010fa0ac67dac2cbf4e1b3a14c003f14f0213706672dad03899cf182ba9ed5118aaa4781452b57f325400542e93d2669fad8d283b3f3899accb

Download Submit
C:\Program Files\File Magic\IsLicense50.dll

Filesize
2.2MB

MD5
5949dea9a38e8bbc54db0144c705f966

SHA1
5ee6e072d548d27fd6fceddecbf26efc2f8debb5

SHA256
28dfb39347dc485290a0a2a59d6fa7d9a4ea5842b835191fd80bd85326c912f6

SHA512
f28d8987b2a78010fa0ac67dac2cbf4e1b3a14c003f14f0213706672dad03899cf182ba9ed5118aaa4781452b57f325400542e93d2669fad8d283b3f3899accb

Download Submit
C:\Program Files\File Magic\IsLicense50.dll

Filesize
2.2MB

MD5
5949dea9a38e8bbc54db0144c705f966

SHA1
5ee6e072d548d27fd6fceddecbf26efc2f8debb5

SHA256
28dfb39347dc485290a0a2a59d6fa7d9a4ea5842b835191fd80bd85326c912f6

SHA512
f28d8987b2a78010fa0ac67dac2cbf4e1b3a14c003f14f0213706672dad03899cf182ba9ed5118aaa4781452b57f325400542e93d2669fad8d283b3f3899accb

Download Submit
C:\Program Files\File Magic\LangsFileMagic\es.xml

Filesize
87KB

MD5
ca4ae0f35b2aa819fa1b93896409ec24

SHA1
82253cbdb936891710b6116175d14150b16b6f6a

SHA256
da65b1cdc723fd0ef002104f2bba444e40e0e27ce76a39d70a9f852b39e32910

SHA512
56683ccd5a417b226d44b5adb4b7f48a42fbc879f51a0a8680767ff51780aabd65802dc2103051c27d2c333e85d44f28461372400021427f4140d8466278a69e

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\SolvuSoft.Common.dll

Filesize
354KB

MD5
468cb5c21e24945949ee281c32815462

SHA1
31325ef4fb97f122f9f6bb38a4212a554ab39efd

SHA256
9db9c6e67416236d1d34ef67df528cb8b725761c12acfcf75f97512787358b2b

SHA512
5081ac485ffa6a8354347c0ee9ca0b8a68613a92770a4bc5c92b30e66834f5c54bcb19e8c87cd6302d4294d008866799ca1c9821fa642b84473726aa80e06b1f

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\ProgramData\IsolatedStorage\andpqw05.1u4\3thnywcu.ggw\Publisher.hobc41kkywtcc0rbz1btlitztrczryui\identity.dat

Filesize
1KB

MD5
05c9f19b4efe1e17616a590bf7ba78b4

SHA1
0b6af11405461794316cca1ba03f04e48368856a

SHA256
2065f492126f161ac0583f22dd1b72240bbee3d763d6a9e0d1eb365b8d9c9ff1

SHA512
e96f2b0c106dcc948225e34c867a23b8f2ec503cd9711a2a6cb4e90cedde8630530147fa4326044d19d9fe95ff45215edc29f2e72b5a6ac93dbc7da839819fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17

Filesize
2KB

MD5
076f42d4cccda26e5d66f84f1e02078d

SHA1
c452d8acd04868869dd9504a94d700bd1a88491d

SHA256
661f9caf475df3d97a207baacf5211e00a5f0699c302699a2835993d8410d99f

SHA512
98b50d0f5f4ba41dd82a21959104e4b532dee0c451447353f947e0715c9b8c7fbe97b8b26d2131acdb851e1ad9e4659200b3fc9324778bd860b1bda5f81d201e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
5f37048de717939db22879d186493d92

SHA1
f2fac6a9a6261397d648aec0d3f7f2ead3ae023d

SHA256
31f3c6aa02743ff82e7fe54bcf5c3005406d9dc4858993cc4762f33f13198c37

SHA512
1188df5bbfa21db355b5bf124db2949ac6d75fa95d8aa03158b1b1bd17dd5077ee1a68691ea5e8ca866f5bb4bd8dacdba80a0d1e4005de6bfc5d9499b770acc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_C8F25AE27487A9B785CB8B5A011F38CA

Filesize
509B

MD5
4e97fa37cd44e8d33e2e34708b651e6c

SHA1
c58d3517a4403b81ddf42f0fe3eefaff69d18fed

SHA256
494399cdbc82862ba2f424d0b18a2edc440e13d5c628297d8aa2b9248b170323

SHA512
b86470157cf84d90c6f0b0e61de84c92f09f30668182e2bbfda6a8144666ccbe2d90083d2b09efce58897dfa7ac3ca311bd8359a98dc65c67120416908751b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17

Filesize
488B

MD5
8c06a17fddb27e7470d9d37744c2864b

SHA1
632de043e192a166a83cbe231e0cd928b1d6af30

SHA256
fe4a978f56db2a921aba3a247c28746ee42aff95469b583c69ea6fc2f3c069b2

SHA512
c686275560e5869676b942c32d4bac1920a746501528bdc1f655001bce43ffad15a9dc9acc6a177803d245ab4c341f79cc9362275c7e552a8f38a833efe7cc2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
5f6e42bf5f8e576608ee1c4a4328224b

SHA1
145897fcbc957ce9b2ef058a3abf1ae846c0fb1f

SHA256
c7baedeae5f2ad491770447522ddfcad3400e06d71945067ff79bccfc90d697a

SHA512
d76193d426ac644d0a17c07d15de8c1cee453d3a072d67c6fb925145d0c2bb9239afd665182c99d7f3b5c3d18756334f48c86ea2a5d89a124695d5e0c188d7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_C8F25AE27487A9B785CB8B5A011F38CA

Filesize
480B

MD5
c5e7e7581cf416c09a1cf63431f2b065

SHA1
54d0320c1b1538fe892f2c3b5f4a94eff6ab5588

SHA256
488a8727875f468b00488f709799a0229d8192f77c5132f8845385c9685032f1

SHA512
4315c67310fa41956c07e2c5fe8987edc7c07d0f250204df39f4262415ef3f51bcf482feacbf6364fb26c73de7d6d33a7c00f5f91a9adf0f086dadffb62d72af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FileMagic.exe.log

Filesize
1KB

MD5
f340950db4fc6a28fa548a4cbc1053d6

SHA1
0e43647f2f4c47e6ddeb90ef8f5a06e958a8afde

SHA256
cb9a83ea79439b672853eca4deb6135f5e3af5d10787c52542364d62893f6e03

SHA512
dbe41975581a4b625f48c10a58741cbda368b55905de64d41dbcf36c81d0a5487fc36556d776d2578606978328fc1365dcf20bbb90d4e99d2583a5eb01aff67d

Download Submit
C:\Users\Admin\AppData\Local\Solvusoft_Corporation\FileMagic.exe_Url_sdoseg0s0kj31nlznxgcytyyqrzs2u5a\1.9.8.19\user.config

Filesize
1KB

MD5
109ba1a058717e1322aa5f45d1106f9b

SHA1
a81648558aeac87c59a78fda7e458fb2a0dda14f

SHA256
b935200854fd87dbbb585d7e64217511e21f89bdc081aa4e798399d841334203

SHA512
bd97b3465fcc7623ee299f91a76a4b62b95fd2879baadc42ff69638fbc505c63b677265369938f0b24bac1effc32939988a65de5fae24f3abf84f0882a3c3cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-32N0C.tmp\FileMagic-S-1.9.8.19.tmp

Filesize
1.1MB

MD5
034641d201844aa7f133e69aa72274ac

SHA1
050b02112b1e22cf8a310e5cd3b19afa993473ce

SHA256
f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0

SHA512
78066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-32N0C.tmp\FileMagic-S-1.9.8.19.tmp

Filesize
1.1MB

MD5
034641d201844aa7f133e69aa72274ac

SHA1
050b02112b1e22cf8a310e5cd3b19afa993473ce

SHA256
f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0

SHA512
78066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-F155E.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F7B1CC79-0983-4864-953C-092B34445C3F}\FileMagic-S-1.9.8.19.exe

Filesize
58.1MB

MD5
6bba1a3f0115ea3604f87d92e6cb925e

SHA1
e489aef3f3448354ca315dc9840cd58918ce2bea

SHA256
c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88

SHA512
228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F7B1CC79-0983-4864-953C-092B34445C3F}\FileMagic-S-1.9.8.19.exe

Filesize
58.1MB

MD5
6bba1a3f0115ea3604f87d92e6cb925e

SHA1
e489aef3f3448354ca315dc9840cd58918ce2bea

SHA256
c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88

SHA512
228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5

Download Submit
C:\Users\Admin\AppData\Roaming\IsolatedStorage\Publisher.hobc41kkywtcc0rbz1btlitztrczryui\identity.dat

Filesize
1KB

MD5
05c9f19b4efe1e17616a590bf7ba78b4

SHA1
0b6af11405461794316cca1ba03f04e48368856a

SHA256
2065f492126f161ac0583f22dd1b72240bbee3d763d6a9e0d1eb365b8d9c9ff1

SHA512
e96f2b0c106dcc948225e34c867a23b8f2ec503cd9711a2a6cb4e90cedde8630530147fa4326044d19d9fe95ff45215edc29f2e72b5a6ac93dbc7da839819fb3

Download Submit
\??\pipe\LOCAL\crashpad_1932_GJQCLIKZHDEYJHJU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/368-168-0x0000000000000000-mapping.dmp

Download
memory/380-199-0x0000000000000000-mapping.dmp

Download
memory/804-162-0x0000000000000000-mapping.dmp

Download
memory/968-161-0x0000000005E70000-0x0000000006AE2000-memory.dmp

Filesize
12.4MB

Download
memory/968-179-0x0000000005AA0000-0x0000000005AEE000-memory.dmp

Filesize
312KB

Download
memory/968-200-0x0000000007660000-0x000000000768E000-memory.dmp

Filesize
184KB

Download
memory/968-201-0x00000000090F0000-0x0000000009128000-memory.dmp

Filesize
224KB

Download
memory/968-149-0x00000000003A0000-0x0000000000454000-memory.dmp

Filesize
720KB

Download
memory/968-154-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Filesize
40KB

Download
memory/968-144-0x0000000000000000-mapping.dmp

Download
memory/968-169-0x0000000008160000-0x00000000087C2000-memory.dmp

Filesize
6.4MB

Download
memory/968-173-0x0000000005610000-0x0000000005630000-memory.dmp

Filesize
128KB

Download
memory/968-155-0x0000000005140000-0x0000000005196000-memory.dmp

Filesize
344KB

Download
memory/968-191-0x0000000007370000-0x000000000743E000-memory.dmp

Filesize
824KB

Download
memory/968-152-0x0000000009A50000-0x0000000009FF4000-memory.dmp

Filesize
5.6MB

Download
memory/968-150-0x0000000009400000-0x000000000949C000-memory.dmp

Filesize
624KB

Download
memory/968-190-0x0000000007210000-0x000000000729A000-memory.dmp

Filesize
552KB

Download
memory/968-197-0x0000000007950000-0x000000000796E000-memory.dmp

Filesize
120KB

Download
memory/968-184-0x00000000098A0000-0x00000000099A2000-memory.dmp

Filesize
1.0MB

Download
memory/968-153-0x0000000004FB0000-0x0000000005042000-memory.dmp

Filesize
584KB

Download
memory/1136-137-0x0000000000000000-mapping.dmp

Download
memory/1296-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1296-132-0x0000000000000000-mapping.dmp

Download
memory/1296-151-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1296-134-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1296-142-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1932-143-0x0000000000000000-mapping.dmp

Download
memory/2344-202-0x0000000000000000-mapping.dmp

Download
memory/2408-183-0x0000000000000000-mapping.dmp

Download
memory/2408-241-0x0000000000000000-mapping.dmp

Download
memory/2416-175-0x0000000000000000-mapping.dmp

Download
memory/2480-213-0x0000000000000000-mapping.dmp

Download
memory/2560-186-0x0000000000000000-mapping.dmp

Download
memory/2656-181-0x0000000000000000-mapping.dmp

Download
memory/2764-242-0x0000000000000000-mapping.dmp

Download
memory/2888-239-0x0000000007890000-0x00000000078B0000-memory.dmp

Filesize
128KB

Download
memory/2888-236-0x0000000007740000-0x000000000779E000-memory.dmp

Filesize
376KB

Download
memory/2888-203-0x0000000000000000-mapping.dmp

Download
memory/2888-237-0x000000000A360000-0x000000000A984000-memory.dmp

Filesize
6.1MB

Download
memory/2888-238-0x000000000A990000-0x000000000AF94000-memory.dmp

Filesize
6.0MB

Download
memory/3468-148-0x0000000000000000-mapping.dmp

Download
memory/4012-160-0x0000000000000000-mapping.dmp

Download
memory/4156-233-0x0000000000000000-mapping.dmp

Download
memory/4168-248-0x0000000000000000-mapping.dmp

Download
memory/4928-240-0x0000000000000000-mapping.dmp

Download
memory/4964-244-0x0000000000000000-mapping.dmp

Download
memory/4968-231-0x0000000000000000-mapping.dmp

Download
memory/5068-246-0x0000000000000000-mapping.dmp

Download