Analysis
-
max time kernel
1845s -
max time network
1848s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
15-02-2023 03:52
General
-
Target
Setup_File_Magic_2022.exe
-
Size
1.2MB
-
MD5
8f2c8356efa99b8b91b11741f6834602
-
SHA1
c2a4bb8ef0c785e14e624f0a27045803c9aeb03b
-
SHA256
99842928d56ef4c03fa17ec47538b1527d25d4b4644e157628475426cdb7acde
-
SHA512
333bca23e0fe61d2b35bfb383bfaf9aa6582e58b18365c395eeaa90b00482ad13ebf09039e6f9c9dc9e82e13bb4d16991a23a5b477b24f7359403dec808ed421
-
SSDEEP
24576:eoyyzDBXE5OljBjauSRJZXCi2GpnXZK1PMUOcIa3oz4Yk45cIpBss:tyIdtvBGpn01ucVA4Y7Bss
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 54 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 45 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_File_Magic_2022.exe"C:\Users\Admin\AppData\Local\Temp\Setup_File_Magic_2022.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exe"C:\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exe" /verysilent /norestart /LANG en-us2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-O6MJN.tmp\FileMagic-S-1.9.8.19.tmp"C:\Users\Admin\AppData\Local\Temp\is-O6MJN.tmp\FileMagic-S-1.9.8.19.tmp" /SL5="$2017E,60285589,131584,C:\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exe" /verysilent /norestart /LANG en-us3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.solvusoft.com/en-us/file-magic/install/?utm_source=file-magic&utm_campaign=version_1.9.8.19_06042019&utm_medium=file-magic-standalone4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\File Magic\FileMagic.exe"C:\Program Files\File Magic\FileMagic.exe" /restartWithNoAdminRights lang=en-us4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Program Files\File Magic\FileMagic.exe5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef65e4f50,0x7fef65e4f60,0x7fef65e4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3448 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3784 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1000 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3880 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3836 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2764 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1928 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=988 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3248 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=824 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3300 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1036 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3856 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1000 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,10579446978524141349,4912600705073241262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1828 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef65e4f50,0x7fef65e4f60,0x7fef65e4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1004,1011099394518587041,9716857869329038414,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1004,1011099394518587041,9716857869329038414,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1392 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\File Magic\FileMagic.exe"C:\Program Files\File Magic\FileMagic.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2892_1032923539\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2892_1032923539\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={2a397a80-7da7-4c56-8410-eed16f251858} --system2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\File Magic\DevExpress.Data.v18.1.dllFilesize
6.4MB
MD575e4c5f9581ef853d787961cf4f8830f
SHA104615d07cd402692f5c1a35474fc9ae01a1cb3cb
SHA256a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209
SHA51202efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b
-
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dllFilesize
12.4MB
MD5c5420b084a69cc5783d15bd9ee77d707
SHA1ed47a4da79ce18af598a416633f4b9d9a032464e
SHA2561a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84
SHA51253994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e
-
C:\Program Files\File Magic\FileMagic.exeFilesize
693KB
MD59d39755e575708ff21df4eef3c2f8c8a
SHA14c53bbf1ccfb764b07627fdea4bb48d405bcf609
SHA2563c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118
SHA5122b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed
-
C:\Program Files\File Magic\FileMagic.exeFilesize
693KB
MD59d39755e575708ff21df4eef3c2f8c8a
SHA14c53bbf1ccfb764b07627fdea4bb48d405bcf609
SHA2563c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118
SHA5122b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed
-
C:\Program Files\File Magic\FileMagic.exe.configFilesize
3KB
MD54e73c4ff8ea09cdc528e5eea378b9c89
SHA1e3974580154b5897441a68b3a14bae74fbfab14d
SHA2567c90b0bbb693a95518b394ff9fe96f975b1290cf51c017a4a8b5ef669d91e916
SHA512155962cd814ded2d3d4d4120e8f5774fc381fdb8bf2aecc04e2c0ac84ea2079428f34f60890ad78c627164d33c7f82517750a116e70b00e1aea6e79ae8c32ce3
-
C:\Program Files\File Magic\IsLicense50.dllFilesize
2.2MB
MD55949dea9a38e8bbc54db0144c705f966
SHA15ee6e072d548d27fd6fceddecbf26efc2f8debb5
SHA25628dfb39347dc485290a0a2a59d6fa7d9a4ea5842b835191fd80bd85326c912f6
SHA512f28d8987b2a78010fa0ac67dac2cbf4e1b3a14c003f14f0213706672dad03899cf182ba9ed5118aaa4781452b57f325400542e93d2669fad8d283b3f3899accb
-
C:\Program Files\File Magic\QlmLicenseLib.dllFilesize
530KB
MD59bee3b92a4f2b257274200913438ec0e
SHA12c01d251f44565f916b06c40c2d01bd61ce6e33d
SHA256d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99
SHA512df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a
-
C:\Program Files\File Magic\SolvuSoft.Licensing.dllFilesize
283KB
MD52a31ac2f0f94571165e54d6bddaba0d9
SHA1d250106e535762ebd529884ecc517a9f5867dd4f
SHA256f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65
SHA512745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38
-
C:\Program Files\File Magic\SolvuSoft.Localization.dllFilesize
86KB
MD555a97c12d0ac4092a285396d7ecf28ae
SHA1dfafde9bf9f5eccdfad2534d4038b76e044d9999
SHA256f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2
SHA512129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746
-
C:\Program Files\File Magic\SolvuSoft.Resources.dllFilesize
101KB
MD58e085b1a786a4dcdd55a740d621f4c60
SHA16a5fd787ef4a6083c15111084b22c4f586eebd95
SHA256e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21
SHA512849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5f3e775bc383b903b7368d5c3a6bb43aa
SHA179e036007543d0830927d0a461dbdca596688b89
SHA256a1e65eefe5b5e754e97b322960ef13815a4a778c7df822753d64d7902429063d
SHA512973ffd342df5c071bd7eb590f84611943c9d730f438d63c761ddde25c7ab47aa31f80e3ad3deed8ea20dcee3b58357092add980f3dcd6b87fedc0f2513ef70fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50dd6c49515e46d75c30b20fa310f2899
SHA1765a6b3d5e601dc28efffa37e672b2e3066ff4e1
SHA256c0acb4e31a3a4cb5a5fa9d75b967876f56e616a1091355d256b8a3c5ad990efd
SHA512135f620ff51d82696c21add480c7cf15d385838371a9e4759b2ac70239a5d6c86f61f34d02157850c74018fc6a43845828bbdfe9a0f2a8237e6a56f8ed7988d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b82accb7462afd2147769e36781972c5
SHA128919f1dab20dfca9a42a55a25f6b7f1f365ada3
SHA256e09f01d19abb06d48c67ccce43ddeebb2a1cf0bd23cf2cc196bbc112d23f5046
SHA512d07f715523596ec56e223abd415cfa6c951500f29ad443739e550e77de9437272fab81772d1c7f88051f85b775b28c98872f3789c28ba1505cfe16adda50e41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b9f1d1bdfe23ea6c7f442c76a5e13a0a
SHA17c07b14e00b1045ca17a5496f0ea0c32383456ed
SHA25651eaf081cc94c8be744a912fcafcbafb2635be39b6e09b9dd0f576207da93d87
SHA51211156abcdd96b88599a1f914adc0fee16f0f860d2be428b3a41315b36dfb202a7461f74e0955f9f34d14a2a5c9035eae7289fdf46da4bcf523152eeea43ea009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b39da512c4f7a727648814a8f2e4b65b
SHA147c37739413d81b5a433183f9b7bf704a3378dbf
SHA256436fd419dedbee4603192bdf8be66f554bb35245382cfa2b29fa18fdbbdda371
SHA51230cba0f8f9e75a57095e5b5d6ff60fa0a3a0e116f2eee98e03f51d7a37b90e36c01779cdf467c1adf7de38957ac9c353104d969ba818668c1273af9a80bd6e71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5ed6ee0ccef27e8eaaa207e84d4c0cfbb
SHA1a64fb92322975f57bab45209fa6d62ddd48c00b3
SHA2569b304751bccc46470a1ed655964e711da694ea06f8044da017b61a67121ca676
SHA512203becd67b55d13d2f60ccf74f09ec428d48258c1079a2ea16049a2e9a9aed6d97780457f9b8abd99b8b8a860cfcad1e81e32b74bad5cea0ad47810766f5648c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5ed6ee0ccef27e8eaaa207e84d4c0cfbb
SHA1a64fb92322975f57bab45209fa6d62ddd48c00b3
SHA2569b304751bccc46470a1ed655964e711da694ea06f8044da017b61a67121ca676
SHA512203becd67b55d13d2f60ccf74f09ec428d48258c1079a2ea16049a2e9a9aed6d97780457f9b8abd99b8b8a860cfcad1e81e32b74bad5cea0ad47810766f5648c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5ed6ee0ccef27e8eaaa207e84d4c0cfbb
SHA1a64fb92322975f57bab45209fa6d62ddd48c00b3
SHA2569b304751bccc46470a1ed655964e711da694ea06f8044da017b61a67121ca676
SHA512203becd67b55d13d2f60ccf74f09ec428d48258c1079a2ea16049a2e9a9aed6d97780457f9b8abd99b8b8a860cfcad1e81e32b74bad5cea0ad47810766f5648c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5ed6ee0ccef27e8eaaa207e84d4c0cfbb
SHA1a64fb92322975f57bab45209fa6d62ddd48c00b3
SHA2569b304751bccc46470a1ed655964e711da694ea06f8044da017b61a67121ca676
SHA512203becd67b55d13d2f60ccf74f09ec428d48258c1079a2ea16049a2e9a9aed6d97780457f9b8abd99b8b8a860cfcad1e81e32b74bad5cea0ad47810766f5648c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
88KB
MD5e7b909e201e3cb3fc61c85539ee671cd
SHA1f2b720962d80eec7b0b0c033074521c11420eb2d
SHA256d78296192f52458208c8fd6b123cc3f3e9cd73572c605ef8062bd58d620bea7b
SHA512afc3ee9954f9ef38ced0d48fb36dd887ce4bc1ceb68b49fd73690dc90b580633f636ce7577c8bba3fad9282f9ccf5c492735521ef02cf1e5c23c50cf45585af2
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1evexod\imagestore.datFilesize
5KB
MD53d3e528b8570f21e969b54348879f0f1
SHA1faf7c1b6b43ec106d704df2e8cdc5e1249c89556
SHA2560b9d26793f7ed732e06270c7d0ac0a85a8123c8de47eac7538d558dc67c39e1a
SHA51223f4d2bc508112228f5d6c3757bc87c0762787c9cf5440f63799d6e1e888271d0221d981f6d450e7e4380073d0e3bdf8fbbeb7ac390efcc5b6e18c5fa9d4755c
-
C:\Users\Admin\AppData\Local\Temp\is-O6MJN.tmp\FileMagic-S-1.9.8.19.tmpFilesize
1.1MB
MD5034641d201844aa7f133e69aa72274ac
SHA1050b02112b1e22cf8a310e5cd3b19afa993473ce
SHA256f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0
SHA51278066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1
-
C:\Users\Admin\AppData\Local\Temp\is-O6MJN.tmp\FileMagic-S-1.9.8.19.tmpFilesize
1.1MB
MD5034641d201844aa7f133e69aa72274ac
SHA1050b02112b1e22cf8a310e5cd3b19afa993473ce
SHA256f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0
SHA51278066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1
-
C:\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exeFilesize
58.1MB
MD56bba1a3f0115ea3604f87d92e6cb925e
SHA1e489aef3f3448354ca315dc9840cd58918ce2bea
SHA256c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88
SHA512228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5
-
C:\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exeFilesize
58.1MB
MD56bba1a3f0115ea3604f87d92e6cb925e
SHA1e489aef3f3448354ca315dc9840cd58918ce2bea
SHA256c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88
SHA512228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5
-
\??\pipe\crashpad_1364_QGZPPYEJDYNBFAIZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_1876_RXKCQEEGENCNUFREMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files\File Magic\DevExpress.Data.v18.1.dllFilesize
6.4MB
MD575e4c5f9581ef853d787961cf4f8830f
SHA104615d07cd402692f5c1a35474fc9ae01a1cb3cb
SHA256a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209
SHA51202efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b
-
\Program Files\File Magic\DevExpress.Data.v18.1.dllFilesize
6.4MB
MD575e4c5f9581ef853d787961cf4f8830f
SHA104615d07cd402692f5c1a35474fc9ae01a1cb3cb
SHA256a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209
SHA51202efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b
-
\Program Files\File Magic\DevExpress.Data.v18.1.dllFilesize
6.4MB
MD575e4c5f9581ef853d787961cf4f8830f
SHA104615d07cd402692f5c1a35474fc9ae01a1cb3cb
SHA256a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209
SHA51202efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b
-
\Program Files\File Magic\DevExpress.Data.v18.1.dllFilesize
6.4MB
MD575e4c5f9581ef853d787961cf4f8830f
SHA104615d07cd402692f5c1a35474fc9ae01a1cb3cb
SHA256a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209
SHA51202efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b
-
\Program Files\File Magic\DevExpress.Utils.v18.1.dllFilesize
12.4MB
MD5c5420b084a69cc5783d15bd9ee77d707
SHA1ed47a4da79ce18af598a416633f4b9d9a032464e
SHA2561a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84
SHA51253994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e
-
\Program Files\File Magic\DevExpress.Utils.v18.1.dllFilesize
12.4MB
MD5c5420b084a69cc5783d15bd9ee77d707
SHA1ed47a4da79ce18af598a416633f4b9d9a032464e
SHA2561a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84
SHA51253994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e
-
\Program Files\File Magic\DevExpress.Utils.v18.1.dllFilesize
12.4MB
MD5c5420b084a69cc5783d15bd9ee77d707
SHA1ed47a4da79ce18af598a416633f4b9d9a032464e
SHA2561a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84
SHA51253994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e
-
\Program Files\File Magic\DevExpress.Utils.v18.1.dllFilesize
12.4MB
MD5c5420b084a69cc5783d15bd9ee77d707
SHA1ed47a4da79ce18af598a416633f4b9d9a032464e
SHA2561a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84
SHA51253994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e
-
\Program Files\File Magic\FileMagic.exeFilesize
693KB
MD59d39755e575708ff21df4eef3c2f8c8a
SHA14c53bbf1ccfb764b07627fdea4bb48d405bcf609
SHA2563c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118
SHA5122b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed
-
\Program Files\File Magic\FileMagic.exeFilesize
693KB
MD59d39755e575708ff21df4eef3c2f8c8a
SHA14c53bbf1ccfb764b07627fdea4bb48d405bcf609
SHA2563c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118
SHA5122b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed
-
\Program Files\File Magic\FileMagic.exeFilesize
693KB
MD59d39755e575708ff21df4eef3c2f8c8a
SHA14c53bbf1ccfb764b07627fdea4bb48d405bcf609
SHA2563c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118
SHA5122b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed
-
\Program Files\File Magic\IsLicense50.dllFilesize
2.2MB
MD55949dea9a38e8bbc54db0144c705f966
SHA15ee6e072d548d27fd6fceddecbf26efc2f8debb5
SHA25628dfb39347dc485290a0a2a59d6fa7d9a4ea5842b835191fd80bd85326c912f6
SHA512f28d8987b2a78010fa0ac67dac2cbf4e1b3a14c003f14f0213706672dad03899cf182ba9ed5118aaa4781452b57f325400542e93d2669fad8d283b3f3899accb
-
\Program Files\File Magic\QlmLicenseLib.dllFilesize
530KB
MD59bee3b92a4f2b257274200913438ec0e
SHA12c01d251f44565f916b06c40c2d01bd61ce6e33d
SHA256d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99
SHA512df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a
-
\Program Files\File Magic\QlmLicenseLib.dllFilesize
530KB
MD59bee3b92a4f2b257274200913438ec0e
SHA12c01d251f44565f916b06c40c2d01bd61ce6e33d
SHA256d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99
SHA512df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a
-
\Program Files\File Magic\SolvuSoft.Licensing.dllFilesize
283KB
MD52a31ac2f0f94571165e54d6bddaba0d9
SHA1d250106e535762ebd529884ecc517a9f5867dd4f
SHA256f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65
SHA512745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38
-
\Program Files\File Magic\SolvuSoft.Licensing.dllFilesize
283KB
MD52a31ac2f0f94571165e54d6bddaba0d9
SHA1d250106e535762ebd529884ecc517a9f5867dd4f
SHA256f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65
SHA512745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38
-
\Program Files\File Magic\SolvuSoft.Resources.dllFilesize
101KB
MD58e085b1a786a4dcdd55a740d621f4c60
SHA16a5fd787ef4a6083c15111084b22c4f586eebd95
SHA256e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21
SHA512849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02
-
\Program Files\File Magic\SolvuSoft.Resources.dllFilesize
101KB
MD58e085b1a786a4dcdd55a740d621f4c60
SHA16a5fd787ef4a6083c15111084b22c4f586eebd95
SHA256e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21
SHA512849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02
-
\Program Files\File Magic\unins000.exeFilesize
1.1MB
MD5034641d201844aa7f133e69aa72274ac
SHA1050b02112b1e22cf8a310e5cd3b19afa993473ce
SHA256f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0
SHA51278066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1
-
\Users\Admin\AppData\Local\Temp\is-O6MJN.tmp\FileMagic-S-1.9.8.19.tmpFilesize
1.1MB
MD5034641d201844aa7f133e69aa72274ac
SHA1050b02112b1e22cf8a310e5cd3b19afa993473ce
SHA256f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0
SHA51278066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1
-
\Users\Admin\AppData\Local\Temp\is-TDTPK.tmp\isxdl.dllFilesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exeFilesize
58.1MB
MD56bba1a3f0115ea3604f87d92e6cb925e
SHA1e489aef3f3448354ca315dc9840cd58918ce2bea
SHA256c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88
SHA512228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5
-
\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exeFilesize
58.1MB
MD56bba1a3f0115ea3604f87d92e6cb925e
SHA1e489aef3f3448354ca315dc9840cd58918ce2bea
SHA256c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88
SHA512228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5
-
\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exeFilesize
58.1MB
MD56bba1a3f0115ea3604f87d92e6cb925e
SHA1e489aef3f3448354ca315dc9840cd58918ce2bea
SHA256c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88
SHA512228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5
-
\Users\Admin\AppData\Local\Temp\{D4E4D639-9015-4B7F-A097-9B4EFEA880F8}\FileMagic-S-1.9.8.19.exeFilesize
58.1MB
MD56bba1a3f0115ea3604f87d92e6cb925e
SHA1e489aef3f3448354ca315dc9840cd58918ce2bea
SHA256c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88
SHA512228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5
-
memory/1292-151-0x0000000000000000-mapping.dmp
-
memory/1316-146-0x0000000006CC0000-0x00000000072E4000-memory.dmpFilesize
6.1MB
-
memory/1316-142-0x0000000001FA0000-0x0000000001FEE000-memory.dmpFilesize
312KB
-
memory/1316-145-0x0000000004A90000-0x0000000004AEE000-memory.dmpFilesize
376KB
-
memory/1316-136-0x0000000000000000-mapping.dmp
-
memory/1316-137-0x00000000002D0000-0x0000000000384000-memory.dmpFilesize
720KB
-
memory/1316-139-0x00000000050E0000-0x0000000005D52000-memory.dmpFilesize
12.4MB
-
memory/1316-140-0x0000000006380000-0x00000000069E2000-memory.dmpFilesize
6.4MB
-
memory/1316-144-0x0000000005DC0000-0x0000000005DDE000-memory.dmpFilesize
120KB
-
memory/1316-147-0x0000000007340000-0x0000000007944000-memory.dmpFilesize
6.0MB
-
memory/1316-148-0x0000000008100000-0x000000000810C000-memory.dmpFilesize
48KB
-
memory/1316-149-0x0000000004A25000-0x0000000004A36000-memory.dmpFilesize
68KB
-
memory/1316-150-0x0000000004A25000-0x0000000004A36000-memory.dmpFilesize
68KB
-
memory/1316-141-0x0000000000710000-0x0000000000730000-memory.dmpFilesize
128KB
-
memory/1316-143-0x0000000008050000-0x00000000080DA000-memory.dmpFilesize
552KB
-
memory/1468-87-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1468-62-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1468-68-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1468-59-0x0000000000000000-mapping.dmp
-
memory/1720-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmpFilesize
8KB
-
memory/1872-71-0x0000000071A21000-0x0000000071A23000-memory.dmpFilesize
8KB
-
memory/1872-66-0x0000000000000000-mapping.dmp
-
memory/2468-116-0x00000000048D0000-0x000000000491E000-memory.dmpFilesize
312KB
-
memory/2468-122-0x0000000007060000-0x00000000070EA000-memory.dmpFilesize
552KB
-
memory/2468-84-0x0000000000000000-mapping.dmp
-
memory/2468-89-0x00000000010B0000-0x0000000001164000-memory.dmpFilesize
720KB
-
memory/2468-131-0x0000000004CD0000-0x0000000004CD6000-memory.dmpFilesize
24KB
-
memory/2468-130-0x0000000004B20000-0x0000000004B26000-memory.dmpFilesize
24KB
-
memory/2468-129-0x0000000004B80000-0x0000000004B9E000-memory.dmpFilesize
120KB
-
memory/2468-90-0x0000000000250000-0x0000000000292000-memory.dmpFilesize
264KB
-
memory/2468-117-0x0000000000760000-0x000000000076A000-memory.dmpFilesize
40KB
-
memory/2468-107-0x0000000000650000-0x0000000000670000-memory.dmpFilesize
128KB
-
memory/2468-101-0x0000000006230000-0x0000000006892000-memory.dmpFilesize
6.4MB
-
memory/2468-95-0x00000000052C0000-0x0000000005F32000-memory.dmpFilesize
12.4MB
-
memory/2912-134-0x000000006AEA1000-0x000000006AEA3000-memory.dmpFilesize
8KB
-
memory/2912-132-0x0000000000000000-mapping.dmp
-
memory/3004-135-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmpFilesize
8KB