99842928d56ef4c03fa17ec47538b1527d25d4b4644e157628475426cdb7acde

Analysis

max time kernel
211s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2023 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup_File_Magic_2022.exe
Size

1.2MB
MD5

8f2c8356efa99b8b91b11741f6834602
SHA1

c2a4bb8ef0c785e14e624f0a27045803c9aeb03b
SHA256

99842928d56ef4c03fa17ec47538b1527d25d4b4644e157628475426cdb7acde
SHA512

333bca23e0fe61d2b35bfb383bfaf9aa6582e58b18365c395eeaa90b00482ad13ebf09039e6f9c9dc9e82e13bb4d16991a23a5b477b24f7359403dec808ed421
SSDEEP

24576:eoyyzDBXE5OljBjauSRJZXCi2GpnXZK1PMUOcIa3oz4Yk45cIpBss:tyIdtvBGpn01ucVA4Y7Bss

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup_File_Magic_2022.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	Setup_File_Magic_2022.exe

Executes dropped EXE 3 IoCs

Processes:

FileMagic-S-1.9.8.19.exeFileMagic-S-1.9.8.19.tmpFileMagic.exe

pid process

1920 FileMagic-S-1.9.8.19.exe
4992 FileMagic-S-1.9.8.19.tmp
660 FileMagic.exe

pid	process
1920	FileMagic-S-1.9.8.19.exe
4992	FileMagic-S-1.9.8.19.tmp
660	FileMagic.exe

Loads dropped DLL 16 IoCs

Processes:

FileMagic-S-1.9.8.19.tmpFileMagic.exe

pid	process
4992	FileMagic-S-1.9.8.19.tmp
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe
660	FileMagic.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files\File Magic\Wps\wps2html.exe	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

FileMagic-S-1.9.8.19.tmp

description	ioc	process
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\language\html\is-4N1SG.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-JJ82I.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.XtraRichEdit.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-F5IT1.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-HS5UV.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-KR97S.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-QI8VD.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.XtraTreeList.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SocialExplorer.FastDBF.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.RichEdit.v18.1.Export.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-EC0AT.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\IsLicense50.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-D20O4.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Views.Media.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\Vlc.DotNet.Forms.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-VJM61.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-UPBO5.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.RichEdit.v18.1.Core.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\Raw\dcraw.exe	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-EKAOE.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-NNQAF.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-4SISQ.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-1UU2E.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-FN5ON.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-04G88.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-06T4E.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-38PUC.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.Spreadsheet.v18.1.Core.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Views.Wpd.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-KLIK8.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-HAOB2.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-235BL.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-V2H56.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\editor\is-9D1DR.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\editor\is-E5I67.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-Q5V84.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\Svg.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-HOBUS.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-99O97.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-BOJES.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.XtraEditors.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-AHKOL.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-NSREB.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\editor\is-JG9RM.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.XtraBars.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-2DLUG.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Common.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-ENJAU.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-PSI72.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-29GN0.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\Wps\wps2html.exe	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SolvuSoft.Views.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\ICSharpCode.TextEditor.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-8J943.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-7TGQV.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\basic-languages\src\is-MGMD1.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\LangsFileMagic\is-2AK51.tmp	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\DevExpress.Images.v18.1.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\SevenZipSharp.dll	FileMagic-S-1.9.8.19.tmp
File opened for modification	C:\Program Files\File Magic\PaintDotNet.Resources.dll	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\Resources\Editor\monaco\min\vs\base\worker\is-RDNSP.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-DGTTN.tmp	FileMagic-S-1.9.8.19.tmp
File created	C:\Program Files\File Magic\is-MFAD0.tmp	FileMagic-S-1.9.8.19.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

FileMagic.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	FileMagic.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	FileMagic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	FileMagic.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	FileMagic.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	FileMagic.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

FileMagic-S-1.9.8.19.tmpmsedge.exemsedge.exeidentity_helper.exe

pid	process
4992	FileMagic-S-1.9.8.19.tmp
4992	FileMagic-S-1.9.8.19.tmp
4952	msedge.exe
4952	msedge.exe
4664	msedge.exe
4664	msedge.exe
3380	identity_helper.exe
3380	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

FileMagic-S-1.9.8.19.tmpmsedge.exe

pid process

4992 FileMagic-S-1.9.8.19.tmp
4664 msedge.exe
4664 msedge.exe
4664 msedge.exe

pid	process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Setup_File_Magic_2022.exe

pid	process
456	Setup_File_Magic_2022.exe
456	Setup_File_Magic_2022.exe
456	Setup_File_Magic_2022.exe
456	Setup_File_Magic_2022.exe
456	Setup_File_Magic_2022.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Setup_File_Magic_2022.exeFileMagic-S-1.9.8.19.exeFileMagic-S-1.9.8.19.tmpmsedge.exe

description	pid	process	target process
PID 456 wrote to memory of 1920	456	Setup_File_Magic_2022.exe	FileMagic-S-1.9.8.19.exe
PID 456 wrote to memory of 1920	456	Setup_File_Magic_2022.exe	FileMagic-S-1.9.8.19.exe
PID 456 wrote to memory of 1920	456	Setup_File_Magic_2022.exe	FileMagic-S-1.9.8.19.exe
PID 1920 wrote to memory of 4992	1920	FileMagic-S-1.9.8.19.exe	FileMagic-S-1.9.8.19.tmp
PID 1920 wrote to memory of 4992	1920	FileMagic-S-1.9.8.19.exe	FileMagic-S-1.9.8.19.tmp
PID 1920 wrote to memory of 4992	1920	FileMagic-S-1.9.8.19.exe	FileMagic-S-1.9.8.19.tmp
PID 4992 wrote to memory of 4664	4992	FileMagic-S-1.9.8.19.tmp	msedge.exe
PID 4992 wrote to memory of 4664	4992	FileMagic-S-1.9.8.19.tmp	msedge.exe
PID 4992 wrote to memory of 660	4992	FileMagic-S-1.9.8.19.tmp	FileMagic.exe
PID 4992 wrote to memory of 660	4992	FileMagic-S-1.9.8.19.tmp	FileMagic.exe
PID 4992 wrote to memory of 660	4992	FileMagic-S-1.9.8.19.tmp	FileMagic.exe
PID 4664 wrote to memory of 1180	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 1180	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 3788	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4952	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 4952	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe
PID 4664 wrote to memory of 556	4664	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Setup_File_Magic_2022.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_File_Magic_2022.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456

C:\Users\Admin\AppData\Local\Temp\{731B70EC-51EF-4D1A-8083-0E379878B69B}\FileMagic-S-1.9.8.19.exe
"C:\Users\Admin\AppData\Local\Temp\{731B70EC-51EF-4D1A-8083-0E379878B69B}\FileMagic-S-1.9.8.19.exe" /verysilent /norestart /LANG en-us
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\is-6IO0U.tmp\FileMagic-S-1.9.8.19.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6IO0U.tmp\FileMagic-S-1.9.8.19.tmp" /SL5="$5017E,60285589,131584,C:\Users\Admin\AppData\Local\Temp\{731B70EC-51EF-4D1A-8083-0E379878B69B}\FileMagic-S-1.9.8.19.exe" /verysilent /norestart /LANG en-us
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.solvusoft.com/en-us/file-magic/install/?utm_source=file-magic&utm_campaign=version_1.9.8.19_06042019&utm_medium=file-magic-standalone
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff956046f8,0x7fff95604708,0x7fff95604718
5⤵
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
5⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
5⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
5⤵
PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
5⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
5⤵
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
5⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
5⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
5⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
5⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff76c065460,0x7ff76c065470,0x7ff76c065480
6⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
5⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14124856438717012880,6082657832466878580,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
5⤵
PID:4456

C:\Program Files\File Magic\FileMagic.exe
"C:\Program Files\File Magic\FileMagic.exe" /restartWithNoAdminRights lang=en-us
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Data.v18.1.dll

Filesize
6.4MB

MD5
75e4c5f9581ef853d787961cf4f8830f

SHA1
04615d07cd402692f5c1a35474fc9ae01a1cb3cb

SHA256
a12b4168dcd3692fb8a68382c3d9413351c9d2c543b2d2061064de7994787209

SHA512
02efcef0a7250db93322c2c241a0f120985a730479517793fa8cbce8f0bfed3103bb2a22bde751b8fd333a89e6f85ffd3ebad821d1155d9d82c5f681f213a12b

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\DevExpress.Utils.v18.1.dll

Filesize
12.4MB

MD5
c5420b084a69cc5783d15bd9ee77d707

SHA1
ed47a4da79ce18af598a416633f4b9d9a032464e

SHA256
1a610b808c07247c0662b829fa703c5068f361194c301594b9594f414e0ebe84

SHA512
53994e509c56ac9435bcd06dc1341b589dc168ed5df2ebe13d2ca43cd50278e898768b1b5b65596542831b68d922612d3896c74d4dae8da829f5f0512905cb4e

Download Submit
C:\Program Files\File Magic\DevExpress.XtraEditors.v18.1.dll

Filesize
6.0MB

MD5
8c0d9ba800cffbabac77b2c320ab169d

SHA1
f28285a8b9b8a5086b5024a4352973019f689590

SHA256
7cd141c2fdc9dbaf634a02b51cc3740d98af3b21b694a444f5430a35a46b13f1

SHA512
52e29c064195b2eda58659aa3482c111f37b901e6053b764cbf1af4e498a14deefa7a74af069ae91446e71a6d8381b89a1f5ff178f2ac8bc1bb9cd04eb77b123

Download Submit
C:\Program Files\File Magic\DevExpress.XtraEditors.v18.1.dll

Filesize
6.0MB

MD5
8c0d9ba800cffbabac77b2c320ab169d

SHA1
f28285a8b9b8a5086b5024a4352973019f689590

SHA256
7cd141c2fdc9dbaf634a02b51cc3740d98af3b21b694a444f5430a35a46b13f1

SHA512
52e29c064195b2eda58659aa3482c111f37b901e6053b764cbf1af4e498a14deefa7a74af069ae91446e71a6d8381b89a1f5ff178f2ac8bc1bb9cd04eb77b123

Download Submit
C:\Program Files\File Magic\DevExpress.XtraEditors.v18.1.dll

Filesize
6.0MB

MD5
8c0d9ba800cffbabac77b2c320ab169d

SHA1
f28285a8b9b8a5086b5024a4352973019f689590

SHA256
7cd141c2fdc9dbaf634a02b51cc3740d98af3b21b694a444f5430a35a46b13f1

SHA512
52e29c064195b2eda58659aa3482c111f37b901e6053b764cbf1af4e498a14deefa7a74af069ae91446e71a6d8381b89a1f5ff178f2ac8bc1bb9cd04eb77b123

Download Submit
C:\Program Files\File Magic\FileMagic.exe

Filesize
693KB

MD5
9d39755e575708ff21df4eef3c2f8c8a

SHA1
4c53bbf1ccfb764b07627fdea4bb48d405bcf609

SHA256
3c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118

SHA512
2b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed

Download Submit
C:\Program Files\File Magic\FileMagic.exe

Filesize
693KB

MD5
9d39755e575708ff21df4eef3c2f8c8a

SHA1
4c53bbf1ccfb764b07627fdea4bb48d405bcf609

SHA256
3c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118

SHA512
2b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed

Download Submit
C:\Program Files\File Magic\FileMagic.exe

Filesize
693KB

MD5
9d39755e575708ff21df4eef3c2f8c8a

SHA1
4c53bbf1ccfb764b07627fdea4bb48d405bcf609

SHA256
3c3724c0119d87e25e730c4285aa48f982f1cefac1151e55b69beedf7491b118

SHA512
2b46a9ca61f02dc4487923eb29612e626af23ba580d6482cf4696b304648f3cea68e40f1c49ca5af6ab562a0b6ee26d9955e49a56ab96f64817ad32e96a1bbed

Download Submit
C:\Program Files\File Magic\FileMagic.exe.config

Filesize
3KB

MD5
4e73c4ff8ea09cdc528e5eea378b9c89

SHA1
e3974580154b5897441a68b3a14bae74fbfab14d

SHA256
7c90b0bbb693a95518b394ff9fe96f975b1290cf51c017a4a8b5ef669d91e916

SHA512
155962cd814ded2d3d4d4120e8f5774fc381fdb8bf2aecc04e2c0ac84ea2079428f34f60890ad78c627164d33c7f82517750a116e70b00e1aea6e79ae8c32ce3

Download Submit
C:\Program Files\File Magic\IsLicense50.dll

Filesize
2.2MB

MD5
5949dea9a38e8bbc54db0144c705f966

SHA1
5ee6e072d548d27fd6fceddecbf26efc2f8debb5

SHA256
28dfb39347dc485290a0a2a59d6fa7d9a4ea5842b835191fd80bd85326c912f6

SHA512
f28d8987b2a78010fa0ac67dac2cbf4e1b3a14c003f14f0213706672dad03899cf182ba9ed5118aaa4781452b57f325400542e93d2669fad8d283b3f3899accb

Download Submit
C:\Program Files\File Magic\IsLicense50.dll

Filesize
2.2MB

MD5
5949dea9a38e8bbc54db0144c705f966

SHA1
5ee6e072d548d27fd6fceddecbf26efc2f8debb5

SHA256
28dfb39347dc485290a0a2a59d6fa7d9a4ea5842b835191fd80bd85326c912f6

SHA512
f28d8987b2a78010fa0ac67dac2cbf4e1b3a14c003f14f0213706672dad03899cf182ba9ed5118aaa4781452b57f325400542e93d2669fad8d283b3f3899accb

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\QlmLicenseLib.dll

Filesize
530KB

MD5
9bee3b92a4f2b257274200913438ec0e

SHA1
2c01d251f44565f916b06c40c2d01bd61ce6e33d

SHA256
d619cbc409da682985b79af7ab0a008836285950f228b7c11cd433c5f042ca99

SHA512
df3762eacb0015915f64854cd26a8a54b68395cd786b24d637991f9154ca89f4ebb5aa781399158943885f60eec2d9443c3d966e4f2a3488fbc459ddbca47a1a

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Licensing.dll

Filesize
283KB

MD5
2a31ac2f0f94571165e54d6bddaba0d9

SHA1
d250106e535762ebd529884ecc517a9f5867dd4f

SHA256
f442ed07ce803f8141d51021a468b7cd2358c4949047eb04e54c20616f691d65

SHA512
745cdb8eb1165a047e2e2ef96a0a3c1751cf459f40a19cdc973cee6cb1d4232b9a0268d55270dae26cc8f1d3fcc07b79db6266c9e5befb0fad33016b60ed7e38

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Localization.dll

Filesize
86KB

MD5
55a97c12d0ac4092a285396d7ecf28ae

SHA1
dfafde9bf9f5eccdfad2534d4038b76e044d9999

SHA256
f8a9c9a3038f51b55b80cd6a3b75273483b49c592325a61fb87669114c1228e2

SHA512
129ab9b827c23565f2b1e9c10de7415426f215392fafabdd9c54df8b0e0c77be9d98b15de6bee41cac5362edee38d047431802db4a05fe9c48b5d0a111212746

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\Program Files\File Magic\SolvuSoft.Resources.dll

Filesize
101KB

MD5
8e085b1a786a4dcdd55a740d621f4c60

SHA1
6a5fd787ef4a6083c15111084b22c4f586eebd95

SHA256
e7a2b0b975e99160989eaa0b3fd15f9264349433740654d1d12f7eae5d88de21

SHA512
849b19c3fafbe029397d9c5be537afe0b8db08128bc069049d93a2ba7aa78b56ec86ba4cd97717dc5162f0c886bd1be31eaa0ee792eba1f55f9d6b4ee8b8ae02

Download Submit
C:\Program Files\File Magic\Wps\wps2html.exe

Filesize
133KB

MD5
0ba5a293b5bac50fbd39ce37c3780439

SHA1
7b141b62777c8b0422203d323771032ff355ef5c

SHA256
b995f5b374a261a991da7db7b09c47d8c6945c7c92fe5d74aa947b054a712cb1

SHA512
c684705c7827087d6df7617a232484927c878894918f0e4a8dabf6580a77d49db4dc8a32fa550b69b2531f7372766e75974b279b2f69310a958b76fb7b8e33b4

Download Submit
C:\Program Files\File Magic\unins000.exe

Filesize
1.1MB

MD5
034641d201844aa7f133e69aa72274ac

SHA1
050b02112b1e22cf8a310e5cd3b19afa993473ce

SHA256
f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0

SHA512
78066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
a8c5ec082ddbfa706307d295f25ae6fa

SHA1
9d59be752069e201236a1edec3c3b374afc1b382

SHA256
c6e194e6a673e59490dfe69c0ea81bff16de4cb1b9b82408dc2738ec7efe488c

SHA512
80441dd81f5edc564f50c550a2b93db1bcf7d809811f8df43896d4d3d85c4bda95e735e67f82edf951f2601c84119f8a0769df3643ec777172f1134132ec6dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
eb4999388bd9b00b511f2a4be28dbfc7

SHA1
00268666fef75bb386d00063b3e19f195bb6b826

SHA256
f6256a7fc4ef83725280437843481d408044a0bb6a95493350bd62f902199246

SHA512
f49a070a5f72db1516926ecac98bc711eda3e7ad92e708a543a6893541073069f9692143c4acdb913d44070213ce02ced8beb479856b8952cb856c6ea1a3ccdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
f69330422405e222aef0d254b08f3fb5

SHA1
da5b37d55aa877e50d67771d44587366ce7bc123

SHA256
7aba2c26d2b2072c4846b95a71cab2fe1a72787f7fdff1ff6b508cd0dd6fa029

SHA512
327ad8d496c6d0ee62b9e6d2f3d2a596b626c2ab776612ab238b3d47662e016f8943f938310fc47e8ee09e029df9df0597f9adec6ab79d330062d2b706398713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
db3fdba25fad7574998c67d8a07703e8

SHA1
aa9e7cd0efc4ef494503ff0a5b674c6b3c6f2450

SHA256
df87560bdbaf86ce3da4f164f06421061cc3374deab4824b2b49f9ccfd1b69e9

SHA512
08947c5dbdb5f3d8c4b31493f10eb926ec1a8f8812485265163cebc084f1e75c5bd6dd93abcf2ab1eec179b007ccd8290aac5733bc2ee6837202456b9f164cbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
e879e95f11770c24d969bbd38eb7d946

SHA1
e7dbf70c3a7c61868cb0936edf459c4f44f8de23

SHA256
b437cd7088cef896a918cbaed4cd5a5f4ca3514ab30ed2d244729520b1a45c82

SHA512
726d46ae93a4a43ae2cc1833d71fdee9cba863e71581c8e7e4f1ab15406f4afeac4c0960e15587d85f3e887cef7d4b24217a84d8e1dfece68c1d41c993af4e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c9f422227a7f1f55759519396d53ccc

SHA1
e65e42470976bd633c5ad65852d5f6cc4aec3746

SHA256
bd102f31ed78964ed66062dcd991e9e84345c5250c96f8944048d3eb00041682

SHA512
a68599acc903a4a8895d9150eebe11be87370fc919527a8876c9a333ecb0be8bc1b130911149b482cbab84f5b318fd7e21d1643e05709254a1f32aa45ade08f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a7936feb5d451a46124469f2abcb991

SHA1
d964dbd653524cd98ad41e1000cfe10d30ead181

SHA256
e51983c6be32bfd84d7120efccc5aa10989590dc05fb59ca0f3663d9a1546f2a

SHA512
8b6b5b75f5b75406cb96f5ae4f4d73800ff07330174cec5b6e29f9868da7b28fb6dc06d549b87f15ae9280222d3e233570921a20325fa0ecd7fe3ad0d25028d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60060ac51e8c136c3b64db676bf6d5d7

SHA1
fb372f559af167622e2e70994f7ffa64e1bd32a2

SHA256
fdab122b853cbb06bcffc7b655ec98ddaea503d77d76c393667262ef11b34748

SHA512
9db4522e878001f77b0014c8b09a22a1321f5bfd2e6166560112fe6db92ef82fb5425c13e67e791a2c757197a1d0fe3e2e73f7c1734b414ab98167f154c2b5d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
ce64af631dbeadfdbe45d35ae66741e8

SHA1
1625bd94d34407ccd6bf5d245a3f0a730c50afee

SHA256
37a0aaba621cb88d3920aad57721e492767bfe25966f3fcac3a5b998ab624e1e

SHA512
ddb3d5147c8a4b33233fe6c6ccd91ea76c6e1c88da49bfc5cb961ef66f2f49000c5a047839688d00930ac088421720f8cf9bf36f2d13df8d8a56c25c8c33b7b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6cc2037eb9881dd5e4d5419f51e5e8b9

SHA1
5e198d4df4f553cdd26f8e6a89295eb60697052f

SHA256
be14ff80903ece4a5d3d715cef87383fa504ea241992857bfaac9427a3ac7f40

SHA512
bb688392d947b5338db5eb5bc6bf6d51ee2ebbc2feb78150ba96fc1ca9c8977a6a1551c60284a4b51987aba101c004488bf1b41438db31b77d2efa0fca833a83

Download Submit
C:\Users\Admin\AppData\Local\Solvusoft_Corporation\FileMagic.exe_Url_sdoseg0s0kj31nlznxgcytyyqrzs2u5a\1.9.8.19\rtuejefu.newcfg

Filesize
897B

MD5
76c406f3463f8927abfdead2e20c6743

SHA1
44c4a253f270d4f9a071edc8763f804117f5bd80

SHA256
56874e4c85e368b11d105180b0806e434f3d0d7e5a816ee866853df1017ccfa4

SHA512
1defde300abbbb71372f2fa0c384780f293bcabcc745c2cbd4e028fc93b41c921788a0e5a3f425111dc24ea2197515768b711e3a58ec825e93b1755d868568f1

Download Submit
C:\Users\Admin\AppData\Local\Solvusoft_Corporation\FileMagic.exe_Url_sdoseg0s0kj31nlznxgcytyyqrzs2u5a\1.9.8.19\user.config

Filesize
697B

MD5
0a7398e4f31c76d0011b55271476e0ff

SHA1
bc5ba183844eac072cf3840da916fadbd4373283

SHA256
eef3293b6321934bd16a1118a5d7cccde00128367348f9c6768a4eed353f3441

SHA512
19695367ad4a2c6d88bc376a48af60a1ae84a2f1b2fe5ff305d0e8722ae64abf6b4781c00c7d53d0a27f71036d3fbc1aed3d388945d5b284d0dc5cdfa05994a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6IO0U.tmp\FileMagic-S-1.9.8.19.tmp

Filesize
1.1MB

MD5
034641d201844aa7f133e69aa72274ac

SHA1
050b02112b1e22cf8a310e5cd3b19afa993473ce

SHA256
f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0

SHA512
78066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6IO0U.tmp\FileMagic-S-1.9.8.19.tmp

Filesize
1.1MB

MD5
034641d201844aa7f133e69aa72274ac

SHA1
050b02112b1e22cf8a310e5cd3b19afa993473ce

SHA256
f56049e52d6ab4c7d233d9745395c910a042528de0c577a2ed6717bd52cf6db0

SHA512
78066721fec10d68a3f7c45cfe4192c79a838afec319de5300e13b7870c217fba5f568a45a84d4f55e2563cfccd0f70a1174a86b3cdb0a19111aa141853dddf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NJI79.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{731B70EC-51EF-4D1A-8083-0E379878B69B}\FileMagic-S-1.9.8.19.exe

Filesize
58.1MB

MD5
6bba1a3f0115ea3604f87d92e6cb925e

SHA1
e489aef3f3448354ca315dc9840cd58918ce2bea

SHA256
c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88

SHA512
228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{731B70EC-51EF-4D1A-8083-0E379878B69B}\FileMagic-S-1.9.8.19.exe

Filesize
58.1MB

MD5
6bba1a3f0115ea3604f87d92e6cb925e

SHA1
e489aef3f3448354ca315dc9840cd58918ce2bea

SHA256
c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88

SHA512
228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{731B70EC-51EF-4D1A-8083-0E379878B69B}\FileMagic-S-1.9.8.19.exe

Filesize
58.1MB

MD5
6bba1a3f0115ea3604f87d92e6cb925e

SHA1
e489aef3f3448354ca315dc9840cd58918ce2bea

SHA256
c89b59b5a94afc89b4ee13bccff3bb440ef24662e8420c3f658c939207346d88

SHA512
228be702a4d3c1b6d5a04095b6af1d193d6b61126acb6819571eb90d83d9535a7021ccbea3a61d84dd76e292c3d87cc7fde4da3e4f6a33979a404428772b76e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{AC912661-A747-454C-A844-BB6033A1ACCD}\resources.1.0.0.29s

Filesize
1.6MB

MD5
0e7d6a3a2b0fdaefff1fbf07dfb0e483

SHA1
42b8b39856c52194d2a7e4d7877eec061de22213

SHA256
ef17ed2630826295a6c4092269524f422cebcd1c9af872fb9f270c810ae9923d

SHA512
9f44ff56d19e9892ed941b3579966627750d086fd0c0d5042ef4432d494ab79d5b232ee8c47a60cb5122946e2de03c4d2f07c1d9a779d1e3e26ddd4a47cb4a78

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
eed9711ee50ad12d0be015d165800f76

SHA1
85ab67ac27fcc059d261475e853dd222531d4dfa

SHA256
db39c146db360525aa96ad0d514fe90fd62982b24573871cbe7eb401ed6a9e79

SHA512
0076d97095707f5b84499537ef8104ba416dd0803c291d58c4a5ae3c8dad271e54b5e248b0b5f9ac43f77b7bcbb13bff7f29d5e47ff4b402ef61b860d3559693

Download Submit
\??\pipe\LOCAL\crashpad_4664_TDDNUUAZDHBECVOC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/660-518-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/660-539-0x0000000008450000-0x0000000008AB2000-memory.dmp

Filesize
6.4MB

Download
memory/660-527-0x0000000005360000-0x00000000053B6000-memory.dmp

Filesize
344KB

Download
memory/660-520-0x0000000005170000-0x0000000005202000-memory.dmp

Filesize
584KB

Download
memory/660-663-0x000000000B710000-0x000000000B73E000-memory.dmp

Filesize
184KB

Download
memory/660-664-0x0000000013480000-0x00000000134B8000-memory.dmp

Filesize
224KB

Download
memory/660-545-0x0000000005810000-0x0000000005830000-memory.dmp

Filesize
128KB

Download
memory/660-651-0x000000000B830000-0x000000000B8FE000-memory.dmp

Filesize
824KB

Download
memory/660-531-0x0000000006200000-0x0000000006E72000-memory.dmp

Filesize
12.4MB

Download
memory/660-526-0x0000000005130000-0x000000000513A000-memory.dmp

Filesize
40KB

Download
memory/660-749-0x0000000002A60000-0x0000000002A70000-memory.dmp

Filesize
64KB

Download
memory/660-662-0x000000000BBC0000-0x000000000BBDE000-memory.dmp

Filesize
120KB

Download
memory/660-517-0x0000000009D40000-0x000000000A2E4000-memory.dmp

Filesize
5.6MB

Download
memory/660-1005-0x00000000134C0000-0x0000000013AC4000-memory.dmp

Filesize
6.0MB

Download
memory/660-512-0x0000000000540000-0x00000000005F4000-memory.dmp

Filesize
720KB

Download
memory/660-570-0x0000000006000000-0x000000000604E000-memory.dmp

Filesize
312KB

Download
memory/660-647-0x0000000009C80000-0x0000000009D0A000-memory.dmp

Filesize
552KB

Download
memory/660-513-0x00000000096F0000-0x000000000978C000-memory.dmp

Filesize
624KB

Download
memory/1920-519-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1920-210-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1920-153-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4992-253-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/4992-516-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/4992-165-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download