9a442ced41f0f9a0142618ce04b67d56c49d9e1c215a2ffcc13f8309428e3abc

Analysis

max time kernel
134s
max time network
146s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/02/2023, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

duplicati-2.0.6.3_beta_2021-06-17-x64.msi
Size

40.6MB
MD5

29a941121d8e8326f0d2b3bd1278f70d
SHA1

9b6423bbe3bbf0e9bff8a2db83d78bf6410304e9
SHA256

9a442ced41f0f9a0142618ce04b67d56c49d9e1c215a2ffcc13f8309428e3abc
SHA512

bf1f1878db627308f127e7a60191971c2104e546f88eb516c65e079f6032b566323669ea2c0363c805a9b1dac11320b1216e58ff06187a1d0dde83974f0649a7
SSDEEP

786432:BLEhpgno079Az03fcxM9KtxqO7EdeTNgXbDS4Rv3sky+AsoaC082NO/rkZ1MXuoX:BLEhNKW03kM9Kp7TNWbDSy3sky+Ahtq4

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	1812	msiexec.exe
4	1812	msiexec.exe
6	1812	msiexec.exe
8	320	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1752	Duplicati.GUI.TrayIcon.exe
956	Duplicati.GUI.TrayIcon.exe

Loads dropped DLL 2 IoCs

pid	Process
956	Duplicati.GUI.TrayIcon.exe
956	Duplicati.GUI.TrayIcon.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\logout_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\less\font-awesome\rotated-flipped.less	msiexec.exe
File created	C:\Program Files\Duplicati 2\x86\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\styles\smoothness\images\ui-bg_flat_0_aaaaaa_40x100.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Library.Backend.TahoeLAFS.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\MegaApi\license.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\MimeKit\licensedata.json	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\less\font-awesome\list.less	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\directives\progressBar.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\SVGIcons\light\context_menu_pause.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Library.AutoUpdater.exe	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\steps\line-out.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\license.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\menu.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\styles\smoothness\images\animated-overlay.gif	msiexec.exe
File created	C:\Program Files\Duplicati 2\SVGIcons\light\context_menu_resume.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Library.Compression.dll.config	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.CommandLine.BackendTester.exe	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\social\duplicati_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\manifest.json	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\restore_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\backuprunning_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\backupschedule.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\fonts\ClearSans-Medium-webfont.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\oem\root\index\oem.css	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\pause_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\lvm-scripts\create-lvm-snapshot.sh	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\social\github_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\win-tools\libgcrypt-20.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\controllers\RestoreDirectController.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\backuprunning.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\FasterHashing\licensedata.json	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\progress-resume.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\utility-scripts\DuplicatiVerify.ps1	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\SSH.NET\licensedata.json	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\apple-icon-180x180.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\autoupdate.manifest	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\backuprunning.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\steps\line-out_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\oem\ngax\scripts\oem.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\zxcvbn.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Library.Backend.AlternativeFTP.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Server.exe	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Service.exe	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\fonts\fontawesome-webfont.eot	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\agsXMPP\license.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\ms-icon-70x70.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\treeicons.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\about.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\AWSSDK.Core.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\controllers\CaptchaController.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\arrow_expand_blue.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\templates\log.html	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\templates\notificationarea.html	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\pause.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\lvm-scripts\remove-lvm-snapshot.sh	msiexec.exe
File created	C:\Program Files\Duplicati 2\alphavss\AlphaVSS.x86.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\android-icon-72x72.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\android-icon-96x96.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\OSXTrayHost\rumps.py	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\directives\timeFormatFixer.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\social\duplicati_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\favicon.ico	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\FluentFTP\licensedata.json	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6ca278.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6ca278.msi	msiexec.exe
File created	C:\Windows\Installer\6ca279.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{D2A5D819-4FA0-493B-8D37-9531C659D95A}\DuplicatiIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\6ca279.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\{D2A5D819-4FA0-493B-8D37-9531C659D95A}\DuplicatiIcon.exe	msiexec.exe
File created	C:\Windows\Installer\6ca27b.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a712062139d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26A507C1-A514-11ED-BB74-42A406F29BB0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382339124"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000066fb0d6c7e80604abdcd34aabb17f583000000000200000000001066000000010000200000004fbab08a1d5e5f5651d92942a73b9327530a54ec2dd8f9c284e4c94f5bc162b0000000000e80000000020000200000009896ca7842d521029d34d2059028edb8b2fe938f00049da369326311fa9705ef900000008311728580c57e27210bc0c8c29867c23e06b4b18c6ed1326dc0f099ca06da53bafbda2182706ba693b7a3e050bdde63f2725a2baedd79fd3bc757969a3fd22533c5b3e586d9380e2646847165188fcb3dd1cf4335272e4391131c05668ced24e04f0492453544d44943ca531b153bf1628ba68d5eabb7647ed40c5deae4bc3533d0ef9dba97862ae02a97b589af202e40000000c81245bfaafbca8a0c2990b59b6e17de3b1e17089a2b9fd8afc848656dbd8d2521e33f4db0a8d6c89a1b00d3a0871aa29f7e5bfd2be439436c2aadbf3a52ee16	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000066fb0d6c7e80604abdcd34aabb17f58300000000020000000000106600000001000020000000d4650500a433d586e65f7c7439126e829f7a01b61102cb537feba41da391c114000000000e800000000200002000000063b7ebbf7e5c84f0a259e33a857ab4ed5170eda9c3ba4d2ecc65a0adeb22b98420000000462ef6a849d0aa4ed088b6510032f6aeedd7cb9f3efa9ee119a2804bb33d1dc44000000025843bdb3087ca455a341dd4f465b736ea0cbba985a1c2e56de8f4cde9244c958d40b4a1b3b525612d6289d0c58a5ea62dcccee61fa4b9992ee4f1a95ecdca79	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5CB49C12FB23724D9F8C23BE087D061	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiDesktopShortCutFeature = "DuplicatiCore"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiProgramMenuShortCutFeature = "DuplicatiCore"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Version = "33554438"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\ProductIcon = "C:\\Windows\\Installer\\{D2A5D819-4FA0-493B-8D37-9531C659D95A}\\DuplicatiIcon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5CB49C12FB23724D9F8C23BE087D061\918D5A2D0AF4B394D87359136C959DA5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiStartupShortCutFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\ProductName = "Duplicati 2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\PackageName = "duplicati-2.0.6.3_beta_2021-06-17-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiCore	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\PackageCode = "93C29AF77613D1543B9E8B547802D254"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Media	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Duplicati.GUI.TrayIcon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Duplicati.GUI.TrayIcon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Duplicati.GUI.TrayIcon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Duplicati.GUI.TrayIcon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Duplicati.GUI.TrayIcon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Duplicati.GUI.TrayIcon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
320	msiexec.exe
320	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1812	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1812	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeSecurityPrivilege	320	msiexec.exe
Token: SeCreateTokenPrivilege	1812	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1812	msiexec.exe
Token: SeLockMemoryPrivilege	1812	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1812	msiexec.exe
Token: SeMachineAccountPrivilege	1812	msiexec.exe
Token: SeTcbPrivilege	1812	msiexec.exe
Token: SeSecurityPrivilege	1812	msiexec.exe
Token: SeTakeOwnershipPrivilege	1812	msiexec.exe
Token: SeLoadDriverPrivilege	1812	msiexec.exe
Token: SeSystemProfilePrivilege	1812	msiexec.exe
Token: SeSystemtimePrivilege	1812	msiexec.exe
Token: SeProfSingleProcessPrivilege	1812	msiexec.exe
Token: SeIncBasePriorityPrivilege	1812	msiexec.exe
Token: SeCreatePagefilePrivilege	1812	msiexec.exe
Token: SeCreatePermanentPrivilege	1812	msiexec.exe
Token: SeBackupPrivilege	1812	msiexec.exe
Token: SeRestorePrivilege	1812	msiexec.exe
Token: SeShutdownPrivilege	1812	msiexec.exe
Token: SeDebugPrivilege	1812	msiexec.exe
Token: SeAuditPrivilege	1812	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1812	msiexec.exe
Token: SeChangeNotifyPrivilege	1812	msiexec.exe
Token: SeRemoteShutdownPrivilege	1812	msiexec.exe
Token: SeUndockPrivilege	1812	msiexec.exe
Token: SeSyncAgentPrivilege	1812	msiexec.exe
Token: SeEnableDelegationPrivilege	1812	msiexec.exe
Token: SeManageVolumePrivilege	1812	msiexec.exe
Token: SeImpersonatePrivilege	1812	msiexec.exe
Token: SeCreateGlobalPrivilege	1812	msiexec.exe
Token: SeBackupPrivilege	860	vssvc.exe
Token: SeRestorePrivilege	860	vssvc.exe
Token: SeAuditPrivilege	860	vssvc.exe
Token: SeBackupPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeLoadDriverPrivilege	1960	DrvInst.exe
Token: SeLoadDriverPrivilege	1960	DrvInst.exe
Token: SeLoadDriverPrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe
Token: SeTakeOwnershipPrivilege	320	msiexec.exe
Token: SeRestorePrivilege	320	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1812	msiexec.exe
1812	msiexec.exe
1808	iexplore.exe
956	Duplicati.GUI.TrayIcon.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
956	Duplicati.GUI.TrayIcon.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1808	iexplore.exe
1808	iexplore.exe
888	IEXPLORE.EXE
888	IEXPLORE.EXE
888	IEXPLORE.EXE
888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1752	1812	msiexec.exe	32
PID 1812 wrote to memory of 1752	1812	msiexec.exe	32
PID 1812 wrote to memory of 1752	1812	msiexec.exe	32
PID 1752 wrote to memory of 956	1752	Duplicati.GUI.TrayIcon.exe	33
PID 1752 wrote to memory of 956	1752	Duplicati.GUI.TrayIcon.exe	33
PID 1752 wrote to memory of 956	1752	Duplicati.GUI.TrayIcon.exe	33
PID 956 wrote to memory of 1808	956	Duplicati.GUI.TrayIcon.exe	34
PID 956 wrote to memory of 1808	956	Duplicati.GUI.TrayIcon.exe	34
PID 956 wrote to memory of 1808	956	Duplicati.GUI.TrayIcon.exe	34
PID 1808 wrote to memory of 888	1808	iexplore.exe	36
PID 1808 wrote to memory of 888	1808	iexplore.exe	36
PID 1808 wrote to memory of 888	1808	iexplore.exe	36
PID 1808 wrote to memory of 888	1808	iexplore.exe	36

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\duplicati-2.0.6.3_beta_2021-06-17-x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe
  "C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe
    "C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:8200/index.html
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:888

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "0000000000000060"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Duplicati 2\CoCoL.dll

Filesize
156KB

MD5
a19cd90de674cf1225e4087b0245998b

SHA1
097b4029f291b8c5ff24928d1536592c90fdeced

SHA256
9f521cef31800523760faac4338ea0e18d325ae2eb60f904f68a9635381ff930

SHA512
4347da063300c533f4d11d66fb23feed5b45ec93d047d64e164b3a7aa7e64abf38b431b23b1e6a1bf039b983d747a253cb3d756fadc02626702c7799b9831abc

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe

Filesize
435KB

MD5
120b4702e78a8e0da42a6362bfaf84aa

SHA1
4bfe0883b97c13fbdb7110a3fb142cbfbdeb6a03

SHA256
864eb2ff9db3902a237f7be33017351305c1d8a134822f6c0a0f177abfaf442a

SHA512
1019c7b4c136cfd23c915fd7d732bd66db9903248addb96a68430ef53a0421479b9c792e5c35a68edd64868951da8d5b282270e37fb2e8cd9b2ae98857a2ff19

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe

Filesize
435KB

MD5
120b4702e78a8e0da42a6362bfaf84aa

SHA1
4bfe0883b97c13fbdb7110a3fb142cbfbdeb6a03

SHA256
864eb2ff9db3902a237f7be33017351305c1d8a134822f6c0a0f177abfaf442a

SHA512
1019c7b4c136cfd23c915fd7d732bd66db9903248addb96a68430ef53a0421479b9c792e5c35a68edd64868951da8d5b282270e37fb2e8cd9b2ae98857a2ff19

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe

Filesize
435KB

MD5
120b4702e78a8e0da42a6362bfaf84aa

SHA1
4bfe0883b97c13fbdb7110a3fb142cbfbdeb6a03

SHA256
864eb2ff9db3902a237f7be33017351305c1d8a134822f6c0a0f177abfaf442a

SHA512
1019c7b4c136cfd23c915fd7d732bd66db9903248addb96a68430ef53a0421479b9c792e5c35a68edd64868951da8d5b282270e37fb2e8cd9b2ae98857a2ff19

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe.config

Filesize
2KB

MD5
02004bd9622fa6de0c811465de0d2cec

SHA1
45265f3303781c8109a67f7841094b0c9fabed9c

SHA256
9a5a032e345b3410c380daa7357a39199ce3397a47aee2683c084f2242065a53

SHA512
8e1f74f4949035c8d09d694e0186f7a544a93f01e87b5d1f6c63c046775b184bcdb495cc53998f1da26c8405ae2081c07bfa6f27b705305b7908d313cf6c5f22

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.AutoUpdater.exe

Filesize
59KB

MD5
dfe6d2707691eeb6f031d64e58dd3614

SHA1
226a380ba868ef9120ad5efffc11ad9faf273597

SHA256
ba12cb217484f0f4dcea8c98966200de7656293979b575c8c54520dd1d93335f

SHA512
41676ad7ff8cda030d49698d0ad86d045de6c09823be91cc9ec3e0a3dcf639e73ebc6dee0d77a4aee1bd30bf0ad77f2c4136c91b7256478a2acf0b3c94e45bff

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.IO.dll

Filesize
39KB

MD5
c35d8e46e34983d318f633317a434289

SHA1
357e24ab4aea137341555e3d8786e622966fb48e

SHA256
b5330c50dbda0ebeea3c2de62a80955030457a31b95028469a762d5648ce5c7b

SHA512
b6fd4e009aa3f15e1c0fc42f622991a6320c3eaefa61e8c5e44d5314c02dbd5fd2058e003bf1edfa82782ab86f6f434513077c02f408b969c83b42139158daee

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Interface.dll

Filesize
33KB

MD5
f71fe535098d9e3e079f12d73b3a2ca4

SHA1
e580788d21431dbf3212661efe026e472df97eb5

SHA256
d69cc4a05a1f96d142dd5dba4ec6f45be504fd0a7b9840f88ba09d9e37e45a64

SHA512
f16a5f00394cf0f3f121cd579c3123e001b34626c9fa396446d5919bad44a7e08a0fa35a796cae91b62b6821e4e539b2e39ccbf81a708b4686a38c5e4f8b16b5

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Localization.dll

Filesize
2.1MB

MD5
22643bfb0af4984f73c9e7f653889342

SHA1
8ff68b1b01ccab355e8d935aa26ece31caaa96e1

SHA256
da0682659cecec9f4fb2a0ed2daa7b21e6140cb677de08098ea006d090388aec

SHA512
f0d73eb1454629dff76c19c7601bf157d6f563678ae0f53605023cf967d387ea257a462ba8f81bd1729221bd133e62298e42cdcc65f33624b09737038a648392

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Logging.dll

Filesize
25KB

MD5
9c23e2e276cbd883671e25cbda65726d

SHA1
ba81cf7395aeaa8aabcdebb3327d858e57b9644a

SHA256
b48dc8199e74adffd89dc565a35b0d5eb22bd3677c7006e769c5ab48136ec4b5

SHA512
674500c623b624ca178d9b5096e9f82dc76834b4fcf1aaa418ea9eae1ad7b88ec6d4072ae7896dfd9fa0e5f8361f88cff31df580b9f1eb5bb4db93f777424399

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Main.dll

Filesize
895KB

MD5
11147106d569f21526b2212621c98595

SHA1
eae6269ba67f7acd353e4f2a462b02ef96cd3fa4

SHA256
d99c1004254febb2ea34204f940ab2fa4b2301e79f4d4e0e65c9dd5dc777a117

SHA512
b3554e149b11ff3d7dbfeff7c300591bfd5e710eb50e9b72bf4b5aef1256644cdc5ae40ce2dc46c088a13c31091a56929b141cbc1b25a278c808d201c13bd2df

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Modules.Builtin.dll

Filesize
105KB

MD5
3f69bcd4669706c60b32dbfa780efb7d

SHA1
4f1d1f56bd596e378fbe597b79e383aaa4054085

SHA256
5f5ee065c559327b4cb727188a01b346c57c6c7b5cbc261cda002dcaa64c64ad

SHA512
0f99604861fae7f7853cc1c7eb9643d71eccf4cd8a1e46ce6bc3c73000308a052d237c7ac02ce6a96b1385a47dfebdbe94b011e2b833822d5dfb639f0afd4955

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.OAuthHelper.dll

Filesize
46KB

MD5
250bf618d585572efd573c4919a61f5f

SHA1
cd4b53daf6018dc2c740acc111080ded885b414a

SHA256
66761efa3d1ff43731d0151950f0a0ba59c70c0752c14566dc59c767dfc22a83

SHA512
e45cda72692b33d77b12a825d83067a131882044945957e9a1e47ddd324ce46fce4ef1a8f2cc11c2a05e6ca6e101eabe1fd11c8f9a8a6e47cb2361e4df3396ce

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.UsageReporter.dll

Filesize
38KB

MD5
486af459e1040336cc40868969877ff4

SHA1
be67a2740ea1fd6dc2973e24139356067d580e1d

SHA256
7486158f4ebcccf7316703c6bac0cd8720ec02487828e3e73ba954a07077cfed

SHA512
731074667c2c63a037ed56753f6fe00053e09e6e5ba67dc89b2317fc6a94de300ad9e544b0455fa2c8e69c5b3e4f47e1a6be5b2a614b1772f681c562e3707704

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Utility.dll

Filesize
129KB

MD5
ce21c5dd1ce33e83fc204083587021c5

SHA1
ba2ddd15b63a90c711736a13ae66a03fe02caf0e

SHA256
b504a8bd01192e3b3a0e114fd0268421ff30a4022d450411f8c187c0c94ccf99

SHA512
01210a5c43575be339d292a76aa1209816ccad5a65a22b39e917451292b00293612fb97a1661da49af79f8fb699126c5f8e45d5c16f60d7012d7fc3759874296

Download Submit
C:\Program Files\Duplicati 2\Duplicati.License.dll

Filesize
17KB

MD5
9b98d6f5b39dbd0f4da794cd36f45c98

SHA1
87a4847e18b48ed7dc6d9798dd359503656f9641

SHA256
bab1bdf92cae9024b1cb20174ee32314858389d980c81701c8cd8ff7d20f7ce2

SHA512
4d677db8b474bcff3424ff74d7cb0aa5ee77e255ed19d075666b4b215e06a5f22c0fb78bca47baaad1978049959f8eb240565a251fcb1720410a7caba2cb88c5

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Server.Serialization.dll

Filesize
29KB

MD5
1ced72a2ed16c237e32e60c87eaa8fbc

SHA1
a678b920f283d218d8929ffc78f2c0ee373ee10c

SHA256
e58240ab64c98747a13e2fa28c92a351ff359ccac5b440fa8da394a7eb637515

SHA512
68ab35cecccbfb2ff9a9fbbc436f08323b3967e5ed56aac3a2ee9c26718f8898ab05c5ed5d904ed2375e8bc812df7736352d081f0cdab0e92c572c8d2d03657f

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Server.exe

Filesize
276KB

MD5
a4b6ced4afa1f28ab12239904fdd981b

SHA1
79625563b89ea084ade4e0c162f5b581487594f2

SHA256
75c048ea0e2f67ddc1da8d3c69f68d0e9ed1576c31937810c2849d1662390247

SHA512
db1f7cb1f2840b98cc8b2372d4638a71456b2d8bffae0772251e075a4ee19884b3089b58b222597c6c444d2f15fdf3f653500575d0051796c4fafcd992d9344e

Download Submit
C:\Program Files\Duplicati 2\HttpServer.dll

Filesize
128KB

MD5
317820d7bb5045a824684674bdd0eaea

SHA1
28b4d8862b351906483cd9e5ebe112a615043840

SHA256
81184f1aa5604f10db8c1b69eae9248011f44b869048bdd3d6f87b96fbf12667

SHA512
d18802750d5ad6c9ee10af306ffcb84033667e2e8c9b2a5e156883c178e03cb37b82b85e82cdba8a8011ceb5bd4dd8a4ca7b206f82c276c0a3c6c19333276db1

Download Submit
C:\Program Files\Duplicati 2\NGettext.dll

Filesize
39KB

MD5
c5b823764576bf0e26f936251331c7b8

SHA1
53e862ab979d92f24d5c2ef972365eae30f1b5c1

SHA256
bf4e06ef47575920cc31727470a8e75a54b42f2e0dc4bceba0adbe4c3900a23d

SHA512
b8e8f543f7875f257bcea41100dd498307080d63c5809e6f8329ed32ef0f437a383c2ca753066b23a43d5b2d4bebccf98b49b28c124c563ffc1a95aa2413d0f2

Download Submit
C:\Program Files\Duplicati 2\Newtonsoft.Json.dll

Filesize
659KB

MD5
4df6c8781e70c3a4912b5be796e6d337

SHA1
cbc510520fcd85dbc1c82b02e82040702aca9b79

SHA256
3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af

SHA512
964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c

Download Submit
C:\Program Files\Duplicati 2\SQLiteHelper.dll

Filesize
18KB

MD5
d29d1020dbe7dc71b99c794204a2d4ba

SHA1
31b490067ced5a44b297515e981fed5e626a0c51

SHA256
a4901edca392452b82d8bebd47ae21675a1d0dcb504524910471a8aea871e923

SHA512
0be39c3a54cb474dda226a3f6807bf353cffff4b90165ff95149cb769421697d82cedcdf792b41a1f7f3d03685e2b091a1f26d31ced4e4bc962bd96b2e9f4b4c

Download Submit
C:\Program Files\Duplicati 2\SQLite\win64\SQLite.Interop.dll

Filesize
1.4MB

MD5
4bdb3f840b80dae7ef1b07ef456846ea

SHA1
432cfe5dbe4499e8d6d603da0bc67de9b2726445

SHA256
c3eede99fa0048b96c313f3d89b57f5edb52ea91f73a0da0baf5178ccfe2eef6

SHA512
a7506cb18ee573fbde68d917aec8861d762afb1e6d3b4f3e4a5d72cbbf49518042e6d7c29425335012ef172642c022892576d5d08775b4704a22a7c0ff9d06d6

Download Submit
C:\Program Files\Duplicati 2\SQLite\win64\System.Data.SQLite.dll

Filesize
344KB

MD5
99dd5de4174bf7fd09ed3ae2c21fe8e2

SHA1
a237230ec3ac2c4e3211b7ffaec7e2272440e688

SHA256
a1fd117d427918d22dde8ffde74587f70adb80c2fc072bc5ebf9e4c9b69f2933

SHA512
bd3573da0678b9a248109d2aeeb2dab2ed8feed774593d23f59665b02fb37008a72abf9265dcdf27f42fb55d5445d90c0b0a319537e3821580d0e73f287dd4f7

Download Submit
C:\Program Files\Duplicati 2\System.Data.SQLite.dll

Filesize
344KB

MD5
99dd5de4174bf7fd09ed3ae2c21fe8e2

SHA1
a237230ec3ac2c4e3211b7ffaec7e2272440e688

SHA256
a1fd117d427918d22dde8ffde74587f70adb80c2fc072bc5ebf9e4c9b69f2933

SHA512
bd3573da0678b9a248109d2aeeb2dab2ed8feed774593d23f59665b02fb37008a72abf9265dcdf27f42fb55d5445d90c0b0a319537e3821580d0e73f287dd4f7

Download Submit
C:\Program Files\Duplicati 2\System.Data.SQLite.dll.config

Filesize
736B

MD5
8ab01db32f56322275cbd0864feb5d55

SHA1
cbdb70f5fc04485af0d09ef7484faa7f8b3047bb

SHA256
cde00e0a0f52ed121d52c17338da42ffd9656d4f81a76df2dceda05c88f783ef

SHA512
e52a5e341309bae40a4f69d67226a92dfc42b08d4e815da3a7df7295d68da6dcad8973d32af84f269692bd98634c4657e1394366574f5ec299eb50fa3d1db468

Download Submit
C:\Program Files\Duplicati 2\autoupdate.manifest

Filesize
218KB

MD5
885424d583c859ed85627d054080bcb7

SHA1
cd84ff359fe58373c7d86bc18fc6bf526a3cbff2

SHA256
cfd02f48b88d16a23994361f914c0ceb25b84775092dbd30f2220f1bca7a585c

SHA512
05233406ff6024cbe741b60f2f19092223da15489942d60f23b332c06990f034ef6c591a044f30460bfe8b9d524a0661fe07d02af0ddce4085ecc62951e0a095

Download Submit
C:\Program Files\Duplicati 2\webroot\customized\customized.css

Filesize
36B

MD5
6fd6d760b5a33a442c5a171022e4f7d9

SHA1
be7bd673c5b270bbe7f626b56371284e9ad9b9ba

SHA256
3b167971e15a01d5b8b16f0132ed9b36752d20b584067ad04ea4b840d0bae126

SHA512
5eaa5b95c5e5d2e81f678e407fd30b9eccea2d6b5c49cf1964634ca9026da5bb8222367c664a04bc66f8e80d0057993b23643e78c07a91ba74609cfe59b587a3

Download Submit
C:\Program Files\Duplicati 2\webroot\index.html

Filesize
1KB

MD5
7307eb11e64a0934df081051b7445c6f

SHA1
f1c77e3052b7a89dc6779242abd484d53f33993e

SHA256
7746454235cb3960d999038be82246efacdfb43ace790cf4cb8e22916e8f16e8

SHA512
ec7e92dd2877d3b53eb3180c1747ca7ff31135ae79629fa130fde7078a145949dde58218924d491d2aab1f38385c3da86c172e5efb87fd84379227511875a624

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\index.html

Filesize
21KB

MD5
6311412c8b609c93c19f00dc5607b039

SHA1
13f80f3ea0d9c0ebe6523974b6fceb01d0882f59

SHA256
7828db2c3c04f83f8836541e7e6ce1df81926a086e20a0961a3698b2bd24e40a

SHA512
1470d8eea8d0c9b5c1e71b7146a77318e28ff1898d461ac690a8cc4cc910b760720f6583e69c18a38b59abc384fe04b1daee409268a781fc98ca1168dbd94c0c

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-animate.min.js

Filesize
22KB

MD5
abf4748a7ef6bb5b610ecb5ab749afae

SHA1
d06789f4a6d2907b9ae799602745a1ece2aefa0f

SHA256
97653bef82db77a701f9d2a415900c36078901f4e14ee3b731f36ffeb5aa9850

SHA512
b6b3a30a884966e5d5b140dd2b8a9faa2947a80f7f6636af10df5069cce67115b69b295c06ab2a1da6d1410c314ff8e772141013a7daf257c40c87e4ef8e9948

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-cookies.min.js

Filesize
1KB

MD5
c7ea09ff0b341fb7c648d16a056ba395

SHA1
0574c478addb9303d0d313ca36bad7a8a6182d58

SHA256
14720e097c4454765a3d5b53071a519ede02de67859b464d58cc1e26076bedc2

SHA512
9bb8403ec9c9863e11d5319918c2d7238d8a17f43be4e39dd562a064a0256d5e603604f5c65e7c9548308059a25ec38cb0566088cbce5b8a8d60d405c6855ece

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-loader.min.js

Filesize
1KB

MD5
2ee3222394e5cec6bf151a02699d34b1

SHA1
2a8913f4a577d68a538a5540a56dc4c980bd3039

SHA256
cdba8badf4f1794a33f5ddb004e53d9ec03945939b6dc26316d8f85641454d89

SHA512
16e07c9a5696d1027d80886906e07af5bf6edee1325609b3c51e7b20b5ea1eff9c61a314213cf27704512bd6b6ef90544b61bc56ea5e468185f7b828c3825038

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-resource.min.js

Filesize
3KB

MD5
97796a250538882e4d26ddf37e05f208

SHA1
2b8ec6d42e87816cc3c0913ecbb67874a072bbe7

SHA256
71a58ac067d715151a49a0c1ee89aab221fc7d483c8745d7c644296fabe8d772

SHA512
76969c9bdb99396f4ae713d9d645aabfa593f056b3d2fcba9faec1ee63468eaf2b5b4ac65d3e015fd91b9511820aa2ac7e619f1bd90cf5a85b29577949aa3084

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-route.min.js

Filesize
4KB

MD5
ce6c7d9fab94072d82a126c27e259a80

SHA1
867e67f37bfd180eb64ba0881ebe1a28f0e5649b

SHA256
46b9a21e39611c0782d0d0746518082029df55a0aabd464cf291fd2d973a76e5

SHA512
9b7c379b9b573aef22942c034cd3fa4a7c46b765b3a929b01b4e344aa250adc042b3fdf62058292a303ed7cb9d71719bfec43c6d965d734f18ab7bb0bbde80c2

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-sanitize.min.js

Filesize
5KB

MD5
bacfe60d661bf26faa119cebc50c6518

SHA1
83b0f02d070149b4c3ae4643c9c656afb0acf433

SHA256
4713972b2c0b51aa082d103989f04db5614f162c070944e98f6bc3e94140062d

SHA512
b06ef0e21f47766d0ac34e1bb0623d96664a63c44d4341b0b048b1eef184f1abf17bd0fc0c508aaa7e3d10d317749923c9a7ebb8683771fce40774c8ab2d2f28

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-touch.min.js

Filesize
3KB

MD5
5665d0692979a972c2e4f7523a56c814

SHA1
c68df316661475371fbf308e83c98b3ffd3d1ff9

SHA256
e7abe75520880fb7e29fc199b2de1ec25787ee57d09e7ff29ecd9bf8e46a885f

SHA512
6f7d87e8b01e96923855a45ee11cb990d6001ec6ab287985d9551f33f2df0fa098741a558c4bd7bd5cb8a51b7bb0178ba73893df40b9c6242194aa3227f7bab4

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular.min.js

Filesize
141KB

MD5
d2342622316f832ef1333c74e41354ca

SHA1
74b2457fcdfd192423146de16f5450e96c789829

SHA256
9051fdcf3b95d87d41a74cafd3db94fb4484976c7da9c27b43ade4745b01905a

SHA512
1ea0b51b5c7af12f21727005e3cf14f5e2bd79e90c86881963f74ac767b96ad8b579b63062228bbcea2e210ea12c541b161f61595ac55992491aed4ce0b64493

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\angular-gettext.min.js

Filesize
5KB

MD5
60bcde3571c503af787c3fe7a49bc817

SHA1
b08b39cc3f764072f7ea20cfc8964cbf1fe7630f

SHA256
b954479cc30ceea5f543157c2463b283a68f16abc8bd8e87158b3029f002190f

SHA512
5cfb1449745ffd920cd018992a898b517a57b84b661c7b1d4a473b760f887bc8209321b2a5df23501b5c99e9a5b6921484f8bc445e383881164e779bbbcb2f27

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\clipboard.min.js

Filesize
10KB

MD5
4a5ce070c2a4e7342d28e47f019880a0

SHA1
49fad7f0b3596a81a570d98812fa09233b286dbe

SHA256
fac02a96e87d9afaa0ccb933490c281386d6f3b3971e419c747fd6e1f5875e1f

SHA512
b370f4dd31dd401f4a3a21fbf6be8ceb30c0aced7e2cd4802837ca231433655e43da8266968460fe202b6114514c42c12b06eaf70fdcacaa90a57869365d453a

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\cryptojs.js

Filesize
8KB

MD5
bf0b3194a3e3b3a299854e2f623ad883

SHA1
8a8d630020f978995cc3bcae09e4e5adc52b3a1e

SHA256
d58b77b8772a9dc5e1d005e07d48d261b527828aebaee8b67ab2c7cedc2b9ca5

SHA512
faa3b0138e91b648d03709d4003839e51f6eac66df4b43b64ac246f6eeba14f95b7eaa58231f939562089b0479bfdcf47bad3951eeb6c7c855fdd1ca0a870302

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\dxTree.js

Filesize
2KB

MD5
8ab03d1893adb30bb6702a3d5710c2f4

SHA1
00c9a3f431503cb0e3b0eb8f716d0623f42075ad

SHA256
bcabf68c346669e32050066f4876b6a4558ba11b3fc0fb2f003456488c8b873e

SHA512
71b4ec1a7e73e8bfac3c44eea5c4ff492737c1612bbeceeb18bd10b00729121a4faffd801067f281330b8df278d6e0dddacf1d9a9e128e98a215b687725ebde2

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\jquery-ui.min.js

Filesize
222KB

MD5
a260a5162201f288adf08ae3d2ba9f89

SHA1
fb471217c99800ef719810adb07f0b0129b952b2

SHA256
5aa962ebf4317e3d2f52cc1fec293eb52f8532f3b48455dbce096c024f9ba4e6

SHA512
a513d1aa0307fb7f6cd483f8b995da25db9f3ac028ed770c1c12503c9d80a4ee2c734e5906f3d7564e10c63005bf679acc32dc2a609a4307f97a66eb34662cf8

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\jquery.min.js

Filesize
82KB

MD5
f9c7afd05729f10f55b689f36bb20172

SHA1
43dc554608df885a59ddeece1598c6ace434d747

SHA256
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

SHA512
3dcae1ff6e98c64e3586be3eb14dd486c51f7d4e9fa1b8f9a628be4fbb6a9ab562f31f9b50e16d2e0c72b942bdbe84eee8e0ef87fa730db1428b199a59d88232

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\modal.min.js

Filesize
1KB

MD5
51732e8cc87cd36c73b8396aa48b888e

SHA1
2724ef34149cf227c526f1ed307d8006417f26e3

SHA256
f37dcb498fa35be1fa0e77e7ab304f4743cc9e901c91a03baa55eb71e5fc7800

SHA512
8348db131905808c139a22b7ab125e493acd25671de552d5ba3930379d0e6cb9920f2f1ce7a65b993c567387ea60b3e288f6d62eb03ebd4fc22dd413bdc175de

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\moment-with-locales.min.js

Filesize
202KB

MD5
d109c18ce9007af28f705431546ef658

SHA1
b0f4ce7db5a9822917b68225a16d9442fcfcd1f1

SHA256
f8143c84733f74aa5b75ae64468645c20937cf70e9ea7c264082e843b81131b1

SHA512
91f8578fdc9f5ae7b7b0ca98477c7dd0729496498665edb43d91a501713e1ea72330084a814086add5da158a21024df0dbb4c2f0ed0bac560e66782fac34349a

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\ngclipboard.min.js

Filesize
640B

MD5
9459cbc70b529454029535a130876a2e

SHA1
c51a51d45bae54908ab27db9a06cce1486c6f071

SHA256
bf21eab631c9f2c06187b511d130808f3b52b692370c50be56b01c61e10cacf2

SHA512
cab276512f2446038d4017ee9b1fd56da5116ded931f09b0ba767799ee22b371f09009e1244dfd327032e6f562af5e21832041913a8aa8e93d923c3de5b8374b

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\oldbrowsersupport.js

Filesize
589B

MD5
4f690dded7c1b5d07c031c7c37e798e0

SHA1
be1c21e36d57ebc4b7f75f752cc5faf5364e546c

SHA256
f491051a83a4ca236aa860609e6b181e7f4dc7587e9eee8d5669ea231d61a7e0

SHA512
2178d7a0e3c642f390bcb518fabf7936945b1a637113d3653a99e436b9187d811b0dfb4d0f11b609b1ea855d817b038e52fffc0619866f3bc5e0f5140a918bfe

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\zxcvbn.js

Filesize
682KB

MD5
928efd602a8f30dd54f0ea49d7127b48

SHA1
c5546fadaa5f18b53567a79d90a8d1355010bbf0

SHA256
bd611d1c72af496613b44b0e25d20317b53e28a29aa5103eab4858a643cc76cd

SHA512
ec3bb888080a5f8f5c831e53ba0807bf3758c91cf21e447eece4156ee6e77d98f61b84b7fe8593aacd378fafcc5932e73aef4a268bdba1a6ce4a09e087b69fd5

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\styles\smoothness\jquery-ui.min.css

Filesize
26KB

MD5
9c6afa27e09fb6eefd70e20a7c9de40a

SHA1
417d5a7d09fe8ca4f3968f4f3bdc3ad1746eecb0

SHA256
cd5b14ec78ed6b53db0fdda9db112f19b0a45f18ceb9bfdc3f5573c2ac0dbe65

SHA512
d67f5be995e43bad7ffecaf6c45338da12e80dddf3d34fbec81d63f03cf780a24bbc29eb0a1c8dc94b25e41902ee09ae56765e19b933b811b2434f4424532647

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\styles\style.css

Filesize
98KB

MD5
6e9a87c4f84d2e968382439591a5f6a8

SHA1
9a146517c36dfa446704a9b1dfc4444ec4f2551b

SHA256
d69800a8ee70b4a3c36cd9b02adf64066d5edf1342942ff57117e56e0ef5ae92

SHA512
6012a787dd527e0874574a1f212013aea5f4b081ca280065be8566a74ae2b3aaabeeb7e4e325ae61d38f911821d11b373ca3fda20146c666ed23cc41f4f359b7

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\styles\themes.css

Filesize
1KB

MD5
8ce48fa084b1328bdf10fe86ccbfb663

SHA1
3f4d81521226a56b3649ad8dd07a26d0ce95e71a

SHA256
54a04e6459a86f1cca3db6e1420052f4feb07799fc3eb41aa311df79be76cfc8

SHA512
a059cbbbd086fb360623b464ef05088e0f4f79695c611385240fea00f0078a63e2d243e354c3523af90b6c116599b091cd101f2791b2bf7b144544f1a7e3656e

Download Submit
C:\Program Files\Duplicati 2\webroot\oem\ngax\styles\oem.css

Filesize
35B

MD5
07a08fad32be2d0a627ef43d59e115ca

SHA1
d615f23478d584af9fd22190ee030708b01189ea

SHA256
9bfafbf75f591b4fdfd9a900058ed1beae3e9d669b1d81be469b86b9eaa57721

SHA512
92950c66859caaaac30d43d1b62b06f8fe1428a6b85ce3d509e72707a2d674f3cbd2bdf705abcb991737df61de4c6cbae150bd528046e5a38a8ab1d36ef648f2

Download Submit
C:\Program Files\Duplicati 2\webroot\oem\root\index\oem.css

Filesize
35B

MD5
07a08fad32be2d0a627ef43d59e115ca

SHA1
d615f23478d584af9fd22190ee030708b01189ea

SHA256
9bfafbf75f591b4fdfd9a900058ed1beae3e9d669b1d81be469b86b9eaa57721

SHA512
92950c66859caaaac30d43d1b62b06f8fe1428a6b85ce3d509e72707a2d674f3cbd2bdf705abcb991737df61de4c6cbae150bd528046e5a38a8ab1d36ef648f2

Download Submit
C:\Program Files\Duplicati 2\webroot\oem\root\index\oem.js

Filesize
35B

MD5
07a08fad32be2d0a627ef43d59e115ca

SHA1
d615f23478d584af9fd22190ee030708b01189ea

SHA256
9bfafbf75f591b4fdfd9a900058ed1beae3e9d669b1d81be469b86b9eaa57721

SHA512
92950c66859caaaac30d43d1b62b06f8fe1428a6b85ce3d509e72707a2d674f3cbd2bdf705abcb991737df61de4c6cbae150bd528046e5a38a8ab1d36ef648f2

Download Submit
C:\Program Files\Duplicati 2\x64\SQLite.Interop.dll

Filesize
1.5MB

MD5
a0d07d0e354c7760497ef7ea6227b937

SHA1
10cfc3ff37b8b492a2130d1cda2ccfa8788a9650

SHA256
f39fc4d52b3e9e1a8d30fb8e2ffd320c1b54a5d5c5ad2444e57f0b3642cdc05e

SHA512
908c234cb616edc87a76d9153a6da8f2a1013c477602ec2068dc598592cd1355569f42989b1f4b29ab43f9dde3912dbfd9bfb01eaedbf6960277d629f75e24eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
1373b57a94fac3d77b9d2c6289ed2cca

SHA1
b1c5e5cc9fb8ba841ea54b479b13adabb74ca52e

SHA256
8b08dfe356c4f5991477ab12818a8e5236834db01c96cb10ee1398e1763c5ed4

SHA512
2844d21f4fd6bdcd7ed94bc844e5964affaffe926e8058f60b1449d718f68734dd1f854b216954e8a3d1d354accab4ad5a9f004437b062f2669431187625149c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_E1CFD161EF41EAA54F3E842C74412CE8

Filesize
471B

MD5
119e4194888f160773bfe79e9b99836f

SHA1
c19e07304782f6ec26a6721792adbca9d76c4f0f

SHA256
8a9ba027800fb61a49bfe78e21cc66cda9ffc165fd6fa2bd0aee4f7b3ca3bb44

SHA512
2a56498796453a48bf1adf7bf5e71e3799c04bd29a990ed64fcefd426a85e36f115eb03bc78603cb157d3a467b6c38ca6d74f1156ca882da11468481f11d34ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
434B

MD5
c5457e6d457c9b2a57e259ae7810295e

SHA1
9fbfd9caea52f7b7f19c7fbdf94d008dbd4be767

SHA256
a9a3db10e4d680bef12d590ee0243a34f518a56eb72e00056ca47feace11abf8

SHA512
876cdff890e1bb56b2476ee8c18d4acdb95bd46a16c83502444cd8831646cbc6886834d7ad4175b73e5fee46e894be8d622ed4939456a64c382a1efb1977f755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_E1CFD161EF41EAA54F3E842C74412CE8

Filesize
430B

MD5
e3daa388a04f9fffe5341cdd22c533bc

SHA1
55d3e687ac23e506b6f6cadbc92642e9b49646a2

SHA256
a270e99af77513829b9f77189ca3cbe0102f6fa364677046cd91e7a8319159cc

SHA512
f751e56aa6c8b721b8bddad25074764799cfc04441c49915414bc4e2cd287cf7d45099f4d77f705393ef95358a2a71fafd067922280ffab76fdf0818205f1372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31074b9ec11aad93ad0c2d44605ca5bc

SHA1
b7ea8bb41712747a4c741017a1636350660601ad

SHA256
6ce702f5917479cbf1711c1255fb4d52a638a74e080d7448a0f88b8beece51f6

SHA512
b83c212af42a46cedb379bcfb1aed7c62a5d54fb3b6eb256084337737825e401d9031a3f7fcded4bd091b7a6d0e11cdada36fa83c69bc78902cc6215df406187

Download Submit
\Program Files\Duplicati 2\SQLite\win64\SQLite.Interop.dll

Filesize
1.4MB

MD5
4bdb3f840b80dae7ef1b07ef456846ea

SHA1
432cfe5dbe4499e8d6d603da0bc67de9b2726445

SHA256
c3eede99fa0048b96c313f3d89b57f5edb52ea91f73a0da0baf5178ccfe2eef6

SHA512
a7506cb18ee573fbde68d917aec8861d762afb1e6d3b4f3e4a5d72cbbf49518042e6d7c29425335012ef172642c022892576d5d08775b4704a22a7c0ff9d06d6

Download Submit
\Program Files\Duplicati 2\x64\SQLite.Interop.dll

Filesize
1.5MB

MD5
a0d07d0e354c7760497ef7ea6227b937

SHA1
10cfc3ff37b8b492a2130d1cda2ccfa8788a9650

SHA256
f39fc4d52b3e9e1a8d30fb8e2ffd320c1b54a5d5c5ad2444e57f0b3642cdc05e

SHA512
908c234cb616edc87a76d9153a6da8f2a1013c477602ec2068dc598592cd1355569f42989b1f4b29ab43f9dde3912dbfd9bfb01eaedbf6960277d629f75e24eb

Download Submit
memory/956-148-0x000000001CBD0000-0x000000001CC30000-memory.dmp

Filesize
384KB

Download
memory/956-178-0x000000001DAB0000-0x000000001DABA000-memory.dmp

Filesize
40KB

Download
memory/956-99-0x000000001A8B0000-0x000000001A90C000-memory.dmp

Filesize
368KB

Download
memory/956-163-0x000000001D3A0000-0x000000001D3AC000-memory.dmp

Filesize
48KB

Download
memory/956-95-0x0000000001FD0000-0x0000000001FE0000-memory.dmp

Filesize
64KB

Download
memory/956-93-0x000000001BC70000-0x000000001BE94000-memory.dmp

Filesize
2.1MB

Download
memory/956-91-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/956-89-0x0000000001E20000-0x0000000001E2E000-memory.dmp

Filesize
56KB

Download
memory/956-87-0x00000000005C0000-0x00000000005CC000-memory.dmp

Filesize
48KB

Download
memory/956-85-0x0000000001E10000-0x0000000001E1A000-memory.dmp

Filesize
40KB

Download
memory/956-83-0x0000000000550000-0x000000000055C000-memory.dmp

Filesize
48KB

Download
memory/956-164-0x000000001D3B0000-0x000000001D3BC000-memory.dmp

Filesize
48KB

Download
memory/956-165-0x000000001D3C0000-0x000000001D3D0000-memory.dmp

Filesize
64KB

Download
memory/956-166-0x000000001D490000-0x000000001D498000-memory.dmp

Filesize
32KB

Download
memory/956-167-0x000000001D4E0000-0x000000001D4EC000-memory.dmp

Filesize
48KB

Download
memory/956-168-0x000000001D6A0000-0x000000001D6AA000-memory.dmp

Filesize
40KB

Download
memory/956-169-0x000000001D800000-0x000000001D816000-memory.dmp

Filesize
88KB

Download
memory/956-173-0x000000001D960000-0x000000001D96E000-memory.dmp

Filesize
56KB

Download
memory/956-174-0x000000001D970000-0x000000001D97A000-memory.dmp

Filesize
40KB

Download
memory/956-116-0x000000001B718000-0x000000001B737000-memory.dmp

Filesize
124KB

Download
memory/956-115-0x000000001A930000-0x000000001A940000-memory.dmp

Filesize
64KB

Download
memory/956-113-0x000000001AD10000-0x000000001AD2E000-memory.dmp

Filesize
120KB

Download
memory/956-105-0x000000001A780000-0x000000001A7A5000-memory.dmp

Filesize
148KB

Download
memory/956-109-0x000000001B990000-0x000000001BA74000-memory.dmp

Filesize
912KB

Download
memory/956-107-0x000000001AE30000-0x000000001AE5E000-memory.dmp

Filesize
184KB

Download
memory/956-145-0x000000001B718000-0x000000001B737000-memory.dmp

Filesize
124KB

Download
memory/956-146-0x000000001B680000-0x000000001B68A000-memory.dmp

Filesize
40KB

Download
memory/956-111-0x000000001AF50000-0x000000001AF76000-memory.dmp

Filesize
152KB

Download
memory/956-147-0x000000001D310000-0x000000001D394000-memory.dmp

Filesize
528KB

Download
memory/956-149-0x000000001B690000-0x000000001B6A6000-memory.dmp

Filesize
88KB

Download
memory/956-150-0x000000001E030000-0x000000001E116000-memory.dmp

Filesize
920KB

Download
memory/956-151-0x000000001CE60000-0x000000001CECC000-memory.dmp

Filesize
432KB

Download
memory/956-152-0x000000001D5F0000-0x000000001D692000-memory.dmp

Filesize
648KB

Download
memory/956-153-0x0000000021AA0000-0x0000000021D0E000-memory.dmp

Filesize
2.4MB

Download
memory/956-154-0x000000001D450000-0x000000001D482000-memory.dmp

Filesize
200KB

Download
memory/956-155-0x000000001CD40000-0x000000001CD5A000-memory.dmp

Filesize
104KB

Download
memory/956-156-0x000000001B6B0000-0x000000001B6BC000-memory.dmp

Filesize
48KB

Download
memory/956-158-0x000000001CC30000-0x000000001CC3A000-memory.dmp

Filesize
40KB

Download
memory/956-157-0x000000001D7B0000-0x000000001D7F6000-memory.dmp

Filesize
280KB

Download
memory/956-159-0x000000001CED0000-0x000000001CEDE000-memory.dmp

Filesize
56KB

Download
memory/956-161-0x000000001D0F0000-0x000000001D0FC000-memory.dmp

Filesize
48KB

Download
memory/956-160-0x000000001D0E0000-0x000000001D0EC000-memory.dmp

Filesize
48KB

Download
memory/956-162-0x000000001D100000-0x000000001D10C000-memory.dmp

Filesize
48KB

Download
memory/956-172-0x000000001D940000-0x000000001D952000-memory.dmp

Filesize
72KB

Download
memory/956-171-0x000000001D930000-0x000000001D93A000-memory.dmp

Filesize
40KB

Download
memory/956-170-0x000000001D820000-0x000000001D82E000-memory.dmp

Filesize
56KB

Download
memory/956-179-0x000000001DAC0000-0x000000001DACC000-memory.dmp

Filesize
48KB

Download
memory/956-180-0x000000001DAD0000-0x000000001DADC000-memory.dmp

Filesize
48KB

Download
memory/956-101-0x000000001AEF0000-0x000000001AF4C000-memory.dmp

Filesize
368KB

Download
memory/956-181-0x000000001E250000-0x000000001E2D8000-memory.dmp

Filesize
544KB

Download
memory/956-177-0x000000001DAA0000-0x000000001DAAC000-memory.dmp

Filesize
48KB

Download
memory/956-176-0x000000001DA90000-0x000000001DA9A000-memory.dmp

Filesize
40KB

Download
memory/956-183-0x000000001DAF0000-0x000000001DAFC000-memory.dmp

Filesize
48KB

Download
memory/956-184-0x000000001DD80000-0x000000001DD9A000-memory.dmp

Filesize
104KB

Download
memory/956-182-0x000000001DAE0000-0x000000001DAE8000-memory.dmp

Filesize
32KB

Download
memory/956-185-0x000000001EA50000-0x000000001EB16000-memory.dmp

Filesize
792KB

Download
memory/956-175-0x000000001D980000-0x000000001D98E000-memory.dmp

Filesize
56KB

Download
memory/1752-66-0x0000000000210000-0x0000000000280000-memory.dmp

Filesize
448KB

Download
memory/1752-68-0x00000000006C0000-0x0000000000708000-memory.dmp

Filesize
288KB

Download
memory/1752-70-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/1752-72-0x0000000000280000-0x00000000002A4000-memory.dmp

Filesize
144KB

Download
memory/1752-74-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/1752-76-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/1752-78-0x000000001AB50000-0x000000001ABFA000-memory.dmp

Filesize
680KB

Download
memory/1812-54-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download