9a442ced41f0f9a0142618ce04b67d56c49d9e1c215a2ffcc13f8309428e3abc

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2023, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

duplicati-2.0.6.3_beta_2021-06-17-x64.msi
Size

40.6MB
MD5

29a941121d8e8326f0d2b3bd1278f70d
SHA1

9b6423bbe3bbf0e9bff8a2db83d78bf6410304e9
SHA256

9a442ced41f0f9a0142618ce04b67d56c49d9e1c215a2ffcc13f8309428e3abc
SHA512

bf1f1878db627308f127e7a60191971c2104e546f88eb516c65e079f6032b566323669ea2c0363c805a9b1dac11320b1216e58ff06187a1d0dde83974f0649a7
SSDEEP

786432:BLEhpgno079Az03fcxM9KtxqO7EdeTNgXbDS4Rv3sky+AsoaC082NO/rkZ1MXuoX:BLEhNKW03kM9Kp7TNWbDSy3sky+Ahtq4

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	4156	msiexec.exe
11	4156	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4804	Duplicati.GUI.TrayIcon.exe
2264	Duplicati.GUI.TrayIcon.exe

Loads dropped DLL 2 IoCs

pid	Process
2264	Duplicati.GUI.TrayIcon.exe
2264	Duplicati.GUI.TrayIcon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Duplicati 2\Duplicati.Library.Backend.AlternativeFTP.dll.config	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\external-link-hover_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\social\github.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\MegaApi\Homepage.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\oem\root\theme\oem.css	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\arrow_expand_blue.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\services\BackupList.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\backuprunning.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\backuprunning_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\run-script-example.bat	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\fonts\ClearSans-Medium-webfont.eot	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Library.Localization.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\oem\root\theme\oem.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\styles\smoothness\images\ui-icons_454545_256x240.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\directives\backupEditUri.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\OSX Icons\normal-running.png	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230205061656.pma	setup.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\progress-resume.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\over\resume.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\arrow_collapse_green_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.CommandLine.exe.config	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Server.Serialization.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\Json.NET\License.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\Tencentyun\licensedata.json	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\steps\line-out.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\SQLite\win64\System.Data.SQLite.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\add.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\styles\smoothness\images\animated-overlay.gif	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\less\font-awesome\font-awesome.less	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\ms-icon-144x144.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\robots.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Library.DynamicLoader.dll.config	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\logout_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\templates\backends\sia.html	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\styles\smoothness\images\ui-icons_888888_256x240.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\over\add_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\android-icon-192x192.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\arrow_expand_blue_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\resume.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\manifest.json	msiexec.exe
File created	C:\Program Files\Duplicati 2\SQLiteHelper.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\arrow_collapse_blue_2x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\arrow_collapse_blue_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\SVGIcons\light\context_menu_pause.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\duplicati-url.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\fonts\FontAwesome.otf	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\mainmenu\over\logout.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\android-icon-96x96.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\steps\line-out_3x.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\controllers\RestoreController.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\favicon\apple-icon-120x120.png	msiexec.exe
File created	C:\Program Files\Duplicati 2\Duplicati.Library.Backend.AzureBlob.dll.config	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\templates\export.html	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\mainmenu\over\home.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\AngularJS\Homepage.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\TlsTest\licensedata.json	msiexec.exe
File created	C:\Program Files\Duplicati 2\SQLite\win64\SQLite.Interop.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\win-x86\storj_uplink.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\img\_svg\treeicons.svg	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\scripts\controllers\AddWizardController.js	msiexec.exe
File created	C:\Program Files\Duplicati 2\webroot\ngax\fonts\fontawesome-webfont.woff2	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\MailKit\Homepage.txt	msiexec.exe
File created	C:\Program Files\Duplicati 2\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\Duplicati 2\licenses\HttpServer\licensedata.json	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e577a21.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D2A5D819-4FA0-493B-8D37-9531C659D95A}	msiexec.exe
File created	C:\Windows\Installer\{D2A5D819-4FA0-493B-8D37-9531C659D95A}\DuplicatiIcon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D2A5D819-4FA0-493B-8D37-9531C659D95A}\DuplicatiIcon.exe	msiexec.exe
File created	C:\Windows\Installer\e577a23.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e577a21.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8879.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000106161d2e731958f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000106161d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900106161d2000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000106161d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000106161d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiProgramMenuShortCutFeature = "DuplicatiCore"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\PackageCode = "93C29AF77613D1543B9E8B547802D254"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Version = "33554438"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5CB49C12FB23724D9F8C23BE087D061\918D5A2D0AF4B394D87359136C959DA5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\ProductIcon = "C:\\Windows\\Installer\\{D2A5D819-4FA0-493B-8D37-9531C659D95A}\\DuplicatiIcon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A5CB49C12FB23724D9F8C23BE087D061	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiStartupShortCutFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiCore	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\ProductName = "Duplicati 2"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\918D5A2D0AF4B394D87359136C959DA5\DuplicatiDesktopShortCutFeature = "DuplicatiCore"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\PackageName = "duplicati-2.0.6.3_beta_2021-06-17-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\918D5A2D0AF4B394D87359136C959DA5\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2600	msiexec.exe
2600	msiexec.exe
4688	msedge.exe
4688	msedge.exe
684	msedge.exe
684	msedge.exe
4340	identity_helper.exe
4340	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4156	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4156	msiexec.exe
Token: SeSecurityPrivilege	2600	msiexec.exe
Token: SeCreateTokenPrivilege	4156	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4156	msiexec.exe
Token: SeLockMemoryPrivilege	4156	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4156	msiexec.exe
Token: SeMachineAccountPrivilege	4156	msiexec.exe
Token: SeTcbPrivilege	4156	msiexec.exe
Token: SeSecurityPrivilege	4156	msiexec.exe
Token: SeTakeOwnershipPrivilege	4156	msiexec.exe
Token: SeLoadDriverPrivilege	4156	msiexec.exe
Token: SeSystemProfilePrivilege	4156	msiexec.exe
Token: SeSystemtimePrivilege	4156	msiexec.exe
Token: SeProfSingleProcessPrivilege	4156	msiexec.exe
Token: SeIncBasePriorityPrivilege	4156	msiexec.exe
Token: SeCreatePagefilePrivilege	4156	msiexec.exe
Token: SeCreatePermanentPrivilege	4156	msiexec.exe
Token: SeBackupPrivilege	4156	msiexec.exe
Token: SeRestorePrivilege	4156	msiexec.exe
Token: SeShutdownPrivilege	4156	msiexec.exe
Token: SeDebugPrivilege	4156	msiexec.exe
Token: SeAuditPrivilege	4156	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4156	msiexec.exe
Token: SeChangeNotifyPrivilege	4156	msiexec.exe
Token: SeRemoteShutdownPrivilege	4156	msiexec.exe
Token: SeUndockPrivilege	4156	msiexec.exe
Token: SeSyncAgentPrivilege	4156	msiexec.exe
Token: SeEnableDelegationPrivilege	4156	msiexec.exe
Token: SeManageVolumePrivilege	4156	msiexec.exe
Token: SeImpersonatePrivilege	4156	msiexec.exe
Token: SeCreateGlobalPrivilege	4156	msiexec.exe
Token: SeBackupPrivilege	3104	vssvc.exe
Token: SeRestorePrivilege	3104	vssvc.exe
Token: SeAuditPrivilege	3104	vssvc.exe
Token: SeBackupPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeBackupPrivilege	2276	srtasks.exe
Token: SeRestorePrivilege	2276	srtasks.exe
Token: SeSecurityPrivilege	2276	srtasks.exe
Token: SeTakeOwnershipPrivilege	2276	srtasks.exe
Token: SeBackupPrivilege	2276	srtasks.exe
Token: SeRestorePrivilege	2276	srtasks.exe
Token: SeSecurityPrivilege	2276	srtasks.exe
Token: SeTakeOwnershipPrivilege	2276	srtasks.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe
Token: SeTakeOwnershipPrivilege	2600	msiexec.exe
Token: SeRestorePrivilege	2600	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4156	msiexec.exe
4156	msiexec.exe
2264	Duplicati.GUI.TrayIcon.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2264	Duplicati.GUI.TrayIcon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2276	2600	msiexec.exe	95
PID 2600 wrote to memory of 2276	2600	msiexec.exe	95
PID 4156 wrote to memory of 4804	4156	msiexec.exe	98
PID 4156 wrote to memory of 4804	4156	msiexec.exe	98
PID 4804 wrote to memory of 2264	4804	Duplicati.GUI.TrayIcon.exe	99
PID 4804 wrote to memory of 2264	4804	Duplicati.GUI.TrayIcon.exe	99
PID 2264 wrote to memory of 684	2264	Duplicati.GUI.TrayIcon.exe	100
PID 2264 wrote to memory of 684	2264	Duplicati.GUI.TrayIcon.exe	100
PID 684 wrote to memory of 1884	684	msedge.exe	101
PID 684 wrote to memory of 1884	684	msedge.exe	101
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4696	684	msedge.exe	104
PID 684 wrote to memory of 4688	684	msedge.exe	105
PID 684 wrote to memory of 4688	684	msedge.exe	105
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106
PID 684 wrote to memory of 1964	684	msedge.exe	106

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\duplicati-2.0.6.3_beta_2021-06-17-x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe
  "C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe
    "C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:8200/index.html
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcf90046f8,0x7ffcf9004708,0x7ffcf9004718
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
        5⤵
        
        PID:1964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        5⤵
        
        PID:1464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
        5⤵
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4960 /prefetch:8
        5⤵
        
        PID:4880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5044 /prefetch:8
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
        5⤵
        
        PID:2716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
        5⤵
        
        PID:364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:4648
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff6d24d5460,0x7ff6d24d5470,0x7ff6d24d5480
        6⤵
        
        PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1472,10710758433447807312,3307262678610603213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4340

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2276

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Duplicati 2\CoCoL.dll

Filesize
156KB

MD5
a19cd90de674cf1225e4087b0245998b

SHA1
097b4029f291b8c5ff24928d1536592c90fdeced

SHA256
9f521cef31800523760faac4338ea0e18d325ae2eb60f904f68a9635381ff930

SHA512
4347da063300c533f4d11d66fb23feed5b45ec93d047d64e164b3a7aa7e64abf38b431b23b1e6a1bf039b983d747a253cb3d756fadc02626702c7799b9831abc

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe

Filesize
435KB

MD5
120b4702e78a8e0da42a6362bfaf84aa

SHA1
4bfe0883b97c13fbdb7110a3fb142cbfbdeb6a03

SHA256
864eb2ff9db3902a237f7be33017351305c1d8a134822f6c0a0f177abfaf442a

SHA512
1019c7b4c136cfd23c915fd7d732bd66db9903248addb96a68430ef53a0421479b9c792e5c35a68edd64868951da8d5b282270e37fb2e8cd9b2ae98857a2ff19

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe

Filesize
435KB

MD5
120b4702e78a8e0da42a6362bfaf84aa

SHA1
4bfe0883b97c13fbdb7110a3fb142cbfbdeb6a03

SHA256
864eb2ff9db3902a237f7be33017351305c1d8a134822f6c0a0f177abfaf442a

SHA512
1019c7b4c136cfd23c915fd7d732bd66db9903248addb96a68430ef53a0421479b9c792e5c35a68edd64868951da8d5b282270e37fb2e8cd9b2ae98857a2ff19

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe

Filesize
435KB

MD5
120b4702e78a8e0da42a6362bfaf84aa

SHA1
4bfe0883b97c13fbdb7110a3fb142cbfbdeb6a03

SHA256
864eb2ff9db3902a237f7be33017351305c1d8a134822f6c0a0f177abfaf442a

SHA512
1019c7b4c136cfd23c915fd7d732bd66db9903248addb96a68430ef53a0421479b9c792e5c35a68edd64868951da8d5b282270e37fb2e8cd9b2ae98857a2ff19

Download Submit
C:\Program Files\Duplicati 2\Duplicati.GUI.TrayIcon.exe.config

Filesize
2KB

MD5
02004bd9622fa6de0c811465de0d2cec

SHA1
45265f3303781c8109a67f7841094b0c9fabed9c

SHA256
9a5a032e345b3410c380daa7357a39199ce3397a47aee2683c084f2242065a53

SHA512
8e1f74f4949035c8d09d694e0186f7a544a93f01e87b5d1f6c63c046775b184bcdb495cc53998f1da26c8405ae2081c07bfa6f27b705305b7908d313cf6c5f22

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.AutoUpdater.exe

Filesize
59KB

MD5
dfe6d2707691eeb6f031d64e58dd3614

SHA1
226a380ba868ef9120ad5efffc11ad9faf273597

SHA256
ba12cb217484f0f4dcea8c98966200de7656293979b575c8c54520dd1d93335f

SHA512
41676ad7ff8cda030d49698d0ad86d045de6c09823be91cc9ec3e0a3dcf639e73ebc6dee0d77a4aee1bd30bf0ad77f2c4136c91b7256478a2acf0b3c94e45bff

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.IO.dll

Filesize
39KB

MD5
c35d8e46e34983d318f633317a434289

SHA1
357e24ab4aea137341555e3d8786e622966fb48e

SHA256
b5330c50dbda0ebeea3c2de62a80955030457a31b95028469a762d5648ce5c7b

SHA512
b6fd4e009aa3f15e1c0fc42f622991a6320c3eaefa61e8c5e44d5314c02dbd5fd2058e003bf1edfa82782ab86f6f434513077c02f408b969c83b42139158daee

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Interface.dll

Filesize
33KB

MD5
f71fe535098d9e3e079f12d73b3a2ca4

SHA1
e580788d21431dbf3212661efe026e472df97eb5

SHA256
d69cc4a05a1f96d142dd5dba4ec6f45be504fd0a7b9840f88ba09d9e37e45a64

SHA512
f16a5f00394cf0f3f121cd579c3123e001b34626c9fa396446d5919bad44a7e08a0fa35a796cae91b62b6821e4e539b2e39ccbf81a708b4686a38c5e4f8b16b5

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Localization.dll

Filesize
2.1MB

MD5
22643bfb0af4984f73c9e7f653889342

SHA1
8ff68b1b01ccab355e8d935aa26ece31caaa96e1

SHA256
da0682659cecec9f4fb2a0ed2daa7b21e6140cb677de08098ea006d090388aec

SHA512
f0d73eb1454629dff76c19c7601bf157d6f563678ae0f53605023cf967d387ea257a462ba8f81bd1729221bd133e62298e42cdcc65f33624b09737038a648392

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Logging.dll

Filesize
25KB

MD5
9c23e2e276cbd883671e25cbda65726d

SHA1
ba81cf7395aeaa8aabcdebb3327d858e57b9644a

SHA256
b48dc8199e74adffd89dc565a35b0d5eb22bd3677c7006e769c5ab48136ec4b5

SHA512
674500c623b624ca178d9b5096e9f82dc76834b4fcf1aaa418ea9eae1ad7b88ec6d4072ae7896dfd9fa0e5f8361f88cff31df580b9f1eb5bb4db93f777424399

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Main.dll

Filesize
895KB

MD5
11147106d569f21526b2212621c98595

SHA1
eae6269ba67f7acd353e4f2a462b02ef96cd3fa4

SHA256
d99c1004254febb2ea34204f940ab2fa4b2301e79f4d4e0e65c9dd5dc777a117

SHA512
b3554e149b11ff3d7dbfeff7c300591bfd5e710eb50e9b72bf4b5aef1256644cdc5ae40ce2dc46c088a13c31091a56929b141cbc1b25a278c808d201c13bd2df

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Modules.Builtin.dll

Filesize
105KB

MD5
3f69bcd4669706c60b32dbfa780efb7d

SHA1
4f1d1f56bd596e378fbe597b79e383aaa4054085

SHA256
5f5ee065c559327b4cb727188a01b346c57c6c7b5cbc261cda002dcaa64c64ad

SHA512
0f99604861fae7f7853cc1c7eb9643d71eccf4cd8a1e46ce6bc3c73000308a052d237c7ac02ce6a96b1385a47dfebdbe94b011e2b833822d5dfb639f0afd4955

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.OAuthHelper.dll

Filesize
46KB

MD5
250bf618d585572efd573c4919a61f5f

SHA1
cd4b53daf6018dc2c740acc111080ded885b414a

SHA256
66761efa3d1ff43731d0151950f0a0ba59c70c0752c14566dc59c767dfc22a83

SHA512
e45cda72692b33d77b12a825d83067a131882044945957e9a1e47ddd324ce46fce4ef1a8f2cc11c2a05e6ca6e101eabe1fd11c8f9a8a6e47cb2361e4df3396ce

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.UsageReporter.dll

Filesize
38KB

MD5
486af459e1040336cc40868969877ff4

SHA1
be67a2740ea1fd6dc2973e24139356067d580e1d

SHA256
7486158f4ebcccf7316703c6bac0cd8720ec02487828e3e73ba954a07077cfed

SHA512
731074667c2c63a037ed56753f6fe00053e09e6e5ba67dc89b2317fc6a94de300ad9e544b0455fa2c8e69c5b3e4f47e1a6be5b2a614b1772f681c562e3707704

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Library.Utility.dll

Filesize
129KB

MD5
ce21c5dd1ce33e83fc204083587021c5

SHA1
ba2ddd15b63a90c711736a13ae66a03fe02caf0e

SHA256
b504a8bd01192e3b3a0e114fd0268421ff30a4022d450411f8c187c0c94ccf99

SHA512
01210a5c43575be339d292a76aa1209816ccad5a65a22b39e917451292b00293612fb97a1661da49af79f8fb699126c5f8e45d5c16f60d7012d7fc3759874296

Download Submit
C:\Program Files\Duplicati 2\Duplicati.License.dll

Filesize
17KB

MD5
9b98d6f5b39dbd0f4da794cd36f45c98

SHA1
87a4847e18b48ed7dc6d9798dd359503656f9641

SHA256
bab1bdf92cae9024b1cb20174ee32314858389d980c81701c8cd8ff7d20f7ce2

SHA512
4d677db8b474bcff3424ff74d7cb0aa5ee77e255ed19d075666b4b215e06a5f22c0fb78bca47baaad1978049959f8eb240565a251fcb1720410a7caba2cb88c5

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Server.Serialization.dll

Filesize
29KB

MD5
1ced72a2ed16c237e32e60c87eaa8fbc

SHA1
a678b920f283d218d8929ffc78f2c0ee373ee10c

SHA256
e58240ab64c98747a13e2fa28c92a351ff359ccac5b440fa8da394a7eb637515

SHA512
68ab35cecccbfb2ff9a9fbbc436f08323b3967e5ed56aac3a2ee9c26718f8898ab05c5ed5d904ed2375e8bc812df7736352d081f0cdab0e92c572c8d2d03657f

Download Submit
C:\Program Files\Duplicati 2\Duplicati.Server.exe

Filesize
276KB

MD5
a4b6ced4afa1f28ab12239904fdd981b

SHA1
79625563b89ea084ade4e0c162f5b581487594f2

SHA256
75c048ea0e2f67ddc1da8d3c69f68d0e9ed1576c31937810c2849d1662390247

SHA512
db1f7cb1f2840b98cc8b2372d4638a71456b2d8bffae0772251e075a4ee19884b3089b58b222597c6c444d2f15fdf3f653500575d0051796c4fafcd992d9344e

Download Submit
C:\Program Files\Duplicati 2\HttpServer.dll

Filesize
128KB

MD5
317820d7bb5045a824684674bdd0eaea

SHA1
28b4d8862b351906483cd9e5ebe112a615043840

SHA256
81184f1aa5604f10db8c1b69eae9248011f44b869048bdd3d6f87b96fbf12667

SHA512
d18802750d5ad6c9ee10af306ffcb84033667e2e8c9b2a5e156883c178e03cb37b82b85e82cdba8a8011ceb5bd4dd8a4ca7b206f82c276c0a3c6c19333276db1

Download Submit
C:\Program Files\Duplicati 2\NGettext.dll

Filesize
39KB

MD5
c5b823764576bf0e26f936251331c7b8

SHA1
53e862ab979d92f24d5c2ef972365eae30f1b5c1

SHA256
bf4e06ef47575920cc31727470a8e75a54b42f2e0dc4bceba0adbe4c3900a23d

SHA512
b8e8f543f7875f257bcea41100dd498307080d63c5809e6f8329ed32ef0f437a383c2ca753066b23a43d5b2d4bebccf98b49b28c124c563ffc1a95aa2413d0f2

Download Submit
C:\Program Files\Duplicati 2\Newtonsoft.Json.dll

Filesize
659KB

MD5
4df6c8781e70c3a4912b5be796e6d337

SHA1
cbc510520fcd85dbc1c82b02e82040702aca9b79

SHA256
3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af

SHA512
964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c

Download Submit
C:\Program Files\Duplicati 2\SQLiteHelper.dll

Filesize
18KB

MD5
d29d1020dbe7dc71b99c794204a2d4ba

SHA1
31b490067ced5a44b297515e981fed5e626a0c51

SHA256
a4901edca392452b82d8bebd47ae21675a1d0dcb504524910471a8aea871e923

SHA512
0be39c3a54cb474dda226a3f6807bf353cffff4b90165ff95149cb769421697d82cedcdf792b41a1f7f3d03685e2b091a1f26d31ced4e4bc962bd96b2e9f4b4c

Download Submit
C:\Program Files\Duplicati 2\SQLite\win64\SQLite.Interop.dll

Filesize
1.4MB

MD5
4bdb3f840b80dae7ef1b07ef456846ea

SHA1
432cfe5dbe4499e8d6d603da0bc67de9b2726445

SHA256
c3eede99fa0048b96c313f3d89b57f5edb52ea91f73a0da0baf5178ccfe2eef6

SHA512
a7506cb18ee573fbde68d917aec8861d762afb1e6d3b4f3e4a5d72cbbf49518042e6d7c29425335012ef172642c022892576d5d08775b4704a22a7c0ff9d06d6

Download Submit
C:\Program Files\Duplicati 2\SQLite\win64\SQLite.Interop.dll

Filesize
1.4MB

MD5
4bdb3f840b80dae7ef1b07ef456846ea

SHA1
432cfe5dbe4499e8d6d603da0bc67de9b2726445

SHA256
c3eede99fa0048b96c313f3d89b57f5edb52ea91f73a0da0baf5178ccfe2eef6

SHA512
a7506cb18ee573fbde68d917aec8861d762afb1e6d3b4f3e4a5d72cbbf49518042e6d7c29425335012ef172642c022892576d5d08775b4704a22a7c0ff9d06d6

Download Submit
C:\Program Files\Duplicati 2\SQLite\win64\System.Data.SQLite.dll

Filesize
344KB

MD5
99dd5de4174bf7fd09ed3ae2c21fe8e2

SHA1
a237230ec3ac2c4e3211b7ffaec7e2272440e688

SHA256
a1fd117d427918d22dde8ffde74587f70adb80c2fc072bc5ebf9e4c9b69f2933

SHA512
bd3573da0678b9a248109d2aeeb2dab2ed8feed774593d23f59665b02fb37008a72abf9265dcdf27f42fb55d5445d90c0b0a319537e3821580d0e73f287dd4f7

Download Submit
C:\Program Files\Duplicati 2\System.Data.SQLite.dll

Filesize
344KB

MD5
99dd5de4174bf7fd09ed3ae2c21fe8e2

SHA1
a237230ec3ac2c4e3211b7ffaec7e2272440e688

SHA256
a1fd117d427918d22dde8ffde74587f70adb80c2fc072bc5ebf9e4c9b69f2933

SHA512
bd3573da0678b9a248109d2aeeb2dab2ed8feed774593d23f59665b02fb37008a72abf9265dcdf27f42fb55d5445d90c0b0a319537e3821580d0e73f287dd4f7

Download Submit
C:\Program Files\Duplicati 2\System.Data.SQLite.dll.config

Filesize
736B

MD5
8ab01db32f56322275cbd0864feb5d55

SHA1
cbdb70f5fc04485af0d09ef7484faa7f8b3047bb

SHA256
cde00e0a0f52ed121d52c17338da42ffd9656d4f81a76df2dceda05c88f783ef

SHA512
e52a5e341309bae40a4f69d67226a92dfc42b08d4e815da3a7df7295d68da6dcad8973d32af84f269692bd98634c4657e1394366574f5ec299eb50fa3d1db468

Download Submit
C:\Program Files\Duplicati 2\autoupdate.manifest

Filesize
218KB

MD5
885424d583c859ed85627d054080bcb7

SHA1
cd84ff359fe58373c7d86bc18fc6bf526a3cbff2

SHA256
cfd02f48b88d16a23994361f914c0ceb25b84775092dbd30f2220f1bca7a585c

SHA512
05233406ff6024cbe741b60f2f19092223da15489942d60f23b332c06990f034ef6c591a044f30460bfe8b9d524a0661fe07d02af0ddce4085ecc62951e0a095

Download Submit
C:\Program Files\Duplicati 2\webroot\customized\customized.css

Filesize
36B

MD5
6fd6d760b5a33a442c5a171022e4f7d9

SHA1
be7bd673c5b270bbe7f626b56371284e9ad9b9ba

SHA256
3b167971e15a01d5b8b16f0132ed9b36752d20b584067ad04ea4b840d0bae126

SHA512
5eaa5b95c5e5d2e81f678e407fd30b9eccea2d6b5c49cf1964634ca9026da5bb8222367c664a04bc66f8e80d0057993b23643e78c07a91ba74609cfe59b587a3

Download Submit
C:\Program Files\Duplicati 2\webroot\index.html

Filesize
1KB

MD5
7307eb11e64a0934df081051b7445c6f

SHA1
f1c77e3052b7a89dc6779242abd484d53f33993e

SHA256
7746454235cb3960d999038be82246efacdfb43ace790cf4cb8e22916e8f16e8

SHA512
ec7e92dd2877d3b53eb3180c1747ca7ff31135ae79629fa130fde7078a145949dde58218924d491d2aab1f38385c3da86c172e5efb87fd84379227511875a624

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\index.html

Filesize
21KB

MD5
6311412c8b609c93c19f00dc5607b039

SHA1
13f80f3ea0d9c0ebe6523974b6fceb01d0882f59

SHA256
7828db2c3c04f83f8836541e7e6ce1df81926a086e20a0961a3698b2bd24e40a

SHA512
1470d8eea8d0c9b5c1e71b7146a77318e28ff1898d461ac690a8cc4cc910b760720f6583e69c18a38b59abc384fe04b1daee409268a781fc98ca1168dbd94c0c

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-animate.min.js

Filesize
22KB

MD5
abf4748a7ef6bb5b610ecb5ab749afae

SHA1
d06789f4a6d2907b9ae799602745a1ece2aefa0f

SHA256
97653bef82db77a701f9d2a415900c36078901f4e14ee3b731f36ffeb5aa9850

SHA512
b6b3a30a884966e5d5b140dd2b8a9faa2947a80f7f6636af10df5069cce67115b69b295c06ab2a1da6d1410c314ff8e772141013a7daf257c40c87e4ef8e9948

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-cookies.min.js

Filesize
1KB

MD5
c7ea09ff0b341fb7c648d16a056ba395

SHA1
0574c478addb9303d0d313ca36bad7a8a6182d58

SHA256
14720e097c4454765a3d5b53071a519ede02de67859b464d58cc1e26076bedc2

SHA512
9bb8403ec9c9863e11d5319918c2d7238d8a17f43be4e39dd562a064a0256d5e603604f5c65e7c9548308059a25ec38cb0566088cbce5b8a8d60d405c6855ece

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-loader.min.js

Filesize
1KB

MD5
2ee3222394e5cec6bf151a02699d34b1

SHA1
2a8913f4a577d68a538a5540a56dc4c980bd3039

SHA256
cdba8badf4f1794a33f5ddb004e53d9ec03945939b6dc26316d8f85641454d89

SHA512
16e07c9a5696d1027d80886906e07af5bf6edee1325609b3c51e7b20b5ea1eff9c61a314213cf27704512bd6b6ef90544b61bc56ea5e468185f7b828c3825038

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-resource.min.js

Filesize
3KB

MD5
97796a250538882e4d26ddf37e05f208

SHA1
2b8ec6d42e87816cc3c0913ecbb67874a072bbe7

SHA256
71a58ac067d715151a49a0c1ee89aab221fc7d483c8745d7c644296fabe8d772

SHA512
76969c9bdb99396f4ae713d9d645aabfa593f056b3d2fcba9faec1ee63468eaf2b5b4ac65d3e015fd91b9511820aa2ac7e619f1bd90cf5a85b29577949aa3084

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-route.min.js

Filesize
4KB

MD5
ce6c7d9fab94072d82a126c27e259a80

SHA1
867e67f37bfd180eb64ba0881ebe1a28f0e5649b

SHA256
46b9a21e39611c0782d0d0746518082029df55a0aabd464cf291fd2d973a76e5

SHA512
9b7c379b9b573aef22942c034cd3fa4a7c46b765b3a929b01b4e344aa250adc042b3fdf62058292a303ed7cb9d71719bfec43c6d965d734f18ab7bb0bbde80c2

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-sanitize.min.js

Filesize
5KB

MD5
bacfe60d661bf26faa119cebc50c6518

SHA1
83b0f02d070149b4c3ae4643c9c656afb0acf433

SHA256
4713972b2c0b51aa082d103989f04db5614f162c070944e98f6bc3e94140062d

SHA512
b06ef0e21f47766d0ac34e1bb0623d96664a63c44d4341b0b048b1eef184f1abf17bd0fc0c508aaa7e3d10d317749923c9a7ebb8683771fce40774c8ab2d2f28

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular-touch.min.js

Filesize
3KB

MD5
5665d0692979a972c2e4f7523a56c814

SHA1
c68df316661475371fbf308e83c98b3ffd3d1ff9

SHA256
e7abe75520880fb7e29fc199b2de1ec25787ee57d09e7ff29ecd9bf8e46a885f

SHA512
6f7d87e8b01e96923855a45ee11cb990d6001ec6ab287985d9551f33f2df0fa098741a558c4bd7bd5cb8a51b7bb0178ba73893df40b9c6242194aa3227f7bab4

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\angular\angular.min.js

Filesize
141KB

MD5
d2342622316f832ef1333c74e41354ca

SHA1
74b2457fcdfd192423146de16f5450e96c789829

SHA256
9051fdcf3b95d87d41a74cafd3db94fb4484976c7da9c27b43ade4745b01905a

SHA512
1ea0b51b5c7af12f21727005e3cf14f5e2bd79e90c86881963f74ac767b96ad8b579b63062228bbcea2e210ea12c541b161f61595ac55992491aed4ce0b64493

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\cryptojs.js

Filesize
8KB

MD5
bf0b3194a3e3b3a299854e2f623ad883

SHA1
8a8d630020f978995cc3bcae09e4e5adc52b3a1e

SHA256
d58b77b8772a9dc5e1d005e07d48d261b527828aebaee8b67ab2c7cedc2b9ca5

SHA512
faa3b0138e91b648d03709d4003839e51f6eac66df4b43b64ac246f6eeba14f95b7eaa58231f939562089b0479bfdcf47bad3951eeb6c7c855fdd1ca0a870302

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\jquery-ui.min.js

Filesize
222KB

MD5
a260a5162201f288adf08ae3d2ba9f89

SHA1
fb471217c99800ef719810adb07f0b0129b952b2

SHA256
5aa962ebf4317e3d2f52cc1fec293eb52f8532f3b48455dbce096c024f9ba4e6

SHA512
a513d1aa0307fb7f6cd483f8b995da25db9f3ac028ed770c1c12503c9d80a4ee2c734e5906f3d7564e10c63005bf679acc32dc2a609a4307f97a66eb34662cf8

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\jquery.min.js

Filesize
82KB

MD5
f9c7afd05729f10f55b689f36bb20172

SHA1
43dc554608df885a59ddeece1598c6ace434d747

SHA256
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

SHA512
3dcae1ff6e98c64e3586be3eb14dd486c51f7d4e9fa1b8f9a628be4fbb6a9ab562f31f9b50e16d2e0c72b942bdbe84eee8e0ef87fa730db1428b199a59d88232

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\modal.min.js

Filesize
1KB

MD5
51732e8cc87cd36c73b8396aa48b888e

SHA1
2724ef34149cf227c526f1ed307d8006417f26e3

SHA256
f37dcb498fa35be1fa0e77e7ab304f4743cc9e901c91a03baa55eb71e5fc7800

SHA512
8348db131905808c139a22b7ab125e493acd25671de552d5ba3930379d0e6cb9920f2f1ce7a65b993c567387ea60b3e288f6d62eb03ebd4fc22dd413bdc175de

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\oldbrowsersupport.js

Filesize
589B

MD5
4f690dded7c1b5d07c031c7c37e798e0

SHA1
be1c21e36d57ebc4b7f75f752cc5faf5364e546c

SHA256
f491051a83a4ca236aa860609e6b181e7f4dc7587e9eee8d5669ea231d61a7e0

SHA512
2178d7a0e3c642f390bcb518fabf7936945b1a637113d3653a99e436b9187d811b0dfb4d0f11b609b1ea855d817b038e52fffc0619866f3bc5e0f5140a918bfe

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\scripts\libs\zxcvbn.js

Filesize
682KB

MD5
928efd602a8f30dd54f0ea49d7127b48

SHA1
c5546fadaa5f18b53567a79d90a8d1355010bbf0

SHA256
bd611d1c72af496613b44b0e25d20317b53e28a29aa5103eab4858a643cc76cd

SHA512
ec3bb888080a5f8f5c831e53ba0807bf3758c91cf21e447eece4156ee6e77d98f61b84b7fe8593aacd378fafcc5932e73aef4a268bdba1a6ce4a09e087b69fd5

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\styles\smoothness\jquery-ui.min.css

Filesize
26KB

MD5
9c6afa27e09fb6eefd70e20a7c9de40a

SHA1
417d5a7d09fe8ca4f3968f4f3bdc3ad1746eecb0

SHA256
cd5b14ec78ed6b53db0fdda9db112f19b0a45f18ceb9bfdc3f5573c2ac0dbe65

SHA512
d67f5be995e43bad7ffecaf6c45338da12e80dddf3d34fbec81d63f03cf780a24bbc29eb0a1c8dc94b25e41902ee09ae56765e19b933b811b2434f4424532647

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\styles\style.css

Filesize
98KB

MD5
6e9a87c4f84d2e968382439591a5f6a8

SHA1
9a146517c36dfa446704a9b1dfc4444ec4f2551b

SHA256
d69800a8ee70b4a3c36cd9b02adf64066d5edf1342942ff57117e56e0ef5ae92

SHA512
6012a787dd527e0874574a1f212013aea5f4b081ca280065be8566a74ae2b3aaabeeb7e4e325ae61d38f911821d11b373ca3fda20146c666ed23cc41f4f359b7

Download Submit
C:\Program Files\Duplicati 2\webroot\ngax\styles\themes.css

Filesize
1KB

MD5
8ce48fa084b1328bdf10fe86ccbfb663

SHA1
3f4d81521226a56b3649ad8dd07a26d0ce95e71a

SHA256
54a04e6459a86f1cca3db6e1420052f4feb07799fc3eb41aa311df79be76cfc8

SHA512
a059cbbbd086fb360623b464ef05088e0f4f79695c611385240fea00f0078a63e2d243e354c3523af90b6c116599b091cd101f2791b2bf7b144544f1a7e3656e

Download Submit
C:\Program Files\Duplicati 2\webroot\oem\ngax\styles\oem.css

Filesize
35B

MD5
07a08fad32be2d0a627ef43d59e115ca

SHA1
d615f23478d584af9fd22190ee030708b01189ea

SHA256
9bfafbf75f591b4fdfd9a900058ed1beae3e9d669b1d81be469b86b9eaa57721

SHA512
92950c66859caaaac30d43d1b62b06f8fe1428a6b85ce3d509e72707a2d674f3cbd2bdf705abcb991737df61de4c6cbae150bd528046e5a38a8ab1d36ef648f2

Download Submit
C:\Program Files\Duplicati 2\webroot\oem\root\index\oem.css

Filesize
35B

MD5
07a08fad32be2d0a627ef43d59e115ca

SHA1
d615f23478d584af9fd22190ee030708b01189ea

SHA256
9bfafbf75f591b4fdfd9a900058ed1beae3e9d669b1d81be469b86b9eaa57721

SHA512
92950c66859caaaac30d43d1b62b06f8fe1428a6b85ce3d509e72707a2d674f3cbd2bdf705abcb991737df61de4c6cbae150bd528046e5a38a8ab1d36ef648f2

Download Submit
C:\Program Files\Duplicati 2\webroot\oem\root\index\oem.js

Filesize
35B

MD5
07a08fad32be2d0a627ef43d59e115ca

SHA1
d615f23478d584af9fd22190ee030708b01189ea

SHA256
9bfafbf75f591b4fdfd9a900058ed1beae3e9d669b1d81be469b86b9eaa57721

SHA512
92950c66859caaaac30d43d1b62b06f8fe1428a6b85ce3d509e72707a2d674f3cbd2bdf705abcb991737df61de4c6cbae150bd528046e5a38a8ab1d36ef648f2

Download Submit
C:\Program Files\Duplicati 2\x64\SQLite.Interop.dll

Filesize
1.5MB

MD5
a0d07d0e354c7760497ef7ea6227b937

SHA1
10cfc3ff37b8b492a2130d1cda2ccfa8788a9650

SHA256
f39fc4d52b3e9e1a8d30fb8e2ffd320c1b54a5d5c5ad2444e57f0b3642cdc05e

SHA512
908c234cb616edc87a76d9153a6da8f2a1013c477602ec2068dc598592cd1355569f42989b1f4b29ab43f9dde3912dbfd9bfb01eaedbf6960277d629f75e24eb

Download Submit
C:\Program Files\Duplicati 2\x64\SQLite.Interop.dll

Filesize
1.5MB

MD5
a0d07d0e354c7760497ef7ea6227b937

SHA1
10cfc3ff37b8b492a2130d1cda2ccfa8788a9650

SHA256
f39fc4d52b3e9e1a8d30fb8e2ffd320c1b54a5d5c5ad2444e57f0b3642cdc05e

SHA512
908c234cb616edc87a76d9153a6da8f2a1013c477602ec2068dc598592cd1355569f42989b1f4b29ab43f9dde3912dbfd9bfb01eaedbf6960277d629f75e24eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
1373b57a94fac3d77b9d2c6289ed2cca

SHA1
b1c5e5cc9fb8ba841ea54b479b13adabb74ca52e

SHA256
8b08dfe356c4f5991477ab12818a8e5236834db01c96cb10ee1398e1763c5ed4

SHA512
2844d21f4fd6bdcd7ed94bc844e5964affaffe926e8058f60b1449d718f68734dd1f854b216954e8a3d1d354accab4ad5a9f004437b062f2669431187625149c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_E1CFD161EF41EAA54F3E842C74412CE8

Filesize
471B

MD5
119e4194888f160773bfe79e9b99836f

SHA1
c19e07304782f6ec26a6721792adbca9d76c4f0f

SHA256
8a9ba027800fb61a49bfe78e21cc66cda9ffc165fd6fa2bd0aee4f7b3ca3bb44

SHA512
2a56498796453a48bf1adf7bf5e71e3799c04bd29a990ed64fcefd426a85e36f115eb03bc78603cb157d3a467b6c38ca6d74f1156ca882da11468481f11d34ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
a4f78dfe0fdaae329df7d646c7ddf922

SHA1
ad0012755e084dcde60824262c65f7019168e174

SHA256
be3ef52578f33518cd4c9753b3e627884f02b335f6a8ea4dbcb7292775316466

SHA512
39b1212004df7e9a48cb9406e5b990046e4eb5447cc09a6ba680e969f5a070810746b98bf477a7a3d41353b145957fac544ee27ed3d8e3193e53606b4f3e6604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_E1CFD161EF41EAA54F3E842C74412CE8

Filesize
400B

MD5
f8d0f057affa3fdc083ef975a288cc5a

SHA1
82bb0eac2d65a4d70f6cb46397dee4d22f879aeb

SHA256
6f0088861f678c9fbad207fc454237fd5226bdae988673f40b94b937bbc38228

SHA512
e6e76d1d15057ca0c53a7d2706188aca1410aa2216e2ae207a6807ae302ffe90b6fb5c15976cd4be83224950fa9ed7c562b8e6db4ce32eda74b7f6d4dac35e90

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
e233defd1258ebebfbf46b0d9b4d2608

SHA1
4be012feb60b9e58e245e90390ee1dcfda22b3b3

SHA256
8de902330e88c37f970ea196b57d4553e4c2b9d23a596d4de988718cab530539

SHA512
dbd676289d6d447abb247a38591e0c0806e2bade0e6da7718f65d48450defa8ce96377e49be1df7f4a30ccd9228456ba2cee539e7ed4ab8dc8af9f06ee296de9

Download Submit
\??\Volume{d2616110-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8970e9c8-dd98-4e91-b38e-887807c92553}_OnDiskSnapshotProp

Filesize
5KB

MD5
de61975bf12cb169cacdaecb1fc4be71

SHA1
8db791db71c12f58020d7a516076317bb1710252

SHA256
10ba1965932ce3d70ac88ed66be1246eaa668666394552ca1ac2a68a762b02fc

SHA512
2f80fccbde278a2fdaf433c6e509b77af476acadba69fc7497c4619c09926a560dd262a3f945e69794048b03f1f71beadcf6a02ce2906a9e68a76b5054470bf2

Download Submit
memory/2264-166-0x0000026B54B00000-0x0000026B54B0C000-memory.dmp

Filesize
48KB

Download
memory/2264-242-0x00007FFCF81E0000-0x00007FFCF8CA1000-memory.dmp

Filesize
10.8MB

Download
memory/2264-271-0x0000026B74420000-0x0000026B74428000-memory.dmp

Filesize
32KB

Download
memory/2264-270-0x0000026B74410000-0x0000026B7441C000-memory.dmp

Filesize
48KB

Download
memory/2264-192-0x0000026B6F690000-0x0000026B6F6AE000-memory.dmp

Filesize
120KB

Download
memory/2264-194-0x0000026B6F550000-0x0000026B6F560000-memory.dmp

Filesize
64KB

Download
memory/2264-190-0x0000026B705C0000-0x0000026B706A4000-memory.dmp

Filesize
912KB

Download
memory/2264-189-0x0000026B6F630000-0x0000026B6F656000-memory.dmp

Filesize
152KB

Download
memory/2264-186-0x0000026B6F570000-0x0000026B6F59E000-memory.dmp

Filesize
184KB

Download
memory/2264-269-0x0000026B744A0000-0x0000026B74528000-memory.dmp

Filesize
544KB

Download
memory/2264-184-0x0000026B6E900000-0x0000026B6E93A000-memory.dmp

Filesize
232KB

Download
memory/2264-179-0x0000026B6F480000-0x0000026B6F4DC000-memory.dmp

Filesize
368KB

Download
memory/2264-175-0x00007FFCF81E0000-0x00007FFCF8CA1000-memory.dmp

Filesize
10.8MB

Download
memory/2264-174-0x0000026B6E8B0000-0x0000026B6E8C0000-memory.dmp

Filesize
64KB

Download
memory/2264-172-0x0000026B6F6B0000-0x0000026B6F8D4000-memory.dmp

Filesize
2.1MB

Download
memory/2264-268-0x0000026B74400000-0x0000026B7440C000-memory.dmp

Filesize
48KB

Download
memory/2264-170-0x0000026B54AF0000-0x0000026B54AFC000-memory.dmp

Filesize
48KB

Download
memory/2264-168-0x0000026B54B70000-0x0000026B54B7E000-memory.dmp

Filesize
56KB

Download
memory/2264-267-0x0000026B743F0000-0x0000026B743FC000-memory.dmp

Filesize
48KB

Download
memory/2264-164-0x0000026B54B60000-0x0000026B54B6A000-memory.dmp

Filesize
40KB

Download
memory/2264-162-0x0000026B54AE0000-0x0000026B54AEC000-memory.dmp

Filesize
48KB

Download
memory/2264-266-0x0000026B743E0000-0x0000026B743EA000-memory.dmp

Filesize
40KB

Download
memory/2264-265-0x0000026B743D0000-0x0000026B743DC000-memory.dmp

Filesize
48KB

Download
memory/2264-264-0x0000026B743A0000-0x0000026B743AA000-memory.dmp

Filesize
40KB

Download
memory/2264-262-0x0000026B742D0000-0x0000026B742DA000-memory.dmp

Filesize
40KB

Download
memory/2264-263-0x0000026B74390000-0x0000026B7439E000-memory.dmp

Filesize
56KB

Download
memory/2264-260-0x0000026B743B0000-0x0000026B743C2000-memory.dmp

Filesize
72KB

Download
memory/2264-261-0x0000026B74270000-0x0000026B7427E000-memory.dmp

Filesize
56KB

Download
memory/2264-233-0x0000026B715C0000-0x0000026B715CA000-memory.dmp

Filesize
40KB

Download
memory/2264-234-0x0000026B72B70000-0x0000026B72BF4000-memory.dmp

Filesize
528KB

Download
memory/2264-235-0x0000026B72C00000-0x0000026B72C60000-memory.dmp

Filesize
384KB

Download
memory/2264-236-0x0000026B72B00000-0x0000026B72B16000-memory.dmp

Filesize
88KB

Download
memory/2264-237-0x0000026B72D50000-0x0000026B72E36000-memory.dmp

Filesize
920KB

Download
memory/2264-238-0x0000026B72CD0000-0x0000026B72D3C000-memory.dmp

Filesize
432KB

Download
memory/2264-239-0x0000026B742E0000-0x0000026B74382000-memory.dmp

Filesize
648KB

Download
memory/2264-240-0x0000026B74600000-0x0000026B7486E000-memory.dmp

Filesize
2.4MB

Download
memory/2264-259-0x0000026B74240000-0x0000026B7424A000-memory.dmp

Filesize
40KB

Download
memory/2264-241-0x0000026B72C60000-0x0000026B72C92000-memory.dmp

Filesize
200KB

Download
memory/2264-243-0x0000026B72B20000-0x0000026B72B3A000-memory.dmp

Filesize
104KB

Download
memory/2264-244-0x0000026B72AE0000-0x0000026B72AEC000-memory.dmp

Filesize
48KB

Download
memory/2264-247-0x0000026B72B40000-0x0000026B72B4E000-memory.dmp

Filesize
56KB

Download
memory/2264-246-0x0000026B72AF0000-0x0000026B72AFA000-memory.dmp

Filesize
40KB

Download
memory/2264-249-0x0000026B72B60000-0x0000026B72B6C000-memory.dmp

Filesize
48KB

Download
memory/2264-248-0x0000026B72B50000-0x0000026B72B5C000-memory.dmp

Filesize
48KB

Download
memory/2264-245-0x0000026B74280000-0x0000026B742C6000-memory.dmp

Filesize
280KB

Download
memory/2264-250-0x0000026B72CA0000-0x0000026B72CAC000-memory.dmp

Filesize
48KB

Download
memory/2264-251-0x0000026B72CB0000-0x0000026B72CBC000-memory.dmp

Filesize
48KB

Download
memory/2264-252-0x0000026B72CC0000-0x0000026B72CCC000-memory.dmp

Filesize
48KB

Download
memory/2264-253-0x0000026B72D40000-0x0000026B72D50000-memory.dmp

Filesize
64KB

Download
memory/2264-255-0x0000026B72E50000-0x0000026B72E5C000-memory.dmp

Filesize
48KB

Download
memory/2264-254-0x0000026B72E40000-0x0000026B72E48000-memory.dmp

Filesize
32KB

Download
memory/2264-256-0x0000026B72E60000-0x0000026B72E6A000-memory.dmp

Filesize
40KB

Download
memory/2264-257-0x0000026B74250000-0x0000026B74266000-memory.dmp

Filesize
88KB

Download
memory/2264-258-0x0000026B74230000-0x0000026B7423E000-memory.dmp

Filesize
56KB

Download
memory/4804-160-0x00007FFCF81E0000-0x00007FFCF8CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4804-157-0x00000215AC190000-0x00000215AC1B2000-memory.dmp

Filesize
136KB

Download
memory/4804-213-0x00007FFCF81E0000-0x00007FFCF8CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4804-155-0x00000215AC260000-0x00000215AC30A000-memory.dmp

Filesize
680KB

Download
memory/4804-153-0x0000021590AE0000-0x0000021590AEE000-memory.dmp

Filesize
56KB

Download
memory/4804-145-0x00000215AC110000-0x00000215AC158000-memory.dmp

Filesize
288KB

Download
memory/4804-151-0x0000021590AA0000-0x0000021590AA8000-memory.dmp

Filesize
32KB

Download
memory/4804-143-0x0000021590710000-0x0000021590780000-memory.dmp

Filesize
448KB

Download
memory/4804-149-0x0000021592410000-0x0000021592434000-memory.dmp

Filesize
144KB

Download
memory/4804-147-0x0000021590AB0000-0x0000021590AC2000-memory.dmp

Filesize
72KB

Download