floxif | 39f4d1f755842c8b225fad2c850b538a0c6f7deb60c7df1981f039f9c3b288d3

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5af542de0c669234e4156cf32a1eab90N.exe
Size 1.1MB
Sample240907-e8meqavhkg
SHA256 39f4d1f755842c8b225fad2c850b538a0c6f7deb60c7df1981f039f9c3b288d3
MD5 5af542de0c669234e4156cf32a1eab90
SHA1 8ccaaee255a771d943ccba23b8e902cfde787d3f
SHA512 ec0df18550bffbdd6c5151a6241bf93c225d87596e6037faaeebe3ccfbc0bf9f66d65fb22484e6eb525d0e24e4539b8232b6890b879f20094c984dc2b1b193ea
SSDEEP 24576:U53uhCmKskuEyZfGWvoSPKOYEQm2/TlhUpXY2QCrEH7q:U5+hCuhjsSPHvr2/CIc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

floxif backdoor discovery persistence privilege_escalation trojan upx

Malware Config

Signatures

Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x00080000000234f9-1.dat	floxif

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00080000000234f9-1.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	5af542de0c669234e4156cf32a1eab90N.exe

Executes dropped EXE 3 IoCs

pid	Process
3292	Display Driver Uninstaller.exe
5000	Display Driver Uninstaller.exe
4748	Display Driver Uninstaller.exe

Loads dropped DLL 1 IoCs

pid	Process
4108	5af542de0c669234e4156cf32a1eab90N.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000234f9-1.dat	upx
behavioral2/memory/4108-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4108-233-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	5af542de0c669234e4156cf32a1eab90N.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem0.PNF	Display Driver Uninstaller.exe
File created	C:\Windows\inf\oem1.PNF	Display Driver Uninstaller.exe
File created	C:\Windows\inf\oem2.PNF	Display Driver Uninstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5af542de0c669234e4156cf32a1eab90N.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4368	msedge.exe
4368	msedge.exe
1908	identity_helper.exe
1908	identity_helper.exe
3292	Display Driver Uninstaller.exe
3292	Display Driver Uninstaller.exe
3292	Display Driver Uninstaller.exe
3292	Display Driver Uninstaller.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	5af542de0c669234e4156cf32a1eab90N.exe
Token: SeDebugPrivilege	3292	Display Driver Uninstaller.exe
Token: SeSecurityPrivilege	3292	Display Driver Uninstaller.exe
Token: SeBackupPrivilege	3292	Display Driver Uninstaller.exe
Token: SeRestorePrivilege	3292	Display Driver Uninstaller.exe
Token: SeTakeOwnershipPrivilege	3292	Display Driver Uninstaller.exe
Token: SeTcbPrivilege	3292	Display Driver Uninstaller.exe
Token: SeCreateTokenPrivilege	3292	Display Driver Uninstaller.exe
Token: SeLoadDriverPrivilege	3292	Display Driver Uninstaller.exe
Token: SeDebugPrivilege	3292	Display Driver Uninstaller.exe
Token: SeSecurityPrivilege	3292	Display Driver Uninstaller.exe
Token: SeBackupPrivilege	3292	Display Driver Uninstaller.exe
Token: SeRestorePrivilege	3292	Display Driver Uninstaller.exe
Token: SeTakeOwnershipPrivilege	3292	Display Driver Uninstaller.exe
Token: SeTcbPrivilege	3292	Display Driver Uninstaller.exe
Token: SeCreateTokenPrivilege	3292	Display Driver Uninstaller.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 3292	4108	5af542de0c669234e4156cf32a1eab90N.exe	88
PID 4108 wrote to memory of 3292	4108	5af542de0c669234e4156cf32a1eab90N.exe	88
PID 3292 wrote to memory of 5000	3292	Display Driver Uninstaller.exe	89
PID 3292 wrote to memory of 5000	3292	Display Driver Uninstaller.exe	89
PID 5000 wrote to memory of 4368	5000	Display Driver Uninstaller.exe	90
PID 5000 wrote to memory of 4368	5000	Display Driver Uninstaller.exe	90
PID 4368 wrote to memory of 3436	4368	msedge.exe	91
PID 4368 wrote to memory of 3436	4368	msedge.exe	91
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4476	4368	msedge.exe	92
PID 4368 wrote to memory of 4440	4368	msedge.exe	93
PID 4368 wrote to memory of 4440	4368	msedge.exe	93
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94
PID 4368 wrote to memory of 4524	4368	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\5af542de0c669234e4156cf32a1eab90N.exe
"C:\Users\Admin\AppData\Local\Temp\5af542de0c669234e4156cf32a1eab90N.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Display Driver Uninstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Display Driver Uninstaller.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Display Driver Uninstaller.exe
    -visitdduhome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.wagnardsoft.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe510746f8,0x7ffe51074708,0x7ffe51074718
        5⤵
        
        PID:3436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        5⤵
        
        PID:4476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:3440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:4920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
        5⤵
        
        PID:668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
        5⤵
        
        PID:4304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
        5⤵
        
        PID:4744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
        5⤵
        
        PID:1448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
        5⤵
        
        PID:384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4938668033518541828,11070326248316061636,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
        5⤵
        
        PID:696
- - C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Display Driver Uninstaller.exe
    -visitdduhome
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.wagnardsoft.com/
      4⤵
      PID:3364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe510746f8,0x7ffe51074708,0x7ffe51074718
        5⤵
        
        PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Display Driver Uninstaller.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Display Driver Uninstaller.exe.log
Size 1KB
SHA256 a0a22d6dea23118f09d5e58247382fabdebd3e59dc7cba017ab8e34573087fd3
MD5 d57389d5847fb7de1a083caf5f321896
SHA1 6e24d7c33655d35bae42f234bbc7ca215f66a684
SHA512 f307b84aab660a0b29b1689cf1cf7f1cbf76b98d4296159210fd696c516b4a8a532a44bd8e58deac1db6232ad9d2e819567cd8213db1b2c0901d5c513fde6f4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 24KB
SHA256 d641163f7f2bdad75f0f2c128dca1ba77eda0f9266809da2a18bd49dbd54a617
MD5 8b575ebb5796c421938e04c8367b7aa6
SHA1 c7e861fa4d8104515a9479d875eb1f8923ed3af1
SHA512 b0da2c8148bc46fccd1e73e51868d20f093e98ca82e5b14a9779f1c17b63a23f7b926859f3dd33c0b538a84778fd92d70d46ae834f125829dd0d6e3610529620
SSDEEP 768:Ggv/+OxFFWxIdMJVUt3SmxvSoJml4me6Y+AoLJLx:GU/LFFWKWJVUtd9UGD6Y+1Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Size 66KB
SHA256 6c5b4f857ecb42d1a1bc5b4fdb78514ada088eb992f582125bda2613f9205c55
MD5 fa3057ba418a2f9402c0b5b76366ec00
SHA1 bfbeb4c4511505ea82d61afe318e19e992a845bc
SHA512 0fbbd31a2f7c0007b6cb44056b51105575a2a86421ffbec181cf75dd972163877e88259951686ff8d001fbbc0e4ad84ec130c4296ebbaf306889afd931efee98
SSDEEP 1536:xnbpA+TAGwTFJfvYlYK4ZZzx6RVyCa2JSZEQ/6UZU+6TvmZ5voEhm:FbFTAbJ4lYfHzKPFSGQ/6UZUgGEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 a4225bf384d654181addef1280ee520122219807ce574d6230d9906030befcb2
MD5 3a8f4273053b962d3f7407f3dd2dc41a
SHA1 4a7c6364460ad46fcc0caac710a96c6d0d836385
SHA512 f08d07c08bb22426ad6e0765c56dffc7bce5cda28a72ce8ba5305bb1a5b767bc3f7bf5ff99b0ddd7103341e7febd7461f06ef903fb82a52793468ff178d0dd94
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4012c41281057d2694bf0eee1ccc7e2083a94e5e41d0547f2da2ac82a2fa35ce
MD5 824bc298f4e209e850994c67505a5223
SHA1 732d746008e94189c920d5f9c4e775deadb081b8
SHA512 14cf4538dbe48fa000960fc922998129eb280df3f14b0a98a98ecfee622f64e8b5ecffc2e8c566394c4bcf858b8a65a540d64e53f3fc2dec27dc1c1f08afd22c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c5be9bef483e6955dae820eadd248bb052a572cbf5614003e9ff28641b5f625a
MD5 80fb6fecfe9f36722137adb58fe98d9a
SHA1 f5c45321d9559c83350ced68d3f85287195ee956
SHA512 420a64e3e06b7f1d22aa42f0f39e59eb7085e851c905319c831f8f4de19a26577bf21c01c872da7be570f160a2346a21dac6efbecbc3219d154aa9e87c527ba4
SSDEEP 96:nNkXbF1z0AwpvWMoiVmde/Y2Mk+LVW2m5hPeUWQyV+VD7AiEwb:nNkXxt0AGWMPY2aLVW2iPerg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6412ef04bcccd196c1566b549e00bf4e949bec9474432d0354cbc7caad1c9cc6
MD5 0fdbb39712603f4c42364fb748416c35
SHA1 c5ddf4a651434dfb686241f49fb58e4700430df9
SHA512 82534014f1f00b7c5c53def927cc044fac1efb7ec5967b70ac7a4694598102c0c8a65996e389a7320b1afb064e136d93165e8e98bc8471b26193ceaeb4d180fd
SSDEEP 96:nNkXXF1z0BwpvWMoiVmdeHm9hPtUWQyV+VD7ziEwb:nNkX1t0BGWMXYPtrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 03597330f03c7c5c419dd426e4012971d22b49c784e87c4f6eee23ce966c614c
MD5 6e506a551f1fdcb63df36379bd39df88
SHA1 c1abe2134c6be4e339afeb27cc329504cd61d4ba
SHA512 cfd0aa089e5a23ad10f5f045dd17e1ecd5fd15b7eb6a9b1ce0300e00179c21e78df2f10c8c693b5490a3fd53d73d9fc009b69c9ce488e7e8f7c8bf8813a28c60
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUISSYOVLQOl6feAOv1:A9iIxuERzA83h09RZxYs7JVSw1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Display Driver Uninstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Display Driver Uninstaller.exe
Size 1.1MB
SHA256 6e7a2fc5e3fdf2f09094634609eafbaad9d1397eed54dbd763e421272fcd077e
MD5 1053124bbc5ec55535bf36ae12de3acc
SHA1 c01f4707f64db0aec38557ee751508249a55e451
SHA512 589743811366fa321cbb24b8f53e9dd71206c88cc126aeaa54c12b3213079a0ec5cbf44e740c3547b571dc7d17af93ed01fd148d57729765878c1ed71ebc330d
SSDEEP 24576:9lgql/Nf7sn+ymKR1uN9k8FFbQDtvm3gbBvel:9lBsnzmKynk8z4BW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Arabic.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Arabic.xml
Size 23KB
SHA256 3b9536b34720652a2fbb3103eb5176a04422e053af6e37915ce1d0620e02e644
MD5 a609fd1decf2716812ea274c098551cd
SHA1 41fc20a647cd8e6b60dc20a872c0141f10c34834
SHA512 a1e6b85bd965f53f8ecce4e5fefd6035849f81c6f2764265bfb33f91f167d090e85edf1c9660185f236f7b363b0400e2c5c0cc38b690f858be1d6a245ee8ef48
SSDEEP 384:ypPsL9ddbU8Kz/BQpyTmPBifac6oAEru+suZJMuDX+k2vVYzKY2cmnOeOUMuWCX5:yKL0j6FukuDXMY2riMXB5cZjgd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bulgarian.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Bulgarian.xml
Size 26KB
SHA256 516bd8030ef13f694dfead395c7a1b103bdf0f6a40fd9d1552165bf94a656f02
MD5 5ca9e8a92efe8049fbb375ca04541dd7
SHA1 a7c6bbd2ed8e5a4190073317bcfa73646086a2c8
SHA512 b48e21a416ceeac4843efc2e2b12096321c831abef1137551bc5b5257305fe595a8215944663ab48229d66476e506295d70e4647d14e53bd2bc7f34e289a1d25
SSDEEP 384:y7Sm5qmjm8umureO1z0p8Yj2C/mCmJuTaJLzV+cqLii0cSvd:y7V5tKeaRXLCyLzxi6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chinese (Simplified).xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Chinese (Simplified).xml
Size 17KB
SHA256 ce1890b06ebda86b9289b6a967cc4fe85f4ec207c101ec9fb8fa68e3569ab3ce
MD5 4079269c80a37096e68cbad2596d013c
SHA1 81ec475810cc3cfc68d3b76f2bc4a19d57d23b13
SHA512 f2b50e15bbe57bd14b6e0d0ac96a43c384f96c5fdd5f596c4fe453161c2815c80b216d73464f3f8f6a6f8304242b7e5e174d78695a8f7a5d03452ec342b55924
SSDEEP 192:dVUrWCS2lBY37COGMZyy1JwlBiSu3LVJvD+/DoXC6QtvYJNwqTN5rOIQwc2feQfI:dcP5nlsxPC/M5aIP4BFd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chinese (Traditional).xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Chinese (Traditional).xml
Size 16KB
SHA256 c96124b124dbb1dc4f169775df93d3930f03e00ad4abee5395896650f612439d
MD5 9ca5886a864378ea2e67187ce1dd3af6
SHA1 89040df4a6c15d4274840b2c261fa52c541a742d
SHA512 688dbbc813cbfda1a2f580664faef8eeda618cfaf65557650dcf742b4006b9700b9e6eed491a53e855163e80bee79352796264a13f09125ff0ecdcc4318bb03b
SSDEEP 384:9LybrFtGt73KElFNME83VZRXWzrFOIhdUjuPRg:9LybrFtG35FCE83BWzYnjuPRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Czech.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Czech.xml
Size 17KB
SHA256 b26320f7e4e328359990f1b7d9a3aa52d80f40a14d6ff5670960ad49a5ea9e1c
MD5 c87468bbaeb0a8bc5ce8b7248e9b7e56
SHA1 a7e117db45f4e8f34657d83da958c86b848e830b
SHA512 3bb838f93d6fc6a4e67fb436f7cf522e2722867c6d8ce398b5447dc2509acdda8f8241234b98a1129bce7f8f68ee57a7c57f92ee693b6cb11a4184c403eb4b33
SSDEEP 192:dujHFL/iD148/0WNprj3MjMZjUi1ZDk4iqS4rS140iXwvDjINGQva6dr7+OBVF9N:d7vfvySuqf4fA5p8AO6eNt4gcd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Danish.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Danish.xml
Size 14KB
SHA256 e68db5e1ca01546c54c107bbf81dc94d218ab50ac3a1440c91fc1aa71b67bbe4
MD5 70181b67855c113a5531b984c23c450d
SHA1 93b83851b1f0432d63a94bc2736c25f35567c226
SHA512 3e9597b567a45a8e239485f75e66860dd5363957e8320e65cae807d2883bd469798cb3431cc5f5ab7c01b42d627092d228653cd98df005027af8fe797d50cc18
SSDEEP 384:yqsea1HjG7XzkC0tT9/BaJb3I6D1/U/kjsD32d:y3vTE3Iq1/U/Gd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dutch.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Dutch.xml
Size 18KB
SHA256 bd407f71630627442a8f583280415da821fad7ecb4578a5bb9073dcd1cd0445f
MD5 7c148833448dc4109db68f49d94af82e
SHA1 a1c64049c433e0b43390d4feea641e718a1a5d27
SHA512 51c04c881759cf6bc4ce5434acfa2fae22c80c00a410997787eb31a4ef6f4e15c287370c8e6b471e13a9652c177a09e03cc46102cad015468b904b0ffd25fd11
SSDEEP 384:doLuL/LtMjLFfLeLKLA7ClL6LYLDLXLbLfL/LML0/LlLrACkITYnJSg:dtLYBFACxTbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

English.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\English.xml
Size 17KB
SHA256 410450ef36bd1b448cf651c7ffdbfd920e1f406bbe8701343f4f08dff66726c5
MD5 61f8a23fa23d6b8abc0d3d9458117046
SHA1 74c8463f611a38bcf43634c1673c69f9ad4bd5eb
SHA512 2ddea49823b1988ac59bd73314b76eb69d92fd03879e979cf279a34aed178cd869e6f7edce07a751fd3e6bd9e43046b5e5a6041743ce7f6c828271be7bf128a3
SSDEEP 192:y/CQGwbybFEmGAVlasRMZCegYR4F0WsJvDjINGQvaHgTm8vKkzJpOTmFhC5QjNYF:yP+Iky7geSzEf8m8Nn0khMy/UXjBzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finnish.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Finnish.xml
Size 15KB
SHA256 d88630b901034be54d6e9d9e799105f0b00d55e0be23f2bc73aa4a1d6b089f5b
MD5 7b67c5896bf70d4947e91a0fbcba4bb8
SHA1 8904f660685cd5c307c0642bc1e275f1db190ece
SHA512 6026d25cb6f65600c1eb755a5539981606d81a8432c6ad06b3c8b05ee293e2de49820bfe706dca16477be778164eda97513c6097af9fc6ede9975caf3298872a
SSDEEP 192:yhRvs3BTIKC7F27LSjno35LnRMZTZYjPQajbRs34Etay/bkjqsj3Fwi6DShHfAIZ:yFE7wtAQNay/ojs/KAe9C/NumZVQSm1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

French.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\French.xml
Size 19KB
SHA256 ea9c62392597c132026a5b54d2f07e373f285470016ffa63220a92eb45a08bc2
MD5 7ddbdf0f4469be126761583351b4af1f
SHA1 56422f147f5296c71879dcb409b6b8c232941571
SHA512 da0c7b89cd4427287e79838e10028f40c5c37210aa7bdeab71bb6e999a8652872aa523f80fb22d99eed7081d0a1d4aa3f503ec2147c462b0e5cf2bc9d7a4c688
SSDEEP 384:ySSR7ADTdAQbDyjx4Me8qwEHVegIAnT3x2d:y/eTdAQbDQx0wWogIUt2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

German.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\German.xml
Size 15KB
SHA256 27606f32c65dbfe486426af031271da0eb82a4a570159275625d79e60dca1a20
MD5 4fe579dc3b8e3761e97acfce643b97f5
SHA1 18c05b624f047352af4266e9c297a06fc22aaec1
SHA512 06b1daf0d41f44a2618e25d29897f0a74a23e0d7bcd0c8c8f428036288257f6cc9bfd99802a7674d7fdc7576ba39212eedf57dec7c625ad0a8c6c93d7cab7442
SSDEEP 192:dNf0ZfTkfDRL3+Fv6teCoRMZu+t8O1Yld0fpIfxQa0plRShqZIYcYtCfqWlEuata:dMqdt8O1Yz0x62a0sMi40tNsSIuqa3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Greek.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Greek.xml
Size 23KB
SHA256 af67a5416696b394e05b8e398c58609b0574cb7b427d370b823f53ecc1a661a1
MD5 d048ec5409a00e87c16008c5f089283c
SHA1 fb8230b40828096eb52912f08eadf83a818aaa1e
SHA512 479e9ad200cd28f2783fe094af6f12f146ffaf6f4881237d4d6b2bbdc399e35273d69ba4d4df91f089f6f5807d407cf1153cad167077998c57c730f150ff5776
SSDEEP 384:yQzQlnWtVSi/aeux/+iXx4GIPobpJZ3C+3QAnpamlhwz2+TIhd:yQzQlnWmiyJ5+iB4NPobpDS+3Qejlhwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hebrew.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Hebrew.xml
Size 14KB
SHA256 a6ca650fb662ca3fed80a18aa65c505183a54e4b2e5f4c1a3fbf981126402997
MD5 b59535080454462cd8eb577c24612f0d
SHA1 0cd016c5e471842626351f8343569b46962550de
SHA512 e527bd5892245fd554ae127da771b457a05cc9943602f613b3acd87650f836feef4869406b38a660bd44081688731032f06ab914a8ce3712d64387dbf5cd4f5b
SSDEEP 384:ydPU25iqY7XzkC0tT9/ysJb3I6D1/USz88d:ydPZ5iYTV3Iq1/Pzrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hungarian.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Hungarian.xml
Size 20KB
SHA256 bd5ea2f21fd8e6a7b06aa3aba4dba116037a005a416710b35de14f661be5f21d
MD5 686640a0d9d945884afd4eaa67f10801
SHA1 0fc64c6ca87a5d8013be56e4c5f2f9f9c6fbad28
SHA512 5b847a9e183bfea191752c1f94524ba7c356a8761324ae1248e817f8c830a05fe89f31b43d04d7247a4d33128a561ff54768a5c75433a9d05640d5833d7623f0
SSDEEP 384:y1tLOrWi9J35Jsyix7g2JTXVPvNXza+Cve/juvIwcAwXmSod:ye3qdJTh1XzFb/sIwcAwXrod
MD5 SHA1 SHA512 SSDEEP

Submit Download

Italian.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Italian.xml
Size 16KB
SHA256 5ca379b45031894521c3daad9c447c6f8c96909ab5c5359baaba2c865b1be39f
MD5 b997ec2a4a4170c083a183431352a52e
SHA1 5e34706031482f01df9971f8345ab4910290d281
SHA512 5ff038fc03486ac11c5ad6a8345b16c8606e88994282840fae323cb25db3118c2e86fc20a6c31c77a92146bb494ab998a3e207667a75eb131e3bb782fca8b547
SSDEEP 192:ydE4/2hPjUwnMZar17DC86oljGamNeovaMMR2EDAAj0f0dmgFKpkDoBYrljTQ7jd:y8tMo3C8B/ji0opkNZXSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Japanese.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Japanese.xml
Size 21KB
SHA256 694fbf9c142ad6bed470e171e6b100534a716098ea46c9c1370ba154aa574f3c
MD5 47eccb6e75d5608fc6b930f2d3586d09
SHA1 1cd145bd3f778a2c7a66195e4f18f87be972be51
SHA512 179d0cd2da2f492af6318ab4c4e5b75a29f0343279f1feba55873b53687e848e6dc0a950e55799fe9d507a9e973530f744690f494587c585a0c6d213cb1694ef
SSDEEP 192:ywgANDNp5I1gNzQS8bV7GfAqFoebMoSRVC2PpRmoeMssLSjaGw1SnrnsWu57mlpa:yipxI1gN0Msw2JYalEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Korean.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Korean.xml
Size 19KB
SHA256 74f0443507bc8e3a130774acbdabc4ae40fe3ba4b525ea5e54d2e8024e80cd00
MD5 a674533a2dfe94311e8635e441070953
SHA1 2410fefe3f1521432c1ff646e922241a10a08423
SHA512 be7471d655b96361ee3bfe63f9ca9e7dec03231ec5be494c91bdc9f43225227c22c0834f5265e3f392cd6e0ccb1fe6d8cdc882767f334d2c0997e5a03904a73b
SSDEEP 384:yBsmRmYRJan9zZIfyvzy/w6rEALASmgpFDd:yBsmRm0a9vvGQAUS/7Dd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Macedonian (Latin).xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Macedonian (Latin).xml
Size 16KB
SHA256 17713777c8dea712abbc1dd9a5097e8d2bc7f0f34df7a5de04f0fc0d139117c8
MD5 0b12f4af582d715f0b7bf4f1248537d2
SHA1 b407ec7755e3d581e1cd3540a306ade9f471e6fc
SHA512 caa5e75071a20eb9c8be73475fe36b590f95b30493a016fd11430ffefba2df73acaf0e5cd1f6fd4295f3f192693cb1530407d6833611ebe83583859325db4787
SSDEEP 192:yTNOvChOlOTXsYfq4IwMZT6I50DI7lb5CrpP6+d/y/P/ofkddnmcF+z8nnAyG+nA:yF2aheskcqxMvqPakdzmRd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Persian.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Persian.xml
Size 24KB
SHA256 746d8eae18d2ed61a6b12b9c9674e4553e133457b65a87514376408eba228e01
MD5 2258d90d93212e96f7d341e18906f7b7
SHA1 5009b6f53eae7387986e5dcc0142f516bc6370ec
SHA512 15127ef6e6499c30ed6e9c6ef6450bcd8549f4ae2c404a013d9e75b884410884c36854a5998c863ed65d3120f33ed1ebc2261b174b1d473dc3b45dbe0ba03acf
SSDEEP 384:yw2CugONWy1F7DIqYgJ60AcxgeMwhrYUHd:yjCfONWGJnYJ0Acx7J5d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Polish.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Polish.xml
Size 16KB
SHA256 ffd0fb45a83491830e99e0de94d431a9b9694b92036d553a00b4625ceb188b49
MD5 907d0af6af22877f1035d366c547554d
SHA1 4b18a4aeb1e8efcbb659d8367e94dd52d60b772e
SHA512 e5cd85f5fd4d704ef6d80e857fc0bde745b88627efbf95f2bb36b3988f8217c3c38887520527d4a92746bd708d22965aecc5092a5d6995cc9ef719cb9d147c85
SSDEEP 384:ytzkEICYI65N8F4jUTVXYhbq0yY5xYcTGd:ytzlxYTI2jOIhbq0y8Ycid
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portuguese.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Portuguese.xml
Size 18KB
SHA256 bda0154eada9e705e3ebbf14dd1ba2536247002c0d0f55d90d54c8b6ebc404ff
MD5 8405a1486974ff7d407f0a489cd5d3d4
SHA1 ff239e1945901f5cda5a2336baf99bc7a17456be
SHA512 a4f7953614220215c1d35793ce31ca7046dba7425923453b0602ff0d77ff3b3c5235988f848827943fdb9773aee94e8332cf6502e2f3ca01a76832ea92f99f6c
SSDEEP 192:y+I5Se+SAX9p0KOebSJdHsRRMZGEdf9a5YHUWdGYGAoZGNwvgShl3N1Bxfst5HN2:ykd055rXTGYGnYcHswwKaLyEGd
MD5 SHA1 SHA512 SSDEEP

Submit Download

PortugueseBrazil.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\PortugueseBrazil.xml
Size 18KB
SHA256 293b0f490489c26c7a9bea4f7665056f0dde47cfc6bcbe0d12aa5d88ac15214a
MD5 9749be3488144a06d953fa9c4a421442
SHA1 05eae76ae193c3d846157ae8458e6bcb9c4ac5fd
SHA512 74b5bf1005c1b976d91031c8416ab3fc1353d92b74e658b40a2a894f2b0cdada868a852a6da650f9d04b4d7c9b524e512a28724beea9e185be837c9f2d4cf852
SSDEEP 192:y7CCCeK9NbNbVURRMZdkZd/zYkocvYeGXyWHkyG9qCln/ygFUDxxfttZetmTFhAq:yq5/MDRoUGiZy2UXt+gTTd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Russian.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Russian.xml
Size 26KB
SHA256 87f1dd4ebcbd998723deb1102f63107bbb9a872c64a385e02499e9c64602fd51
MD5 d78795e22e5b6cdc670184b7e342f438
SHA1 6e595f1a7350d0b66984f32ceaf132dece1ec05d
SHA512 75861cf96afc3acd6ca3cdc514148bd6d6d07683f947c416c50265f5ca1d34b9eb1deb93dd5cdf6ddde61707ff6beabbc5cdb5991c94b6d1c01122677a0fdf3b
SSDEEP 768:yA7SPP6HqdFUkPd1wwSgv0tFltzAUcWQD3d:x70zvUkPQwSztG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Serbian (Cyrilic).xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Serbian (Cyrilic).xml
Size 22KB
SHA256 778967caad8c311889bbfcccae51e142f3cea53ae8339aa59d4f32ed26040c18
MD5 d1d88cacce57c90bfebec145e95a0538
SHA1 d01b053fd10ab7a11ace36127da9e000a565abc1
SHA512 f57e55db4fc688a321498b74a832a3a176800a469e304274d401809947cbac6ff54f57bae6f2ea596a72da9bb8439e895691eed34f1d50fa977e8a26accb25ac
SSDEEP 192:yoi/+ZjqnyIcstaq97QQA9MZi5hNRAEgjcvZsSVFeuoj4DfgfWEkmbFWvz0TS+Pm:yZGUaql4AqBk4+WEOgG+PMJyHcYgd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Serbian (Latin).xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Serbian (Latin).xml
Size 16KB
SHA256 b6f427bb7292bc5f6d763ffc4e9440f063a0247a20bef76fe2239d3421211739
MD5 358d404248c473cb3cd427d69f621398
SHA1 f0a96bdcfb41333545e899079bcae11312e13359
SHA512 7922867da75aa35516b6e3041f41f618c57f31071de942fcffd018c631e684a10c72f2a8a10c63a502d895f6aa8fa272a5519d81d348a4d1746eea3526d6e76a
SSDEEP 192:ybZfVbZzfIv/PIUHVwVgckMZKOHz6Ry+HguawPjeTVJ+GSB54xlE+8fU0mEFyjLU:yiHgUcB9+mm1CxlEBU7G9TTCOjd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Slovak.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Slovak.xml
Size 14KB
SHA256 5e6d09c079b44b450dbb60e574ef475c2adbe824084f9ea780e65221f9506960
MD5 bee7a7a02a604c4f07867213e252f6eb
SHA1 8a0e9415287ad31122e1e42dd8e8a8d08eea72d8
SHA512 b6fe583c8919b0779f6e8b5eaf2b0d8a4839b9995996d454e830c24c06a5432ccae7af63ba68e10cbe16ed2c1ae65bc21c08df6cdd721cf492dbc6f53a068f8b
SSDEEP 192:yZvasQsKszC0uSbV3EsRMZCeXzkZYw0jungsSQlGUJb3Cf6DvdN4Mf/Km/FmjEq+:y+B4Y7XzkZRJJb3I6D1/U/maKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Slovenian.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Slovenian.xml
Size 18KB
SHA256 38e79f4d30c07d93ccc8006bcbcdc92a07730e12a4b0ccb85f9f2b586959f19c
MD5 9fb4c554b38a0e1e43b059551de8f834
SHA1 078068b884de1f5555ae21c5921de15f4c61acfd
SHA512 d6f710ceb67e4c76b0a1aa0782ed313382390c37f0bf8e8bfd802c2e5e4c9f7b8cf6a95431da604a4e4ba24ca064e96f2c89d402caaf16fb5641230e39e89683
SSDEEP 192:yxjqpqEXDc/hKxcyK83MkMZ+79cmLsIseDYG2kBdeAJmNG3CN99fMuwpnwE20OiW:yx2xqjADxBdWOh5lw81hB0IUCUKnqmYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spanish (Spain).xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Spanish (Spain).xml
Size 18KB
SHA256 0f8db4da1b413cc925933dfff367cb9ec775b359fc7da34690a43a4286530c36
MD5 d34359f6009d1a46f9e56dc1356e867d
SHA1 469fe4653c9f06b6de9bf0267cc9a31a36ac4963
SHA512 7ea446a775cbdb25b8d5bbc9118095be8bef38fd9d4890ff4b79216d069179656dabcbb0a069d778f179362df2f99ceb9ece3722ecfab1b6f1cf91f452fc1d9a
SSDEEP 192:yWTITTjrTEeKjDXIzKOTbyJfl4RMZnJolTvqOXCIF8e+XfocDFQD273oYfgt5aYf:y6c8pYTv/8eBBmngDwKZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spanish.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Spanish.xml
Size 16KB
SHA256 6e5f1ce0c0b48394614649de2d99c705d891ce48cc1920e490c46e17f195ce9d
MD5 dc1d550b6a6f47c6cdeb99d4d0fc87ae
SHA1 a1ada1ef65fbdc426c740532a2b095fd1c1664e0
SHA512 967bb13ec94d99ddbb526a3e46a32f5fb8b95ffa9410fc607a1d4581d85e4adc131b61c222462f3441dfa60ac66b62f825a4540c4add3f6d027ac84ae33ab583
SSDEEP 192:yYToxTLxTkeczCVLpfVj1Be4RMZCeFocFklLrsAsDBF5eigC/DDmEbS8DvdNJMfP:y/t7E75FktsD5eKrbS8D4/hsjKnd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Swedish.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Swedish.xml
Size 18KB
SHA256 c48222207c5585824024a045a62b737b93afbabab74309b73c7f20520c68a244
MD5 0eb076b175f08f097c8eca8c69de78b6
SHA1 66f7aec7413f7b6fbf44425f9eccd6ed0628e0fc
SHA512 f0f080cc334e4603fea11c2e79d4d22f112aa54e8984d71d348e75bb358a69c657a5b6149e7ad460b46f8e343fcfce7060b94350e3c0258b97c3270d25ee4df8
SSDEEP 384:yYZf+PLB1zGg1TpR1XB3MDEvShxrocKxlXJRHd:y4W3h1XJ7ShxZiJRHd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Thai.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Thai.xml
Size 27KB
SHA256 adf1da9cf4fb042f78a04c6dabf4563119375e61890f69690f7e56bdb67766d9
MD5 6d2222c55da575d7abebbc55e285a441
SHA1 f4bc69d225ade6f31b889ca9f13e383bd5ba977a
SHA512 49964a2ceb621ab0e1f06480a3e5ca278641dd9abb2e01c5cd3de49b5a7ebd9686130d95d26bbe0b2dc71170b051f1a85061a563540ca13b2d69cc44c8f22b35
SSDEEP 768:yV441iSB1SuMfBfcjizwNnCtpN+lk257wlNXdSPy3glxZ91FeXmxt/qbzgLfHsvt:mje/BBTTD5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Turkish.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Turkish.xml
Size 18KB
SHA256 54395f8531865e86407a49abb22a7022aea290fc18c7a8e3838818acf247a991
MD5 126585e4af2671e49612c9f814a3eb28
SHA1 004ef852907433086977db997bef00fc05551704
SHA512 26b00a4a553ece9de51f4f81275ad23e2b70ada656a126c4cef015641fc3aa9912221ad6a997f8f78a47684790729b9268db7617ef8082b5404006b99a405609
SSDEEP 384:yzO82+0EVduUD0alLca22tt1mff3a3/t/o9wd:yzB0EVJD0SLR1Cf3a1/vd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ukrainian.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Languages\Ukrainian.xml
Size 25KB
SHA256 14c3b27bb0a6bd31f76398833ddaa8d2d3a292e2faba1a97ea1084ef08e2ba03
MD5 cca3df10bc741661fc4bfcbc5d77db4e
SHA1 af438ca077b10fe3ee91e68417a19533cf3b1d91
SHA512 4f0bd4ab02dfd8e62fc5c0da25a29bea05c307cc2d5a91f841625cddbf1a591a90f333c6fb7740e9553325171f8e69a03c8d480ae69734f8e071e6b50600a943
SSDEEP 384:yweOarREbrPhSHGCDZdDJCuunMoL6l049QgioCd:yweO3CtDcnnbL6+Fd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Settings.xml

Path C:\Users\Admin\AppData\Local\Temp\DDU v18.0.6.1\Settings\Settings.xml
Size 1KB
SHA256 7c8bc36f0184ff9f66d198e4a0b76647ba1fc6c507652feb4e04c359c86e00ed
MD5 eb7e75ddb47af62a29d514674769a8b6
SHA1 ecfe70bb48b8257bc1194c07ad1a9f1648e3e3f5
SHA512 4501b59bd7a959386f9e4a610dacc0438907e4642e08aa16a11983839fcb2f5be28ed9b73bfb5416e40c83ca24a2b26fe948b636787ac7f60292213482728ee9
MD5 SHA1 SHA512

Submit Download

memory/3292-206-0x000001B63B620000-0x000001B63B628000-memory.dmp

Download

memory/3292-237-0x00007FFE501C3000-0x00007FFE501C5000-memory.dmp

Download

memory/3292-259-0x00007FFE501C0000-0x00007FFE50C81000-memory.dmp

Download

memory/3292-208-0x000001B63F790000-0x000001B63F79E000-memory.dmp

Download

memory/3292-207-0x000001B63F7D0000-0x000001B63F808000-memory.dmp

Download

memory/3292-170-0x00007FFE501C0000-0x00007FFE50C81000-memory.dmp

Download

memory/3292-169-0x000001B61F230000-0x000001B61F356000-memory.dmp

Download

memory/3292-168-0x00007FFE501C3000-0x00007FFE501C5000-memory.dmp

Download

memory/4108-233-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4108-7-0x000000000040F000-0x0000000000412000-memory.dmp

Download

memory/4108-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download