hxxp://www[.]funduc[.]com/ftp/Duplicate_File_Finder-Demo-Installer-x64[.]exe

Analysis

max time kernel
161s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.funduc.com/ftp/Duplicate_File_Finder-Demo-Installer-x64.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Duplicate_File_Finder-Demo-Installer-x64.tmp

Executes dropped EXE 3 IoCs

pid	Process
2920	Duplicate_File_Finder-Demo-Installer-x64.exe
4148	Duplicate_File_Finder-Demo-Installer-x64.tmp
3632	DF64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DupFiles\DupFiles.chm	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\de\is-A7NMS.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\ja\is-VS0QS.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\zh_CN\is-E212H.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\is-MEMPL.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\pt\is-SPH96.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\sv\is-5Q4RO.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File opened for modification	C:\Program Files\DupFiles\unins000.dat	Duplicate_File_Finder-Demo-Installer-x64.tmp
File opened for modification	C:\Program Files\DupFiles\DF64.exe	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\nl\is-V98A3.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\zh_CN\is-D8ORC.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\is-7678G.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\de\is-5JVNR.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\sr\is-81TM1.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\es\is-G9V71.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\is-RFPV2.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\is-IFVJ2.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\fr\is-OQLR0.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\es\is-5SRQI.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\unins000.dat	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\it\is-8KSUF.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\fr\is-KR2SV.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\nl\is-27174.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\is-DPMST.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\is-SJGAN.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\it\is-BS3QQ.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\ja\is-L0B1C.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\is-S4EUA.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\pt\is-JEU2E.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp
File created	C:\Program Files\DupFiles\sv\is-J38R5.tmp	Duplicate_File_Finder-Demo-Installer-x64.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\vb.ini	DF64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Duplicate_File_Finder-Demo-Installer-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Duplicate_File_Finder-Demo-Installer-x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	DF64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	DF64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	Duplicate_File_Finder-Demo-Installer-x64.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	DF64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	DF64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	DF64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	DF64.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	DF64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	DF64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	DF64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 766110.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
4784	msedge.exe
4784	msedge.exe
3936	identity_helper.exe
3936	identity_helper.exe
2104	msedge.exe
2104	msedge.exe
4148	Duplicate_File_Finder-Demo-Installer-x64.tmp
4148	Duplicate_File_Finder-Demo-Installer-x64.tmp
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3632	DF64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4148	Duplicate_File_Finder-Demo-Installer-x64.tmp
3632	DF64.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3632	DF64.exe
3632	DF64.exe
3632	DF64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4804	4784	msedge.exe	83
PID 4784 wrote to memory of 4804	4784	msedge.exe	83
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3204	4784	msedge.exe	84
PID 4784 wrote to memory of 3488	4784	msedge.exe	85
PID 4784 wrote to memory of 3488	4784	msedge.exe	85
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86
PID 4784 wrote to memory of 380	4784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://www.funduc.com/ftp/Duplicate_File_Finder-Demo-Installer-x64.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ec646f8,0x7ffd8ec64708,0x7ffd8ec64718
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Users\Admin\Downloads\Duplicate_File_Finder-Demo-Installer-x64.exe
  "C:\Users\Admin\Downloads\Duplicate_File_Finder-Demo-Installer-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\is-T68TG.tmp\Duplicate_File_Finder-Demo-Installer-x64.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-T68TG.tmp\Duplicate_File_Finder-Demo-Installer-x64.tmp" /SL5="$C0234,2836323,832512,C:\Users\Admin\Downloads\Duplicate_File_Finder-Demo-Installer-x64.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:4148
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\DupFiles\Readme.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5661014654762758205,6832704836431378025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Program Files\DupFiles\DF64.exe
"C:\Program Files\DupFiles\DF64.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DupFiles\DF64.exe

Filesize
4.9MB

MD5
a6d15651f5c7cc1b88402642c85426f1

SHA1
e1d27dcc2e1eec6d9e009d062e7789867947c7f1

SHA256
91319e9ea307faefe5c34a182d9b55930c6c11cdb2a8bfbe7e1bc23085270820

SHA512
61a8b3363b5a40910851f3a58ba020105de10d9fdbd849976d99189b595c4d6f8de9c395d25444905076d952446cc72d953649204208f37c2085e6f95c7c9285

Download Submit
C:\Program Files\DupFiles\Readme.txt

Filesize
2KB

MD5
39f9837e6d8f3ea750e319d3e25a93b2

SHA1
999c2debfc3e81ca2519a9330d065dd93010de23

SHA256
1b9f4a3e5b524de67181557a3c29b14ce0016485cd138a6910cee8d49c97d7f1

SHA512
64bdc671739b4c5f697dc71af61063d5117fca2883cda19acb8df7f2d805516d6b70fe3eb6b40c665189a299b4961dc7ea35b9c21d9526829b6bca688dbf4a03

Download Submit
C:\Program Files\DupFiles\es\is-G9V71.tmp

Filesize
50KB

MD5
e75d5b66d9095cd5bb3457afea8f1a8a

SHA1
5ecd481925f25b0bb2bdcc9b5726bc2fd6fe3615

SHA256
76d65aa7a2da420efd6b95cfb29254209ffbe711d71f8671dc7f001171091f7e

SHA512
45c60a078816615dcdb93b45a8620bfef0e3ea8c86c1dba4d7e335a8f425bab573ff5deddf4755b10592d89da8e152acd4f2f00d56fc43bfd352fdfc64229247

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Filesize
765B

MD5
d407d5257d0d53a96538f1a7e9b169bc

SHA1
862422398699f1bfcb503109d4c0c487594a9c4f

SHA256
5b1c8c416405ddc51d5e35e23978b9a1ca0bea6ea6b26ef7b38771ff491adc22

SHA512
eb12ab6a40a0a370a6ba462384cc483829634e0e51febc88593bbdf5b47dfda88c10ab3a2997ba8f03d6ba10facd93dc711eb8be3bf337ac8770d61121e7c3ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_45F341B8F79A15DC90EDDD802EABD400

Filesize
638B

MD5
568f75053b353dc87a8175e8a3cd5c53

SHA1
ff60c7e23056c682545cd476a6c1c86987640194

SHA256
ac6fedfe0ea1ab1d7224c771811ca10edece8928f4da2dcec734796da8d60895

SHA512
b684cd4c39e3c56ac29031bdf3a2026e0e3cb99e898cf9a04bf601e8b393204e3e472cd17a3f688ccc7a7a051a4d065361c8085e4f5b86bce134b6bb52e8fd31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
1KB

MD5
362f9b80fdc2b3bb2cf7ee350a3124e4

SHA1
cd4ae1b58606d5a491e57928ab2e50adfe77b526

SHA256
86812da6e5ec489c2f6fd040ff59888d1ac83b63604004f79989ee8f475046b1

SHA512
2a5a5330a52dc919a8406c7aae5d6d0e5e2a00acea1ad14a18d0b632f89bd289a830201defc9ca0137f6c837958eee576b1cdf432419176f1f3e1d21f670f6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Filesize
484B

MD5
d5934ffa7ce32ee4c7b40c91fac01fe6

SHA1
55b13f5e0adeca27397d75873d148a291147a79e

SHA256
9be073d226ce5e9d2b6c35a872d75a7d09d2182b22b61ec61f68f53cc3d9cc5c

SHA512
b640a5aa127fa23ee5eaa71899d9fb09df7823c8384ac3f9ece51a0cfbef1c3f9f2b2dae89963269c62ebfdcba6ced5673f27278be96d3b42e94a001a29797f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_45F341B8F79A15DC90EDDD802EABD400

Filesize
484B

MD5
d1dc0ecfb99dac5fd827d1d862db9fca

SHA1
16ed28dcfb5a6cbb7af4111227ae4b068725ecf6

SHA256
10579b55aecd4baca27cd3173b3b6bd8f32a9972d731b57341e7a1277081211f

SHA512
a98b8c44f72af9404a8eb10976bc4992fa9da1f50af5f66213a1f13581a074a032dcc4308ae56d97a2a180e58395d77f53366f2f4bd6a2e613825577c3ad03b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Filesize
482B

MD5
6910b7a26173e3b7969336402e85e966

SHA1
aa00b97db00686ce7885a5995ca32845b6b5130f

SHA256
832a10b859ef4a780901fc9207c16da773628f89426222304d5860b5059dd287

SHA512
816b3b5738fdf62fb7acc87cbe07a769a114e8e1fa71b9b843de7cac66df02d7f368afdd4a8eaf09f9f9d5c1683e2891d51f66a9d04c97aab39bfdbe5295dc1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7c3f5dceb36cac4bb6ddb40fd117e0a

SHA1
6f7e258f2e5dbd24559a80e3b7153d7eae618435

SHA256
6291c5c6fe8f3799e896eec1b15389a09f32eba6fb02e6d7c6c642118a39c542

SHA512
f975346477219c450712e040ab50f76e7dde219b356641198408a0a03ec99eea854cc36e01702743e5f50a70506f56def807e809fecdab7cbbfe474d74c016b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b24797d27d37982e5bcb8e642305d562

SHA1
7cc64263b5ef80da90e8208df070387fee98ba7d

SHA256
ba863e540c7e5b8b0ceec77f9dccf9e0b1599d3b2a1619766528c5cd6570b148

SHA512
b09bd998f30984036d7ab5600b5a3e62b455fc489f0473591dd0ab80c37d2b219b9517a3fca0a6e9a874e837373df1f4a8074c6f323dd62d6113c89f5a50a459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
224393200b3a1db4d4cba231f8d7a9a3

SHA1
9422be1f4555a6b3ece3cc77c9436bede79ce2d5

SHA256
889afabb389f2c28d28b6fd9a2450ff226f2da5a570b4f09df6ffc614373df5c

SHA512
79329dcca3eddae297c62932c4768c9548070824d5ee7614f390df6061500dc6e5d2adc354737fd3b5d618e5f36984dd44140e9c70dd0b46a68b04e8701eb83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a1c25f1ddce78242522ade2280b46bef

SHA1
71e9b48e4bf64401b737e6ee27fa445b97ad790b

SHA256
5f8c69014d6f0a09f16bb4943b49178ca4236ed9fcc961fc41c655a0b087166f

SHA512
fd431a322b3a7b1f82da9c0643ce131c60f1b553ba37b7008b2adc992f8dabb6587dd53dc163dde1fa54b2f579beffdb93dea8b7464bf7128f115937ccbdf638

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T68TG.tmp\Duplicate_File_Finder-Demo-Installer-x64.tmp

Filesize
3.1MB

MD5
7f424bf4eefe5e5e69e310a000714571

SHA1
355cb264d9aae9627f8b409b4c76fa6a2125e4aa

SHA256
fc405c72b18ab2f7236e0dd10672456346c61a2ab24f2ee90600293191cc29cc

SHA512
85823a2b08c713a621a107e11f78cefdcb95d443d23377b7f701dba356f721d1e3d10a0aea1f419303b85855c4a8fc11b17f5e8a4316a23e9d3c7cf301bad2a4

Download Submit
C:\Users\Admin\Downloads\Duplicate_File_Finder-Demo-Installer-x64.exe

Filesize
3.5MB

MD5
e5c671285c03939db1c88bd94be2ca1e

SHA1
fd2490a216a3768541845034695882c64a279948

SHA256
afe8b26f3dcbca52ca08c63ad27ab853f86953efe79ec499e44c9b1ee40300ec

SHA512
afa9a66c00b8c4b218be34ed2f50ec27f28307480fa6fd14a61cbbd9cc3b4ef43031fbb9dc50a80a437a89870165c4451255700c98a828b63ac13e5da7895ef2

Download Submit
memory/2920-124-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2920-188-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2920-95-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4148-125-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4148-187-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download