cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/12/2024, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24.msi
Size 14.0MB
Sample241211-sn192asmdr
SHA256 cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24
MD5 5b4e1ae1818b630dae4535ec96807462
SHA1 d1ad62a4b640fef1835a4d4dd54bfb4d6ddaaffc
SHA512 22bb5ef7eb5ae3f95cd166ff5915db5d97d013a45addf46128651caf4e023dada7eb6e157bbfd8a261b882b24bf67909014b8e9581a7353c214992f0d8036b79
SSDEEP 393216:SOpBXH8JSvAg6RGOpkr4wlkOESYp4uY1N:rpBXH8JWl6EOpkUwO7Y1N
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	PDapp.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PDapp.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	PDapp.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PDapp.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PDapp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe App Manager = "C:\\Users\\Admin\\AppData\\Local\\Programs\\EasyDuplicateFinder\\PDapp.exe"	PDapp.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76d8c2.msi	msiexec.exe
File created	C:\Windows\Installer\f76d8c3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76d8c3.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76d8c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDAF4.tmp	msiexec.exe
File created	C:\Windows\Installer\f76d8c5.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1096	PDapp.exe

Loads dropped DLL 7 IoCs

pid	Process
1096	PDapp.exe
1096	PDapp.exe
1096	PDapp.exe
1096	PDapp.exe
1096	PDapp.exe
1096	PDapp.exe
1096	PDapp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2148	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDapp.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	PDapp.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	PDapp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	PDapp.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PDapp.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	PDapp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PDapp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	PDapp.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2076	msiexec.exe
2076	msiexec.exe
1096	PDapp.exe
1096	PDapp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeSecurityPrivilege	2076	msiexec.exe
Token: SeCreateTokenPrivilege	2148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2148	msiexec.exe
Token: SeLockMemoryPrivilege	2148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2148	msiexec.exe
Token: SeMachineAccountPrivilege	2148	msiexec.exe
Token: SeTcbPrivilege	2148	msiexec.exe
Token: SeSecurityPrivilege	2148	msiexec.exe
Token: SeTakeOwnershipPrivilege	2148	msiexec.exe
Token: SeLoadDriverPrivilege	2148	msiexec.exe
Token: SeSystemProfilePrivilege	2148	msiexec.exe
Token: SeSystemtimePrivilege	2148	msiexec.exe
Token: SeProfSingleProcessPrivilege	2148	msiexec.exe
Token: SeIncBasePriorityPrivilege	2148	msiexec.exe
Token: SeCreatePagefilePrivilege	2148	msiexec.exe
Token: SeCreatePermanentPrivilege	2148	msiexec.exe
Token: SeBackupPrivilege	2148	msiexec.exe
Token: SeRestorePrivilege	2148	msiexec.exe
Token: SeShutdownPrivilege	2148	msiexec.exe
Token: SeDebugPrivilege	2148	msiexec.exe
Token: SeAuditPrivilege	2148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2148	msiexec.exe
Token: SeChangeNotifyPrivilege	2148	msiexec.exe
Token: SeRemoteShutdownPrivilege	2148	msiexec.exe
Token: SeUndockPrivilege	2148	msiexec.exe
Token: SeSyncAgentPrivilege	2148	msiexec.exe
Token: SeEnableDelegationPrivilege	2148	msiexec.exe
Token: SeManageVolumePrivilege	2148	msiexec.exe
Token: SeImpersonatePrivilege	2148	msiexec.exe
Token: SeCreateGlobalPrivilege	2148	msiexec.exe
Token: SeBackupPrivilege	2012	vssvc.exe
Token: SeRestorePrivilege	2012	vssvc.exe
Token: SeAuditPrivilege	2012	vssvc.exe
Token: SeBackupPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2476	DrvInst.exe
Token: SeRestorePrivilege	2476	DrvInst.exe
Token: SeRestorePrivilege	2476	DrvInst.exe
Token: SeRestorePrivilege	2476	DrvInst.exe
Token: SeRestorePrivilege	2476	DrvInst.exe
Token: SeRestorePrivilege	2476	DrvInst.exe
Token: SeRestorePrivilege	2476	DrvInst.exe
Token: SeLoadDriverPrivilege	2476	DrvInst.exe
Token: SeLoadDriverPrivilege	2476	DrvInst.exe
Token: SeLoadDriverPrivilege	2476	DrvInst.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe
Token: SeTakeOwnershipPrivilege	2076	msiexec.exe
Token: SeRestorePrivilege	2076	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2148	msiexec.exe
2148	msiexec.exe
1096	PDapp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1096	2076	msiexec.exe	35
PID 2076 wrote to memory of 1096	2076	msiexec.exe	35
PID 2076 wrote to memory of 1096	2076	msiexec.exe	35
PID 2076 wrote to memory of 1096	2076	msiexec.exe	35

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PDapp.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PDapp.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe
  "C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - outlook_office_path
  - outlook_win_path
  PID:1096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005CC" "00000000000003C4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f76d8c4.rbs

Path C:\Config.Msi\f76d8c4.rbs
Size 189KB
SHA256 b31dbb1e2dd1bc0bdbbe244a3c6f62a2be193831a9432cb62ea666ec639c61b4
MD5 dbfe6b3fccb37bcba445ff306228175e
SHA1 ab73609791e9e8700fa985397ef3506961e0efe7
SHA512 569be0de1c2dd934cea34a6ef9f8d5e72852485c0e3cafe8078a7d92c26ed24b494d944765a7e77ae0c6e270649bb02b8b2b771117ccbfd87399eb334254d969
SSDEEP 1536:JmUchMpHU3/As6VcBqCGKQLV2p6hNVf/S+FjsihdIaquzBC:kUch+0o5FjLV20NVfaAsjuzM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdobePIM.dll

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\AdobePIM.dll
Size 1.3MB
SHA256 d5887c9a91d52c55e307d0d6a2b9cb776d74da0189f66a6c597d08500bd22096
MD5 918aa040c843d0ff3b6788d1104081ff
SHA1 e5d7657604e9723441ba08d6f42f4a9234fbefa4
SHA512 7344facc6df8bf5f7b93765a6f4e7adc2ca050084cc20b1379bc89eb628098edac4ee11a40dbd302ffc48487b37ac4b68266cb37cb2b54e79e5e060a2f9bc704
SSDEEP 24576:tY1iODN6rCk37AxYa1cWMLGdyGdxi5a3mMvMW4qZT5TIiB1K8r:TrCk37Aaa1cVOkwpMOZT50iB1lr
MD5 SHA1 SHA512 SSDEEP

Submit Download

CES_PlugInHost.dll

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\CES_PlugInHost.dll
Size 775KB
SHA256 6caf24c107b6d10504e73dec841c4169d5f5a4d366b699402c8d2a51e877032e
MD5 49ce1f597a415370d85c1bf7aa9c8c56
SHA1 5f98f65879d3701d9e1bdb5f68b02f59f5020f55
SHA512 1b730e43311808105f39273a5a940bbeccddd22058f3046be5771f9ac51b5a2e372774026ee79bf38261bd6026cf9b4eb0260075ebde932c5687720c80bdba6a
SSDEEP 12288:jS7GF1lwwJ5Pb6DCgog1POF+/Iox3xqmodIgysRl38sWKLlWCRFR0eQdzOaGaMiQ:jSypS7sRl38VKLlWC/R2d9GTiJKDBWWT
MD5 SHA1 SHA512 SSDEEP

Submit Download

PDapp.exe

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe
Size 2.4MB
SHA256 7e5f8c916e7359dd8a9cd4e476803cf0d89496668879aa34731a38c7ad13a45e
MD5 8c91eacff0f53860ecfc5fd67168927b
SHA1 4062cf4e7c5457849e60232f34afa2b9bbb3d827
SHA512 dbc5f3f07b3f108d0ddc5e93256ed40cd70c8f32383dd58d698498a4cd8de3d970bd70da3c47b2e2bd9d19d5e90159ffaaf5d6e43039158b23c5cd74ae60403e
SSDEEP 49152:M7+TrrOTyf/Fsy6nfC3uG7CMXtsjfCczRpXSkbPsbw2z7KnwtLyBjKx6gk84I1Jg:MKTX8yf/Fsy6nfC3uG7CMXtsjaczRpXD
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.wav

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\audits\file.wav
Size 1.8MB
SHA256 c3b5ab67ff7b2434f4114978574c0f6d346bb9dcb77852b0510e81ac0d531e26
MD5 6e273050001c158d071f785c008e6fb7
SHA1 7ac53cecf2643b2bac9e8f9d6551e03fcc9551b7
SHA512 540c2ac089a2944e19b4e20431ecbd56e3064d1b9f3561ccd9a35e8350bc43eb7b21b0701905ea6801eaef290d00ddb83a66af1d0c44e59836707baeda14b878
SSDEEP 49152:JhErYjuFONCyOOehO6oZx7gbL4oc68mktXl:JhErKulyDexoZx7QLpVkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

backtype-1.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\data\backtype-1.gif
Size 103B
SHA256 90257cea1ab9c86c88be5d4725e3b3bd2221dd88f5f1d18f37469a4ffb46b14e
MD5 ed07f0d10c972df3ba96108512817464
SHA1 ae7709738e643bb0e809399b71174f8406eafe89
SHA512 f27debced23612d596ea5e002490e18de5b15cbceb975b23237e783a7ddb2190100f95746b51f8e4d219fc08d1e3a341e442920e08da31b504e4278b68248579
MD5 SHA1 SHA512

Submit Download

btn-group-default-framed-corners.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn-group\btn-group-default-framed-corners.gif
Size 85B
SHA256 7b78c89b7216394b7368af497b02e574a7d1f321e04104d443bc6a02efc4f4ce
MD5 766985bab326eb7cbce306724f144ca9
SHA1 02212baa371406057b092a2faae04376d09355c5
SHA512 b9e7dbdfc807ba8b4bc6743c0632b273b8811c6f840428e43967ccee3b19c7fcabecb369db530a8cdbbe757206c67d71a0272b8a3d8ca2bb006d65f0f6e7cd03
MD5 SHA1 SHA512

Submit Download

btn-group-default-framed-notitle-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn-group\btn-group-default-framed-notitle-sides.gif
Size 99B
SHA256 c1868f497479bbdf6d82ef1dceb980b5cff79dd6d554220946a35493148c7bd0
MD5 7067bd054af0984763b8dc54c43bd07d
SHA1 7d62875482e0607ccb833ba301b2a65b71b44d51
SHA512 1cfdb49d82a618acecd2dff47e267a1c6b51f3aeb1b8e35f6aacbb184cae3b068cc3d7ccf00d3bfcfd725e782132c4c5bee8c68af144647631f380bef045bd84
MD5 SHA1 SHA512

Submit Download

btn-group-default-framed-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn-group\btn-group-default-framed-sides.gif
Size 106B
SHA256 18b4e5f65b53eba644a0f67cfb1de1142f08f795434b26204bb582f4247a0981
MD5 fcb7db8d14c7c4ee1d0d9a5e3a2d6313
SHA1 61aed02087ad268476c0d5266368859bad85bc73
SHA512 509e80cfb21bef6b257ffdff660c330a77d93cece5df17c91cd60864c1269de27256bcf0c225af0af9f40f2b7e3d41a038f142a55c7e64bddb5002e09eef72f2
MD5 SHA1 SHA512

Submit Download

btn-default-medium-disabled-corners.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn\btn-default-medium-disabled-corners.gif
Size 135B
SHA256 5ad67389bedd16bc5f46fd7c4c0a93ddc19c4070951b68cf50d982bfd0f0f7c0
MD5 6a93c763f4864f22cc1595a0b2745eb8
SHA1 633ec3156e2b46ddb96dfc589cdd83780599f4bd
SHA512 4886f51390a68db51cd93cad107b004232a709051484f8beb12407902ebf0397b32ffe7d27ac41e5fa876726ee0dee8323c9857399e3f5bd60e96a2387d9994e
MD5 SHA1 SHA512

Submit Download

btn-default-toolbar-large-disabled-corners.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn\btn-default-toolbar-large-disabled-corners.gif
Size 123B
SHA256 d8767dd54b30c59b4a426bb86d18ffe6239ad3bc34a0a7e0f39f271ed92cf668
MD5 c05f4d6e2587057d9f1514fc63b3a653
SHA1 0bde91bfd33b6d0ad0e0ff1f8d36a4cf50997cf9
SHA512 685e6236775d2f915549f2761fe7bd14cf6d7b459e464efcafc7961ea413c4c7bccaa28eb0b9d7725ecbddc24872fbd423cd4a9254b2ed72aa4dcf1fc4f46e0e
MD5 SHA1 SHA512

Submit Download

btn-default-toolbar-medium-disabled-corners.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn\btn-default-toolbar-medium-disabled-corners.gif
Size 124B
SHA256 e5c7f9f3d2d05e6d5417246daa23d035df909b8326ec523e44e651ba1aa9d73a
MD5 4f30b831261a4aa622d0f5708f48782b
SHA1 ab28cb228c93fa580953f873e14e5348efb42c8a
SHA512 f6f20676a67a8ba08a1ec985f904735d136c5281802ac6eac84925d73bbc4be5704e4d4e58d742f1b35b6008ef29d81faf584acda0943e745bba9c58f356f62b
MD5 SHA1 SHA512

Submit Download

btn-default-toolbar-medium-over-corners.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn\btn-default-toolbar-medium-over-corners.gif
Size 185B
SHA256 1d17f80db43f29b9ccb79182266f0c191fb522d853374d435239d641d655a3ff
MD5 a06e7dfd845a8adfb9e0dbddac55dab3
SHA1 da22b7c1dbe3bede44080dceddc4ac67dc1b3999
SHA512 2b19c23275a2b9dc1b5725b7c43778452b8ca5b81fdc171e7f1aca365b8f6994948fe49989e962cf8926be65912126ce1cf976105aab83abd869d276a3abb9d4
MD5 SHA1 SHA512

Submit Download

btn-default-toolbar-small-disabled-corners.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\btn\btn-default-toolbar-small-disabled-corners.gif
Size 123B
SHA256 06519563d98ea4ed2f323486714fd73f2858211a1afaedfd5596efe06dd1a973
MD5 10a2674b160c1191518f355c02272c5f
SHA1 8e476beea32b7eba73e669a916360cb04875eb2b
SHA512 ceec2d0fb428ed460e8710afd499731592397a7b7f66e4c18333bf013cc448da577a6396464ae2d75c37d0320ec4e503506abd80bfb148323cc1a4386ca2d80f
MD5 SHA1 SHA512

Submit Download

s-arrow-light.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\button\s-arrow-light.gif
Size 116B
SHA256 fc1b76daf24e786d67a34d50597138342a70b5911e89d6af68dc60aaa178f449
MD5 6576de0eb6bec88f8e37c12829939573
SHA1 da1d024491b5ec2a5e5abdf228181cad752b631e
SHA512 5b50031b941d1d9092723d9c41a487fedc645e18858b91c444cc0c8d03d511463722da5bc4a506da4fa2c94ff74875eb1f3008bc0386ef8ffdc6b4f9e286176b
MD5 SHA1 SHA512

Submit Download

s-arrow-o.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\button\s-arrow-o.gif
Size 139B
SHA256 8bd23fcafa6c984a13a500101abf50adf69060d8e2de80c9fc7fb899b0200bf6
MD5 11e75d35ed05d06d42ee48366853f770
SHA1 339d51798514c2922092abd43f466d9dd7cc1088
SHA512 d68461cb726a08d6d126462d83f526ab3a4a378395c8db6c8d2730aa10180e61aa06ca1317978d9998602f1d4b4bd389c125f37072f81e09b908cd1e5b720164
MD5 SHA1 SHA512

Submit Download

grid-row-editor-buttons-default-top-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\grid-row-editor-buttons\grid-row-editor-buttons-default-top-sides.gif
Size 100B
SHA256 125602c39a34000cbd6914f82b5db053a105834579705e62f8cdcb307d22e154
MD5 32303a4dbf1111d1ea5004b3a3fa50a8
SHA1 58a3f276ff82afbb10ac6de91b21da022514f570
SHA512 41627f8c624b635ec159c1695fe42fbdff966dce0865b8c34f50b40f871171b95605f81905c8b1521b5c6d72f25592cb89534bbe628a7ce8d09287919a2e20f2
MD5 SHA1 SHA512

Submit Download

cell-special-bg.png

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\grid\cell-special-bg.png
Size 121B
SHA256 ed5f693d5bbbc6f5b7eb02facfff309cb3f1b58d34c33203798e6c8bcb47d804
MD5 a6487b6bd88ce1a726d41140595235be
SHA1 5cfd1d8cd70e24b427a655ee5417b23e5f0385c6
SHA512 85dcb225a09944fbcac6799e5cc05892a97e66f29b99877df5bb4d384b9af7853122f87d7d233cff330278393f55cfa9decc843bca21a4d4f0d151ad949a3c91
MD5 SHA1 SHA512

Submit Download

cell-special-selected-bg.png

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\grid\cell-special-selected-bg.png
Size 136B
SHA256 38af55a212e7cd745992dfbeb16beacd1af4e73c2a093a460cfcaa4b4bdd59a5
MD5 df8d68826afb17ab5ed333565f531fdf
SHA1 7a26fe054f8f8871354b81631fc0cd3af26f7539
SHA512 7c8b7ff39bcd42600448a379b78b6179bd4c08a2d43f43e059091908738168aa2e8a2b2e90cfbe1267e76a837184b4af621a11f6711cb1b9ab62b7e5ec5c4862
MD5 SHA1 SHA512

Submit Download

done.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\grid\done.gif
Size 133B
SHA256 5ff21e3dfd8a2f54f30c836f5608f4521c77225fd546dfec2e1065db9690cb08
MD5 365266930a93451414fe51ffc524a196
SHA1 cda9d3b74238adb9f1412946297e90eb0b2484f6
SHA512 489dcdbaa3314bbb6ff06339bc4a7818ae56b06b29d423961d5ffb7d17c779d9e39bca33c8230036b7b18e5ce0b63991c7868798097c31e87b313b990b570341
MD5 SHA1 SHA512

Submit Download

checked.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\menu\checked.gif
Size 90B
SHA256 a8ad9a97b9aa322679bad778e9e86f772753ec952ddbfd13871fd37be9728c94
MD5 03f300ba01c9792dc1ebc28478e777f3
SHA1 3aac8b7d4e797e2cef4fe1d079b576f296053cf6
SHA512 b519b4c08d7a3f9f34aa5ddd94d3e87af7d3dbd4d070d1f441dd38ceda19dfbf048ea4b1f91419b713222f48fe12a524a777138f58c4da8b049851043a694552
MD5 SHA1 SHA512

Submit Download

unchecked.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\menu\unchecked.gif
Size 105B
SHA256 d42e3ab108cdde76e73e74bd12f8eb55f47447daf65fbf8b80a12ababcf2b527
MD5 c95fad9c82eb9905477376f5a1e3b71d
SHA1 dc2a895dd36592d7cd5f479f926cfcb8f4ddc08a
SHA512 2843c54dab97c7ecffdde0d11831298bbdf06239cbd555f884e45b855673014c36146b877961117203e52de8126aadf12d5bf2c3cf853280a72566fa6d931efa
MD5 SHA1 SHA512

Submit Download

panel-default-framed-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\panel\panel-default-framed-sides.gif
Size 88B
SHA256 812ca626245f56bf36c7cddcc97acf2b1b73718e2b01164a9198dbf5b583801a
MD5 d60661757dc6f55237b5cd525e3ab2ae
SHA1 06df058992be5bd4125ddcc48267f6bf12ad31ce
SHA512 ba4e7a87c1c804a7184a4ef09347cbf55df56f9f9c9b6e81600581fd517d067fe663752cae683478d135b877c271c3a8a65f9edd8177db8a4082cbfd338fc8a0
MD5 SHA1 SHA512

Submit Download

left-btn.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\shared\left-btn.gif
Size 106B
SHA256 95e6ade45977bc6edb334a865b968d7165734346c4993ae8e2e990a18711802d
MD5 fdcd1ea713557afe17bd7412a490c329
SHA1 fac823cc09feb6fb5995c23ba4ad1a37e4a034cd
SHA512 2dd9a4d8ab1693e23e3a75afdd6f291307ef80971bf232d60818fb366752995772b96866fda4b58c9c35f033af999f5ab21159cd92233b4b1bb8be939ec11bc1
MD5 SHA1 SHA512

Submit Download

right-btn.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\shared\right-btn.gif
Size 107B
SHA256 6e4969bc5c58a24b73f5fd07442b2e78ba4f64062873d7bdb3b2498a3a66d2d9
MD5 192c5bc33dd9f780439db51c8777dc4f
SHA1 c7ee96919ab81f18aa411bf7dacd27d0322738ae
SHA512 054b25a586787dbc53e7c1da4b76aa11ee682e0c453b1320ad9cad85d0aef47751abbdd851e76615d1c6ca510e1b999bec68427010f2671e1ab9efeff84a1322
MD5 SHA1 SHA512

Submit Download

shadow-c.png

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\shared\shadow-c.png
Size 118B
SHA256 2401e260ba44275168a20dc8102e7490bbcc39d0b4276a61f7c36467b0472e65
MD5 7ab6163237099f2529452b88953a4049
SHA1 18f7b111bab6e8928b88a8cfc315115cfebed8b9
SHA512 2c2bb71547d58c4de6d0da8fcdc7209eb68d93d5e6819a8e6627f8fafe9fc509382e745525755d021621622e111feff669d057f05070bef9788fbaee28b8fc98
MD5 SHA1 SHA512

Submit Download

shadow-lr.png

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\shared\shadow-lr.png
Size 135B
SHA256 b505740166ed0f6e989b89ef4b93ccf2e40054f639f7d5b942a970dd705f3487
MD5 986270d8ab4330fa7499dc33ed135598
SHA1 5c89b09a00ddcd17f3d7a9fe1a880aa04cebeedc
SHA512 d7e20d20af485fdec7e27f280ce1ac24c0674e03d9447b22abeff0c1f186e8ce57b27adf3531ae76838b95f76c9fb73d37543cddebbdf3bb888d3cba029b1405
MD5 SHA1 SHA512

Submit Download

ne-handle.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\sizer\ne-handle.gif
Size 128B
SHA256 1e0afccdd8896181cfefc31faddd79255de0b561e85a5929b7bdbc0abd9da034
MD5 fbd3e5f90df02cc9084ba43a40dafb60
SHA1 7c506a45a8e51604ab63cd9a0ec213ff806b6ef0
SHA512 376d64ac65e449512f3cc3abb6fd1d585ebed43f84233ce6d0da718fd368f059db8a6a8d2e01e65f3ecacb11854707e44cb01b182cdeb79bf3422dc99000c418
MD5 SHA1 SHA512

Submit Download

nw-handle.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\sizer\nw-handle.gif
Size 114B
SHA256 ac751bc3c5e1dfc6dc785624c0cecca40158b2aa8fb424704afafec82f112ed8
MD5 b1cbf1aa7df6305701152f0708f2a5b2
SHA1 d9528450ab14b2a5d0a94946e8925efee7830a5e
SHA512 13881c6156a16247dc3c4ab6b7021b88bc6a7ee5e88f82c838c7038668ebe12a17f9d90196f16c9f750706f568c687431124f313cc5e12f9b0756e82da15b6bc
MD5 SHA1 SHA512

Submit Download

se-handle.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\sizer\se-handle.gif
Size 114B
SHA256 fea18b22529de5635d478e3ff2e2e89b36053f0f1f5eff702d0e4b2e74402613
MD5 a71d1f8a7d1d1e554bac77d838c1e1d2
SHA1 aec8c30647df2bc2c3691f9342034129663c9d41
SHA512 e183c3a77b731298670ed6f72ee12015b3e79693b76d042589cb51c75e5ac7d73c22b0e4eee967778711a65f944c14262e0d5e59018908af6a5f92d690fc72e9
MD5 SHA1 SHA512

Submit Download

square.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\sizer\square.gif
Size 123B
SHA256 17a8890dba62fd5b63b3c671d64af83c5f92404e7e644bd0c8e747d57529060c
MD5 0ce14318c0a8643d11e723f2c95b3cb1
SHA1 047c804b2ddd12804b35a18cd1cacf9a2a27be97
SHA512 95a28642428805cf29ed9e2202f29c4249cd48bbad6f68d685ce2e46b9db8d1ef510c7cbad294f515c386748c5ffef63b880391bb3c64846a217fd736dfa8c59
MD5 SHA1 SHA512

Submit Download

sw-handle.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\sizer\sw-handle.gif
Size 116B
SHA256 4691c5081b99dc0eaea20fcb5e78995b4e892abbac2dced120d58e7732b2f85b
MD5 7e8854d3f963767ccbafd3e4fb4f4a26
SHA1 6e624f69a0caf7a66c31ca3e1af3527b16e52afa
SHA512 57dcda8144392445456362571e655a2bda48dbeb980ded212ba4db4eb31c10a77386cbcbf08c550231b0b6fc8f0741091646c88e1173a731f71d85f4a01761b7
MD5 SHA1 SHA512

Submit Download

slider-bg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\slider\slider-bg.gif
Size 139B
SHA256 045a31d6a8102617f3b7acd8e068c914bf86125f6284213cce00d6c9f7cdf3b8
MD5 f45859c2fafee9462a7df7d47e268014
SHA1 d698261d093fc213dde3dc3881a9c9d9762b38bc
SHA512 297c102807e4c4b49b363755f1035bf9123594f83e338d832ff0989bce2caa4dbdd75b420ba9bf1af8d10e88d74c80a18cbc74693ebc5e9833b77ba9d2c9ca81
MD5 SHA1 SHA512

Submit Download

slider-v-bg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\slider\slider-v-bg.gif
Size 145B
SHA256 31fef9ec7e44a28fe75adabab7f5d47b5a6cf9e64d4b9f51593db2de616846d1
MD5 a5cb3e8daf98f9485bf8b09f41134a73
SHA1 cf330488df2a7758e819a433aa21f4a21d0e555b
SHA512 84d433347f631cb171aad7d1d536abee568cf88ed94c52963d2510d09a874489ba2a95135ec815aca6895f1aed07170c3f1f984d9f52f3e844bcc324ffc8524c
MD5 SHA1 SHA512

Submit Download

tab-default-bottom-active-fbg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tab\tab-default-bottom-active-fbg.gif
Size 146B
SHA256 f642771d1d6e2187840a4fae1bd5ce103cec857d575055a74fb9acfa4c48ddf1
MD5 6fb141ff340f1fe21c6db331496c651c
SHA1 67e4635586e70ff74e42cc2930eeeec1ea123a26
SHA512 8038079e31e57cfbe4804b0c8db60c53c8aaefa78ee47c5b01f61fcd5f1c2360032ebbeb9c421a8a50ed675110763bfd967e1ebe508f8a7eb07dbebdf2c9724e
MD5 SHA1 SHA512

Submit Download

tab-default-bottom-disabled-fbg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tab\tab-default-bottom-disabled-fbg.gif
Size 119B
SHA256 c43a731e51c98b7a90f9d5f6d35713a80ea815028a63219f44316c90a5139f9a
MD5 672b4de08b847dfb1bc28d57a9644c4e
SHA1 af94708d35a9a92496ee5e26080d0f16ddfc625a
SHA512 3c1cd4942dc682de6f5766f93dfd4fd13cda19442d086b08bcb43c2e75140455cf795103c46b9cbefdb6d4f46b311c87f7b1b16d68151527d24392d649c6878e
MD5 SHA1 SHA512

Submit Download

tab-default-bottom-fbg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tab\tab-default-bottom-fbg.gif
Size 145B
SHA256 f1dafa3d78f308fcc08c02dffe5b737cc9c8769f3ed67d549b4e1d7595ef6688
MD5 b5d131b9354a9e9259464b7d780eb38e
SHA1 d192cb26cc9d846df7a345e3017fc787f05d3052
SHA512 3f6b640640d76e6b2d87e15951d2fb14ded58003065c542eae148a292a2ec41382bc9b5256490759e07bc75083d0cce5aeced58a43fefca9ed625644b9f7d7f4
MD5 SHA1 SHA512

Submit Download

tab-default-top-active-fbg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tab\tab-default-top-active-fbg.gif
Size 146B
SHA256 0e368a70f2003a4883988e4fc747df7c19043de78937e80ed0b2dda76c7dfb98
MD5 4a2a4b2244624382df56c1f5cff15e16
SHA1 0712032feaba4e5f87e5fd8244ab3c9f341e56b0
SHA512 99f3db17e5794f417164733ffc3fd5a25e2f4ae9f351863c722766c59cc69b8d572d8c0aba744a758548f861accb0733a5d5c3be8a73890c5443cb5ea18b349d
MD5 SHA1 SHA512

Submit Download

tab-default-top-disabled-fbg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tab\tab-default-top-disabled-fbg.gif
Size 119B
SHA256 c42965e8d04fa91e7d947d478707f4f564e825699817c54c570ae758456eee27
MD5 6b00e72d5760dd37590ded3ed235f466
SHA1 c896273f4552c39a8fba16c79887478a5a20ec78
SHA512 8143743ef70f265b4c977e555c134c3c1934d015b42ebcf8ecc9bbba92bdf6edcc64198e34a6defb5af1186edb0d1269e1eae39cf0c682353e1a5edf9dbc1902
MD5 SHA1 SHA512

Submit Download

tab-default-top-fbg.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tab\tab-default-top-fbg.gif
Size 145B
SHA256 410b8079a8b9ba129e2b4b079d96fe4c1ee23a00c9549a01c00c45275d6f1f15
MD5 2dbbfff84dbad6e64217ca146ad22707
SHA1 8e45037a725dbf3c93d13d19d10e80f6a9e18517
SHA512 93297ea702b05e2a7d52c51341b313505bb08b960a2199f3b556b0d6c3dee00a2bfc5df8856184a5b886de9d9b2d296989922e591375d89ec40ee6c5091582c2
MD5 SHA1 SHA512

Submit Download

tip-default-corners.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tip\tip-default-corners.gif
Size 133B
SHA256 c0cf5d09679ef7c1770c0c7479b5a362a6cf0b668790de9f54d6a720aef9f9c8
MD5 ec65b310c5e634fb7471360095c7cadb
SHA1 bf7df36197305795988d384d39c0699390dd0f2d
SHA512 92662d28793368c78fde42303e22aafaf89058ec269a58870c24cdaad50ae4979e74164bfd425ecbf16403818d113f5be92b67dc66d4962d3dcd454ead7dcbd4
MD5 SHA1 SHA512

Submit Download

tip-default-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tip\tip-default-sides.gif
Size 99B
SHA256 f2382ffc3926050f5e485ad36a643b3efb0cf19c3129360c6453b6276633dfcc
MD5 76db9a84b4c83cb412242f6688824f85
SHA1 b2b959d905b33c0e759cddb892481f7ed3b0fd17
SHA512 043fb027bc890ecaaf23cb0471fc32ace5a8a631898782df1d98de4b3a9ce43595ba7c62cc6ef8de02a7158fcdf7d2bf9b3c218f3277288a1773751ee12a9801
MD5 SHA1 SHA512

Submit Download

tip-form-invalid-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tip\tip-form-invalid-sides.gif
Size 123B
SHA256 7fef0e7e52c0dd73eef9c54640c53778f80aa429e86d3623c78eec14b188c33f
MD5 cc6cac49ac05106357f276cd8f3bc9b2
SHA1 a3a472e6eec14ad10bfd241650e7e20704f44452
SHA512 552a539708dd578339f16512c089ec4f44d2b5c59371a8459b38411269f3a2b3a02893f90c5e7f169491f8c6bda487d38cecc4ffba92e133a0e9c62dc18b8485
MD5 SHA1 SHA512

Submit Download

elbow-line.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tree\elbow-line.gif
Size 72B
SHA256 6778e2460be76c06308cbefa6af9a5bbf2bfa69b6b93a2ee67b3e8dee7b5ca6d
MD5 765c70e58be8064da7ce8c01afb1f6c3
SHA1 c330b11966c9a5f2da16840622e7e228439f15b4
SHA512 62f28073c08d4c89edb75c48090a44ba50f70b517880a5b4a32469ea5489c42c5e21508d6881ab8a1dc9bbf4f209f0561ddda70c7c403d3b8434a54b3dda000e
MD5 SHA1 SHA512

Submit Download

elbow.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tree\elbow.gif
Size 73B
SHA256 bfffef0698380db74faf7b6c4e6eae133000e92473bd94595bdb3a8e6f73348a
MD5 53321708a4948539bb8b4c8efeae39c7
SHA1 784b3f929c5d4e653aaf849c18f928f68a551749
SHA512 e3cee586059ae26d7eb9c10625c398c9ef95ec80658568fb1af0d82f13c5006c4994294c32f43095aaa8618e97874a679aea74a3f79ef993d4195d2ed149e1b3
MD5 SHA1 SHA512

Submit Download

window-header-default-collapsed-bottom-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\window-header\window-header-default-collapsed-bottom-sides.gif
Size 99B
SHA256 e782110640aa72052242f7d45b843da93226e8d7792e20e4081d75c416ecf912
MD5 c1d56142f7fb9401df3fc91faf5b7fa4
SHA1 e2749b3e6fc5488f6e69a1f05911582fdc22616c
SHA512 be03d11565c5f22c8c240db7c2b5dc4cf0a84ca327b8128df7f9c61d8e89d1808370d9b50db2b99fa5ff94f4def54dd1df6cc7cb14a8f647fd6dff301e3557ce
MD5 SHA1 SHA512

Submit Download

window-header-default-top-sides.gif

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\window-header\window-header-default-top-sides.gif
Size 87B
SHA256 c82004a718d496a9b7f59fefb6c91db0e8f5c861f25876024643503018acf931
MD5 d89e273d74224fa8ca532039fc05d75f
SHA1 a921424afc2aaf7c7b6e9d036632e222388eafc0
SHA512 55bad5afd0f85a30ac46c2afd5bffd5b69efed95789b879897a8c3ea2b8825c7aba17c6fbc746a86d5484189fd8e0327c758ba15bb8c477a86fd2390c09909b1
MD5 SHA1 SHA512

Submit Download

stringTable.zdct

Path C:\Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\resources\Dictionary\en_US\stringTable.zdct
Size 1KB
SHA256 47f79c34d5f48ae21b0c7a0e03d0a34c9cf882c7d5afd905cce8e074496cd735
MD5 3314d80c906abaa44d0e73c03f7a9536
SHA1 999bc8ca56632d1b6b762ec14c3fb5c4bb200b4e
SHA512 e9d39b36bcc7bce0f151624218b1841a8c6dce80d3a34665e2ff82335d200204b5dd19514144723d28af0d91a3e8a5ff7b2214a62c047b08d69b9d75b62eec52
MD5 SHA1 SHA512

Submit Download

Fhowtu

Path C:\Users\Admin\AppData\Local\Temp\Fhowtu
Size 46KB
SHA256 961fc9bf866c5b58401d3c91735f9a7b7b4fc93c94038c504c965491f622b52b
MD5 b13fcb3223116f6eec60be9143cae98b
SHA1 9a9eb6da6d8e008a51e6ce6212c49bfbe7cb3c88
SHA512 89d72b893acd2ec537b3c3deffcc71d1ce02211f9f5b931c561625ee7162052b511e46d4b4596c0a715e1c992310f2536ebdd512db400eeab23c8960ec4d312d
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

f76d8c2.msi

Path C:\Windows\Installer\f76d8c2.msi
Size 14.0MB
SHA256 cdfcffceff42c4134d2e41f0bde414abe7a4b7e0480c8f4294ebca0b4ab9af24
MD5 5b4e1ae1818b630dae4535ec96807462
SHA1 d1ad62a4b640fef1835a4d4dd54bfb4d6ddaaffc
SHA512 22bb5ef7eb5ae3f95cd166ff5915db5d97d013a45addf46128651caf4e023dada7eb6e157bbfd8a261b882b24bf67909014b8e9581a7353c214992f0d8036b79
SSDEEP 393216:SOpBXH8JSvAg6RGOpkr4wlkOESYp4uY1N:rpBXH8JWl6EOpkUwO7Y1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

JCopy2.dll

Path \Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\JCopy2.dll
Size 8.7MB
SHA256 e34e5dab882807a35e7d8809cdf01c9122b90110c0bb8ab747b0379ce40ba6a9
MD5 7550d8b4e87ae6b5afa0e2526f6e2f58
SHA1 73647c4fdd614a4bf545c9d30e01007afde65a86
SHA512 926fa93614651da31d3bcd1d0626a6e63771f8ecf2d84f7a43ffe47198450eef352981abc78d9b333b3c962b93ed3cc7f7054bfccdb24c59ed371e7281525612
SSDEEP 196608:RRCnuGyyUmUSSBWqjr8N98TcJgl1xKfDBqBDDTqG9sqAl92RZeMdVK:KnEyZoWAr8N98TcJgl1xKfD0BDD9zIQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp90.dll

Path \Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcp90.dll
Size 552KB
SHA256 f5b6ed22ff07743402a2c90f469fa91f46fba8bf35b55312a5aaf26a448a9064
MD5 30afaf23c37c439c2c83ec6518287076
SHA1 2ece38dc601315f4d05d034f66ad1d77f2845c00
SHA512 0f87a1c55d54dccf5007a82d51ded65be9ee5619e0c82bd94b53c7d10b33237cd39e5b481dad00698bafdeac2687a7ff920ee5c5900468b5c0c93b996e803e1d
SSDEEP 12288:2UmYoJC//83zMHZg7/yToyvYXO84hUgiW6QR7t5C3Ooc8SHkC2eR1:2UmYoO83W0y8yeO8L3Ooc8SHkC2eX
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr90.dll

Path \Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\Microsoft.VC90.CRT\msvcr90.dll
Size 637KB
SHA256 1eab5f18a5733d746e681bc3d60175f8fca219dc1f94a7bb19db9e4c2c36224a
MD5 8d8325e8cdc31ffd3ba95e69d9a5bf91
SHA1 4bbe261d907e58a8487c27d2dc007ae98f1d3d2c
SHA512 49ba10c7ec86cff01568520c2092a993184df0b667a8bd197bc6cbe5918575028c1cd127e7d911344e5a88133827cda99aa3c1a331f26f809b04395da599c6b5
SSDEEP 12288:Zhr4UCeaHTA80gIZ4BgmOEGVN9vtI0E5uO9FAOu8axTFmRyy5:9a2g5gmO791I0E5uO9FANpmRyy5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsAccessBridge-64.dll

Path \Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\WindowsAccessBridge-64.dll
Size 636KB
SHA256 aef2ea4d2a9990173b12de2df9ecf2b6d2cb7d52f2ad6052dd4d8de4c63e8e4e
MD5 4b163d012b0014f106592f4bf93a61a6
SHA1 7d1aa05e10ccdcc602e031487db7cc02f257de9d
SHA512 a1ed82b0429ea236129b0487169b2bda81b1477e3e42e9381cebc2f3d58c2d53af337b31af04bde890680e7f5c8b64439e2a6c0427442b2f15c5e9099db16728
SSDEEP 12288:P5S1CuCjIWO45fg73JGApMAzf2F2zT8uaY3JcxZ815EqvvqqD:P01CuCjxO4+TJ3OAzf02zT8uaY3JcjWf
MD5 SHA1 SHA512 SSDEEP

Submit Download

adbeape.dll

Path \Users\Admin\AppData\Local\Programs\EasyDuplicateFinder\adbeape.dll
Size 27KB
SHA256 86aa8a48abfdca7ed74b3ea0a93dba8444a270cf6a3a2a5552e39cc7f29ead61
MD5 9acad71726c880d5a4285bd912f41baa
SHA1 345244280f447c9d5a86fab6fd4274f0a35a90a8
SHA512 70a15a3a13371138d6f4f91d81d936cb7dff72059c935ed8b9a5f79647bf1efe826fd0f21ac8a60a5576b5f07c27563637a9ff11ec2ae548d6b8081b6a9199df
SSDEEP 384:bXCU4AGUBOn4Q9yN8xKQ9QS1jMtO6yX00OpxSyaOyD8ywCOEl:7CUbGBv9ymKLSqtOnHcaOyYlE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1096-750-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-774-0x0000000063280000-0x00000000634BE000-memory.dmp

Download

memory/1096-748-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-763-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-764-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-767-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-766-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-772-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-773-0x0000000006E90000-0x0000000007427000-memory.dmp

Download

memory/1096-689-0x0000000073D90000-0x0000000073E56000-memory.dmp

Download

memory/1096-775-0x000000006E600000-0x000000006E69D000-memory.dmp

Download

memory/1096-777-0x0000000005C10000-0x000000000619C000-memory.dmp

Download

memory/1096-776-0x0000000005C10000-0x000000000619C000-memory.dmp

Download

memory/1096-778-0x0000000005C10000-0x000000000619C000-memory.dmp

Download

memory/1096-779-0x0000000005C10000-0x000000000619C000-memory.dmp

Download

memory/1096-780-0x0000000005C10000-0x000000000619C000-memory.dmp

Download

memory/1096-696-0x0000000003320000-0x000000000340B000-memory.dmp

Download

memory/1096-811-0x0000000073D90000-0x0000000073E56000-memory.dmp

Download

memory/1096-812-0x0000000003320000-0x000000000340B000-memory.dmp

Download