b4d2c1fa121ca78268304fb8ddc6832af6fad95d857ea59c2ce392154b0585be

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
duckier.exe
Size 10.2MB
Sample260529-hrsryset8n
SHA256 b4d2c1fa121ca78268304fb8ddc6832af6fad95d857ea59c2ce392154b0585be
MD5 ca297693668277e3cb25985378689954
SHA1 b3809abf42ff3e636d73582622e79a15ca361b40
SHA512 c22c3a86261294611276ab9f84b476bf9a3d0ab16247291f391ccc75b6679cd55c3013dec09059f9dc028c6d4ea6060ccf98f9cc871a8ce9ee386bdf3f140f75
SSDEEP 196608:VENzqrUwSGAatt0RSIwNOGNHllKod8vrOsBHutEFOz04VuT8/fyzarh9a38:VLMat2cIwzNlc28qSOtxcQiW1Ms
TLSH
T103B6338707A18181C8CC6571DD67FED3DB4004A1BD893EE633D9760ABE22AE6CD5631E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\wireguard.sys	DrvInst.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2228	netsh.exe
3692	netsh.exe
4780	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
232	duckiervpn-daemon.exe
4520	Duckier.exe
4920	Duckier.exe

Loads dropped DLL 16 IoCs

pid	Process
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
652	duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4920	Duckier.exe
4920	Duckier.exe
232	duckiervpn-daemon.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Duckier = "C:\\Program Files\\Duckier\\Duckier.exe "	Duckier.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Duckier.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
416	powershell.exe
5044	powershell.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\duckier-daemon.pid	duckiervpn-daemon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\SETE451.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\SETE462.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f\wireguard.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f\wireguard.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\wireguard.enc	duckiervpn-daemon.exe
File created	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\SETE450.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\wireguard.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\wireguard.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\wireguard.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f\wireguard.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f\wireguard.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\duckier-daemon.lock	duckiervpn-daemon.exe
File opened for modification	C:\Windows\system32\daemon.key	duckiervpn-daemon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\SETE450.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\SETE451.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}\SETE462.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{19d1ab80-6ded-474d-9ca5-feae12b6e8d7}	DrvInst.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\Duckier\lang\RU.json	duckier.exe
File created	C:\Program Files\Duckier\lang\ZH.json	duckier.exe
File created	C:\Program Files\Duckier\128x128.png	duckier.exe
File created	C:\Program Files\Duckier\uninstall.exe	duckier.exe
File created	C:\Program Files\Duckier\lang\GR.json	duckier.exe
File created	C:\Program Files\Duckier\lang\PL.json	duckier.exe
File created	C:\Program Files\Duckier\wireguard.dll	duckier.exe
File created	C:\Program Files\Duckier\duckiervpn-daemon.exe	duckier.exe
File created	C:\Program Files\Duckier\Duckier.exe	duckier.exe
File created	C:\Program Files\Duckier\libcrypto-3-x64.dll	duckier.exe
File created	C:\Program Files\Duckier\lang\DE.json	duckier.exe
File created	C:\Program Files\Duckier\lang\EN.json	duckier.exe
File created	C:\Program Files\Duckier\lang\FR.json	duckier.exe
File created	C:\Program Files\Duckier\lang\IT.json	duckier.exe
File created	C:\Program Files\Duckier\lang\NL.json	duckier.exe
File created	C:\Program Files\Duckier\lang\SE.json	duckier.exe
File created	C:\Program Files\Duckier\lang\TR.json	duckier.exe
File created	C:\Program Files\Duckier\libssl-3-x64.dll	duckier.exe
File created	C:\Program Files\Duckier\lang\ES.json	duckier.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	duckiervpn-daemon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3816	sc.exe
3008	sc.exe
2164	sc.exe
4232	sc.exe
4672	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duckier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2588	chrome.exe

Checks SCSI registry key(s) 3 TTPs 50 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	duckiervpn-daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	duckiervpn-daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	duckiervpn-daemon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	duckiervpn-daemon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	duckiervpn-daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	duckiervpn-daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	duckiervpn-daemon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	duckiervpn-daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	duckiervpn-daemon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	duckiervpn-daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	duckiervpn-daemon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	duckiervpn-daemon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2372	TaskKill.exe
1508	TaskKill.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245115822095536"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier	duckier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier\shell\open	duckier.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\duckier	duckier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier\shell	duckier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier\shell\open\command	duckier.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\dvpn	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn\ = "URL:com.duckier.app protocol"	duckier.exe
Key created	\REGISTRY\MACHINE\Software\Classes\dvpn\DefaultIcon	duckier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn\shell	duckier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn\shell\open	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier\shell\open\command\ = "\"C:\\Program Files\\Duckier\\Duckier.exe\" \"%1\""	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn\URL Protocol	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn\DefaultIcon\ = "\"C:\\Program Files\\Duckier\\Duckier.exe\",0"	duckier.exe
Key created	\REGISTRY\MACHINE\Software\Classes\dvpn\shell\open\command	duckier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn\shell\open\command	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier\URL Protocol	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier\ = "URL:com.duckier.app protocol"	duckier.exe
Key created	\REGISTRY\MACHINE\Software\Classes\duckier\DefaultIcon	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\duckier\DefaultIcon\ = "\"C:\\Program Files\\Duckier\\Duckier.exe\",0"	duckier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn	duckier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dvpn\shell\open\command\ = "\"C:\\Program Files\\Duckier\\Duckier.exe\" \"%1\""	duckier.exe
Key created	\REGISTRY\MACHINE\Software\Classes\duckier\shell\open\command	duckier.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
652	duckier.exe
652	duckier.exe
5044	powershell.exe
5044	powershell.exe
416	powershell.exe
416	powershell.exe
416	powershell.exe
5044	powershell.exe
232	duckiervpn-daemon.exe
3992	chrome.exe
3992	chrome.exe
5408	msedgewebview2.exe
5408	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
652	duckier.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1404	msedgewebview2.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	TaskKill.exe
Token: SeDebugPrivilege	1508	TaskKill.exe
Token: SeImpersonatePrivilege	652	duckier.exe
Token: SeImpersonatePrivilege	652	duckier.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeIncreaseQuotaPrivilege	5044	powershell.exe
Token: SeSecurityPrivilege	5044	powershell.exe
Token: SeTakeOwnershipPrivilege	5044	powershell.exe
Token: SeLoadDriverPrivilege	5044	powershell.exe
Token: SeSystemProfilePrivilege	5044	powershell.exe
Token: SeSystemtimePrivilege	5044	powershell.exe
Token: SeProfSingleProcessPrivilege	5044	powershell.exe
Token: SeIncBasePriorityPrivilege	5044	powershell.exe
Token: SeCreatePagefilePrivilege	5044	powershell.exe
Token: SeBackupPrivilege	5044	powershell.exe
Token: SeRestorePrivilege	5044	powershell.exe
Token: SeShutdownPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeSystemEnvironmentPrivilege	5044	powershell.exe
Token: SeRemoteShutdownPrivilege	5044	powershell.exe
Token: SeUndockPrivilege	5044	powershell.exe
Token: SeManageVolumePrivilege	5044	powershell.exe
Token: 33	5044	powershell.exe
Token: 34	5044	powershell.exe
Token: 35	5044	powershell.exe
Token: 36	5044	powershell.exe
Token: SeIncreaseQuotaPrivilege	416	powershell.exe
Token: SeSecurityPrivilege	416	powershell.exe
Token: SeTakeOwnershipPrivilege	416	powershell.exe
Token: SeLoadDriverPrivilege	416	powershell.exe
Token: SeSystemProfilePrivilege	416	powershell.exe
Token: SeSystemtimePrivilege	416	powershell.exe
Token: SeProfSingleProcessPrivilege	416	powershell.exe
Token: SeIncBasePriorityPrivilege	416	powershell.exe
Token: SeCreatePagefilePrivilege	416	powershell.exe
Token: SeBackupPrivilege	416	powershell.exe
Token: SeRestorePrivilege	416	powershell.exe
Token: SeShutdownPrivilege	416	powershell.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeSystemEnvironmentPrivilege	416	powershell.exe
Token: SeRemoteShutdownPrivilege	416	powershell.exe
Token: SeUndockPrivilege	416	powershell.exe
Token: SeManageVolumePrivilege	416	powershell.exe
Token: 33	416	powershell.exe
Token: 34	416	powershell.exe
Token: 35	416	powershell.exe
Token: 36	416	powershell.exe
Token: SeAuditPrivilege	2396	svchost.exe
Token: SeSecurityPrivilege	2396	svchost.exe
Token: SeRestorePrivilege	940	DrvInst.exe
Token: SeBackupPrivilege	940	DrvInst.exe
Token: SeLoadDriverPrivilege	940	DrvInst.exe
Token: SeLoadDriverPrivilege	940	DrvInst.exe
Token: SeLoadDriverPrivilege	940	DrvInst.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe
Token: SeCreatePagefilePrivilege	3992	chrome.exe
Token: SeShutdownPrivilege	3992	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
4520	Duckier.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
4520	Duckier.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe
3992	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2372	652	duckier.exe	83
PID 652 wrote to memory of 1508	652	duckier.exe	86
PID 652 wrote to memory of 3008	652	duckier.exe	88
PID 652 wrote to memory of 2164	652	duckier.exe	90
PID 652 wrote to memory of 2824	652	duckier.exe	92
PID 2824 wrote to memory of 4232	2824	cmd.exe	94
PID 2824 wrote to memory of 4672	2824	cmd.exe	95
PID 652 wrote to memory of 3816	652	duckier.exe	96
PID 4520 wrote to memory of 1404	4520	Duckier.exe	102
PID 1404 wrote to memory of 4816	1404	msedgewebview2.exe	103
PID 1404 wrote to memory of 2784	1404	msedgewebview2.exe	106
PID 1404 wrote to memory of 2784	1404	msedgewebview2.exe	106
PID 1404 wrote to memory of 2784	1404	msedgewebview2.exe	106
PID 1404 wrote to memory of 3876	1404	msedgewebview2.exe	107
PID 1404 wrote to memory of 2944	1404	msedgewebview2.exe	108
PID 1404 wrote to memory of 2944	1404	msedgewebview2.exe	108
PID 1404 wrote to memory of 5092	1404	msedgewebview2.exe	109
PID 1404 wrote to memory of 5092	1404	msedgewebview2.exe	109
PID 1404 wrote to memory of 5092	1404	msedgewebview2.exe	109
PID 4520 wrote to memory of 5044	4520	Duckier.exe	112
PID 4520 wrote to memory of 416	4520	Duckier.exe	114
PID 4520 wrote to memory of 3444	4520	Duckier.exe	115
PID 4520 wrote to memory of 4356	4520	Duckier.exe	117
PID 2396 wrote to memory of 4944	2396	svchost.exe	121
PID 2396 wrote to memory of 940	2396	svchost.exe	123
PID 232 wrote to memory of 2588	232	duckiervpn-daemon.exe	125
PID 232 wrote to memory of 4780	232	duckiervpn-daemon.exe	128
PID 232 wrote to memory of 2228	232	duckiervpn-daemon.exe	130
PID 232 wrote to memory of 3692	232	duckiervpn-daemon.exe	132
PID 3992 wrote to memory of 1180	3992	chrome.exe	135
PID 3992 wrote to memory of 1520	3992	chrome.exe	136
PID 3992 wrote to memory of 1520	3992	chrome.exe	136
PID 3992 wrote to memory of 2588	3992	chrome.exe	137
PID 3992 wrote to memory of 3692	3992	chrome.exe	138
PID 3992 wrote to memory of 3692	3992	chrome.exe	138
PID 3992 wrote to memory of 4960	3992	chrome.exe	140
PID 3992 wrote to memory of 3400	3992	chrome.exe	141
PID 3992 wrote to memory of 4960	3992	chrome.exe	140
PID 3992 wrote to memory of 3400	3992	chrome.exe	141
PID 3992 wrote to memory of 696	3992	chrome.exe	142
PID 3992 wrote to memory of 696	3992	chrome.exe	142
PID 3992 wrote to memory of 5344	3992	chrome.exe	144
PID 3992 wrote to memory of 5344	3992	chrome.exe	144
PID 3992 wrote to memory of 5700	3992	chrome.exe	145
PID 3992 wrote to memory of 6088	3992	chrome.exe	148
PID 3992 wrote to memory of 6088	3992	chrome.exe	148
PID 3992 wrote to memory of 5684	3992	chrome.exe	149
PID 3992 wrote to memory of 5684	3992	chrome.exe	149
PID 3992 wrote to memory of 3312	3992	chrome.exe	150
PID 3992 wrote to memory of 4232	3992	chrome.exe	151
PID 3992 wrote to memory of 5900	3992	chrome.exe	152
PID 1404 wrote to memory of 5408	1404	msedgewebview2.exe	153

C:\Users\Admin\AppData\Local\Temp\duckier.exe
"C:\Users\Admin\AppData\Local\Temp\duckier.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\TaskKill.exe
  TaskKill /FI "WINDOWTITLE eq Duckier" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\SysWOW64\TaskKill.exe
  TaskKill /IM duckiervpn-daemon.exe /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\system32\sc.exe" stop DuckierVpnDaemon
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3008
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\system32\sc.exe" delete DuckierVpnDaemon
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\duckier-svc.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\sc.exe
    sc create DuckierVpnDaemon binPath= "C:\Program Files\Duckier\duckiervpn-daemon.exe --service" start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4232
- - C:\Windows\SysWOW64\sc.exe
    sc failure DuckierVpnDaemon reset= 86400 actions= restart/5000/restart/10000/restart/30000
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4672
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\system32\sc.exe" start DuckierVpnDaemon
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3816
- C:\Program Files\Duckier\Duckier.exe
  "C:\Program Files\Duckier\Duckier.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Duckier.exe --webview-exe-version=2.0.15 --user-data-dir="C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4520.2408.5229062386403100227
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ff963eab078,0x7ff963eab084,0x7ff963eab090
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView" --webview-exe-name=Duckier.exe --webview-exe-version=2.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1644,i,1888193940139082078,8459290792023907061,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView" --webview-exe-name=Duckier.exe --webview-exe-version=2.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1356,i,1888193940139082078,8459290792023907061,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView" --webview-exe-name=Duckier.exe --webview-exe-version=2.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,1888193940139082078,8459290792023907061,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView" --webview-exe-name=Duckier.exe --webview-exe-version=2.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,1888193940139082078,8459290792023907061,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView" --webview-exe-name=Duckier.exe --webview-exe-version=2.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4452,i,1888193940139082078,8459290792023907061,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName Win32_ComputerSystemProduct).UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName Win32_ComputerSystemProduct).UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    PID:3444
- - C:\Windows\system32\cmd.exe
    "cmd" /C ver
    3⤵
    PID:4356

C:\Program Files\Duckier\duckiervpn-daemon.exe
"C:\Program Files\Duckier\duckiervpn-daemon.exe" --service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\system32\netsh.exe
  "netsh" interface ip set dns name=wg0 static 166.0.12.81
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2588
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4780
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2228
- C:\Windows\system32\netsh.exe
  "netsh" advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3692

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Program Files\Duckier\Duckier.exe
"C:\Program Files\Duckier\Duckier.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Windows\Temp\3f5c988c4e5d063ee1f5b9e5c2815f749d74098b670a87b8f3c7afcf3ec48f40\wireguard.inf" "9" "4c0863753" "0000000000000154" "Service-0x0-3e7$\Default" "0000000000000168" "208" "C:\Windows\Temp\3f5c988c4e5d063ee1f5b9e5c2815f749d74098b670a87b8f3c7afcf3ec48f40"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4944
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "SWD\WireGuard\{55BB9B61-B9CE-F57D-FB9E-B1B0459C1E00}" "" "" "423288867" "0000000000000000" "2c22"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96519c728,0x7ff96519c734,0x7ff96519c740
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,10588529565352643294,285911162038140209,262144 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,14378800438790479547,8090552174369191791,524288 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,14761959107887631150,13725026156734944487,524288 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,1378368335108610031,2820559621707879069,2097152 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,9432788039350380320,17708901151531681480,2097152 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,14483610654365025436,11087720895539726978,2097152 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:9
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,1632599077997591467,15943288633897294366,2097152 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,6950673946959171121,318318215199314439,524288 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5892,i,13062933272553130453,8193084664911173429,2097152 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3268,i,14242820872063494955,1388225583893267458,2097152 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,11163763994695582429,11266705932334824270,524288 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,4290087034195957367,9227495521526493449,524288 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,16769310142921360093,800485088022403467,524288 --field-trial-handle=1944,i,6563598817023250645,1664943102208939277,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:14
  2⤵
  PID:5900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Duckier.exe

Path C:\Program Files\Duckier\Duckier.exe
Size 10.7MB
SHA256 a6d93fd9dbc0f5dbecd30521aaadb2d5c055283b86d800ecd177d00626056abc
MD5 9186144cfc3150d77544ac5b445dcc15
SHA1 c44a3bd3cf1fb662ccdf3b9b219ef8abaceb9dc6
SHA512 3095c8154c13e5b60e12b8a5bd86827ff3b7a5e20eb364d88bdbd70ec802a9676fefc56815052e02d48b6df6f5f31ff11721d632519b8d01af40d8e52b56f438
SSDEEP 98304:+mnOrtjzrEnuOqHsf8A0U3JYAMjPuH4TVygS6FMFF8aM2BQyeZJb2YgTyNj7DGoz:ChWqCNqGFZdBjuNhg8HjkHDqlxx
TLSH
T143B68E03F69181E8C0AEC578C35BA633EB32BC8D4525B26F5BE44B112E26F506F1D769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

duckiervpn-daemon.exe

Path C:\Program Files\Duckier\duckiervpn-daemon.exe
Size 4.3MB
SHA256 c36e275938367cd8a512cfb6904695a985fed72585d55ec7cea4c7932c72213e
MD5 14ce2f967fa9e3416ddcfb865441b0ae
SHA1 95cbdce6a358a6e7ee8b4f0213768ad386e0f593
SHA512 3ab6ffd3d4fe07608856048b7d9e1fbb7fe527af3532c2e90735c72fb6876957fe443fa18e417966f65df2843df57d511c42b5f0e0e7af4ccbf893069a7e0fc7
SSDEEP 49152:y6kAMt4WT72MsBBrrdCtlQsE3VgGxjS2+KcXUIE5eISPX89Vl5BbaRqbLVuBr7cz:BYyORX3IWsTWa04RD69TW+YR
TLSH
T1A0266C03F69581E9C09EC178835A9332AB32FCCD4A2473AF5BD44A212F66F606F5D749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EN.json

Path C:\Program Files\Duckier\lang\EN.json
Size 23KB
SHA256 33f332e1b3e9be9829a67688575cce40e0f9f4f0fdceb4892c2bcc14b9228f02
MD5 6a84bbb7a50229f647d5f61f7236387d
SHA1 6e32fe96c56eee2da7657079991283b9919daae0
SHA512 eae1781aa8875effd8c173991a6434231ca7eed5b0c9d9bc9e83c91ab81ccb5ff8158d0c021c0aa18b97a9b72bb8ff9beed220349203adf29f1a5a75f93d42ba
SSDEEP 384:luRboWAQZ5WFQw2ZzpgIJIDt2Eqm2x5cxfz/66TT2l97/YCFFQC1dM+8pmQu8EBa:lJ/4IDt2EqJc0DaC1dM+eu8Pj
TLSH
T1E3B2C53D8A00107B4AE2424568660B9377215FA70710341A5B7F42AD27BE17F63BBBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RU.json

Path C:\Program Files\Duckier\lang\RU.json
Size 32KB
SHA256 d998db2a5f89adafe6c11d14b49c4c0b7128d6f1233db3418dfb23c81a1d9dab
MD5 d780df6c331e1d0178e8b41490ac4c08
SHA1 4f1c19981f7a53695018049bf1c5c90c927d3ace
SHA512 8fd12c9d862af196d14e9e509c72b8c959110a5f0aeb0767932ea4a72ce7a9e0ec959a5c4879cc11d098a9dac15143a2a55d32a79506efafab4498e5693e9258
SSDEEP 768:RadFU2SZUE3CE6weZIQVMw+gI53GXBXnRPhaI:M/ER6tr+gIEXBXnBhaI
TLSH
T13FE2CA71558921BF12C3A00ADC147E0A39AA0DBF3B6BB3065777392E71FE027827965D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files\Duckier\libcrypto-3-x64.dll
Size 7.0MB
SHA256 fdc835f0320261693e8a542c4cc91d7819967d7e9a850d6b4621b9d5cb180b21
MD5 bd223308c462b1fbcd1b3f86cc1c21de
SHA1 bcef6a6301be28cd39e47b2efd1547408bb63048
SHA512 84ad68b176327def18aa8be1277d32b78fc2f9283a39d92e2a8646904e06fca8459a1493f2ba0c8908c11bc98fe3b3883d2b45b84c93b366fe2203c5f0317004
SSDEEP 98304:hDtGVpsMh+Me+76oBtLI2U0N9J+fp1CPwDvt3uFt0C:R0HsMhP76oBtLIhAjU1CPwDvt3uFt0C
TLSH
T112768BBDA2BC0105E4AA81BDC2875227DB71B91957B013CF596186F81F33BD62B7E780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files\Duckier\libssl-3-x64.dll
Size 1.4MB
SHA256 71c43b620ec4e41b95b73f1c51a32a474f25a9116fa270ab83b1a671336457d9
MD5 6aab054a2e0fb1c96c621ab8ee2ba12c
SHA1 dc23844d5616387dc3ee759a0f836ca70079eedb
SHA512 8e49a94b48f41811fe9a0285dec5f72c2eba3ed3a81f248473f50b2babc4791249869b137a8bb9d771e40dd99b483b591a9434a2421e88050e5bf2bb62c29ec7
SSDEEP 12288:Q2NajFIvLa8ssh8L1/PX6hB49iip/XslqscfInSXSKzxlDDyV:2CvLaGM/f/iilXsc7XSKzxlDDyV
TLSH
T1D6657D6AA7B8019CE5B6C17CC6934B13D2B6F4162370A7DF0A658A381F63BD6173D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wireguard.dll

Path C:\Program Files\Duckier\wireguard.dll
Size 1.5MB
SHA256 b2c5082289c8d212d0cfa3c9da922d9557d44ed5910beb817176401f06f8c0ea
MD5 a7cc1db9dcaa2550ab9bbe451aa490dc
SHA1 bf5bc13d11f3ade5507e22022bc0b7a6303ffd6c
SHA512 4932e92432f2b3f94883b552ebd584ee286efadb29bce5131d7085c8686931a151e3e85ac1338b69f30c631af357f956de7ee50f3bf1e0b3de53f616439b1fd4
SSDEEP 12288:4UenDNpq9bKeKqM7cyOcN7kWCEKI2ExcN7kWOpsr2:4pqFKew1N7VCEvcN7VOaq
TLSH
T1B365BF42B2481B81D99386FCD4D5C536A675BC042B20C9FF1034F2686F73BDEAA7AE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auth_token

Path C:\ProgramData\Duckier\run\auth_token
Size 64B
SHA256 bd553d4bd8838688e780150be2f1904f32fb9d6d41a99a38e2180b39b4aa0b57
MD5 c47ebed402d0f71f382c591655802168
SHA1 5705656e8f42b42916440cb4ef1395063b6ed5db
SHA512 7b92fc4882b1c1e8225eb7b517d839dc02bf024c3c300a5735536a4f81d7c7b9fd32858764382979afec101a1941fe6b8dd9662089c65cd8538f6a41266fc38f
TLSH
T101A002125515EF962842607A939A55649CCE7116436BF84928B617A54066602DB23406
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3290b07dd7416ebbb567f2cc027ea9662bbfdce9de57cf8545bbb4a48fc937a9
MD5 b5b32a4e99eb1d246df1bfc8478998b1
SHA1 3116f87b46e230e49428fbf0b03091aacc0245e1
SHA512 facddadeb8232dfeaf6ecc50ca55911a97850f4720c97fac460f163ffe2b0c95bd17c12771bd79763d36333fc282f402fa55b0fc12246c8079aa66b1d7a9384a
TLSH
T120F0F9A6DC219C7B08FD2B2960A51B47E79013672B81494F3A3C921C4FB193B858A8AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 e6598c1d3e0c46565276438da3c0c85fe4e9d2641efe08ec16abb1c25c755994
MD5 88488d9bcac26ff6b75e5a219cb65df3
SHA1 00835194dda9767667824f63c268e4ade52664d0
SHA512 9daa9ed4ef2ba2cd44aa2c2c4f901aa0449fc4bfdbdd6d2d2119a52cc32e72abd19be3276938e3abbba0117a8609aa0d09f36e324d0ec76df21cf211b04d9aa8
TLSH
T1FCF0DFB460E429C6CBACDDB990E34ED3A811671785A0230AC332F96088631B8B241842
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 858860a56a3655a3781537499b6e0669a64425164795b20e4e34e561e4d2b9d4
MD5 cc3ca3df034bb4bd6e003e059e439e02
SHA1 36baa728ead0ffa65ad1c58fb79bb66a66709512
SHA512 230271979c2d217601f7ddc17443782a428c66c5c1bb8a5c9b6811bf6741d0693c6bf791ccdeca37863fa29d00fd7863f4372523837e3cc1296e4f51b62874dd
TLSH
T15081AEF7C3E8893D890196F8A7152F2BCE690A64431D3D6BC4D4AF4B93F2870D25058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e55c653e30eb657b3342ba6f4e766ddf73f647f0724f84b68beab814dac43901
MD5 5edff08d4d11134e377f5d97ddc6fa7a
SHA1 cd315d81ab50ecc8d8916c61ab451821624ff13e
SHA512 1a65787f6842c3b498d69aadfa55363d04553a828ad7909bf2cbcaf6d4b6190b42b5e1e22593803cf775d3ecfad9814bb55b150edb6bd646253b017ec2ba3c4b
TLSH
T1CF4188B3C7E88A7D890196F4AB152E1FCE2D0E14532D3D5BC8D4AE0B53E18B5D20158E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f73cfee64d1f7985e5d6e0a3b4034ab741b03afd4b38887500e1979621a85535
MD5 84966898e63bfbb9f29f0cc95ffe935b
SHA1 b0dbaa835b69977251548b8fd0534e225dc16537
SHA512 6b2d5c36f6a3f2a83ad844a5e0813ac36b467767a3992e70cb747ef424314075ea09db3f18ebda8a91647357b8c0581845d57bb02f87691fdd5cdab1819b81c2
TLSH
T1A7F059EBDB69B82741BE44AB1F057C0A54B9A83502807CF4CFAA816CD0954E32F1304B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8814f18357eeff1fc152a4c56a988a148935d95a3b170c9267cae9818334bf6a
MD5 e9dab98da6999e34a2edbae950b4ae1d
SHA1 ed593838f13205813d081966f3585c54a1782d62
SHA512 c296b4627de249f2d64292c7f18f7b35b4d01860977708eab84e96d2d711ad7b3fa5ab1348cf68fc8c73bdc8fa0a14ccdd60cb08b91f5c4317f9bc828e11dd26
SSDEEP 192:aRKcBzRZtExbNFv75pAPRp2V80loW98Hsb+WN2rsJ7+z2DceE2y/VyIsnAUgraJ:aRKmzR/UDVUXouw5w2G2ce
TLSH
T12F52B62BB9206ABB5DD7C219F9217727D3F5106125D42D84E6FCCA2C14EBACC621B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b9ec3f8dc8d126bea9467eacf1e80500386a927b3156ff4301b620b33157eaa8
MD5 6aa2c97bce552d9ef090f4927f4b8092
SHA1 f7d672dc4226a03d8942bf9035dd41280cd21e3f
SHA512 a6de6fe6ca498ec4a4d3cb31a3b01540628659b30b8e350d48aed287f658970c25342046e5127c25bf8962d47d2531852c6bb0318610ce9d93f5c7c3325d9284
SSDEEP 192:aRKRZtExqNMiv75pAPRp2A98Hsb+WNnsJd2ceE2y2VyIsnAUgtaJ:aRKR/fVVUXLuwcdx2r8
TLSH
T1FD42C72EBE106A7B5DCBC219F9617763D3F9107125942D84E6FCCA2C14EB9CC221B11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 62fa963d200d938de14fbe9de0a184e1d6cf73d0ea734b6ce1fa366738c0732f
MD5 ecdeaa9061050ce762060baf4816e43d
SHA1 bc7bdcbac730dcad3fa9071a065b99adf76e9bee
SHA512 4e3cc2fbd522fc03016bf083a0a281c648f1f51641fd65740a274f814c841fe6a1835dc3e5e0fa564c573c9a6c3b387126471e02e14a916f25959953d7e99ab7
SSDEEP 192:aRKcBzRZtExbNMiv75pAPRp2Vp0ljW98Hsb+WN2rsJ7+z2kceE2y2VyIsnAUgtaJ:aRKmzR/UVVUXkuw5w2P2r8
TLSH
T1CF52B62BBD206ABB5DD7C219F9217727D3F9106125942D84E6FCCA2C14EB9CC621B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6580b9be38e043e5d2436ff4ae9296f74b369cbea58296d9af5604bd4b1cc474
MD5 64d379491386bdf9d2b82bfed49740e5
SHA1 522dcfd2f4d188bbcad58538c6461f8bbd43b2e9
SHA512 5d58b317ff66bb8f8373e7f5972247e20a553af50c4ad2756a022edf34ee0bb5688a058056e953d457420c82cddb02044d6062aa1788af614d0c7bcf05ddc3bf
SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcSjwxXODuh+ErU37PHG7iK:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17pV
TLSH
T10B72FA67BC4C9E370F94CA8CD9167F4FADF5024A65E9886482FA9C2503D5BCA11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ebd6c227b6c45b34f053fc5ce133b7caa17b75880a770c98882952070dc17922
MD5 6e3ade488bce37468c186eb278dc576f
SHA1 72e3e51e34cda2ad82d46268917641b315a9915b
SHA512 6518a114dda58cb9ab23383810f258866772a04feb7c46d6b678b94e2f9ba288a990460f6ecb06410f7f92957c80905dc3409ab84bf9ddfcdb796c8c1f39a07a
TLSH
T11FB012A184015511C44203F8218635C8F1589F10A60A271153F46A22C82E2508024250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1483.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a1483.TMP
Size 96B
SHA256 ff336eb3a6596f7fcb28c68cadb6adcf0e8654f1fb162cc3e45a857f870c9fcd
MD5 e00a6297330722993446f9735bdd2530
SHA1 76f111f227bb61f3ed58f7a308b5577c0ec63e07
SHA512 6a4cac4fc8a6dad774c74e215fb92a7be9a4554f10b8662330f87e9f26e95d5febe75a76381ddc6c675a0a59ae4e23fe8e5b835efc517cd9a9a2b5d271bd2192
TLSH
T1D5B02220E0022202C00203B03E88A0ECB2E0EF2CCA030202A3F00B33CC20B2002200A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 25b315cbeb36b6253e999f8851785ed75636fcc765b82c0e5291d7958c742813
MD5 a448bdc502a14f885c5405e625484870
SHA1 fd41332adc3359ac355f6ec192d0adc2e27a8e3e
SHA512 adeaadcc9b08a27999ddda373e78c89253d4d9010707a1bf84167d9771a7dccdede25aadfbc4fc7e60c693e048097a176121194e778d8819d50deb1a32149b9b
TLSH
T163A0029021C42C1DDC0451FE508291547305AEA15030D66BA0A7018C8D668505181980
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c1e4cb988488d37bfd290052c83797d4354cfbfce409cc3bca05a30ab788cce8
MD5 11c956143209240ff12daede64602590
SHA1 392f5547c038eb1945f14bf76c995c0e82648013
SHA512 20b2b9f9eeb170a53a19b0971fd91bf62bb2842336afce7891a0c5f7d5ec837e043cda9596e9d0ba5e5b28f60525da5bdb08fed6aebfdd4db56e9f59ef36de04
SSDEEP 3072:NGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:Em7Rkm1tYpBeh2BAoF
TLSH
T1BCC3122B5D70A97759B9AB0EB08E0B1E1EF149A6C930DE92C8D85B0477FA7DC0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 d997ac7facd7dd5725ddd513e2170ddf939b6a552da42480f0b6e76585c95f81
MD5 06d0ef13a49516ab527a7df97bf0d80a
SHA1 e2a853fcc6781b08048d33a588dee11264c0ae56
SHA512 e50e80c024b7adf277684a47c137104d4281aaf767a504c46a1ac4eeace00b25388259f4df89116a00b47c0ac0d423cefd60ad70702f3feace264c1ec04339b7
SSDEEP 6144:Z5h6qDkvEewPjTzCd5zF7Mm7Rkm1tYpBeh2BAou:ZD6+1zCPzF7/9oBGcAou
TLSH
T1ED341237DC727D7A99BEE762704F054B2FB24CB69C35D58684E64F8827A87C81908D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 1a4fef966500d8c862c80cd91be9ad799da5316a39a10c0d03736a4e64e94f50
MD5 f0c6b19eb67e7cf5c3dcf0100911df77
SHA1 ba4d48bfc210d40df8d0d67ea46b2ffb6d143fd3
SHA512 806737465f89b6a1cfc5bdb742bbae0059be0d7d02c71ce73af763ec516608faebe5ee4fa5d8b07e548483d6a6a8a2cf843b724852eefe6c87cc197a4769432b
SSDEEP 6144:L5h6qDkvEewPjTzCd5zF7Mm7Rkm1tYpBeh2BAou:LD6+1zCPzF7/9oBGcAou
TLSH
T1C7341237DC72797A99BEE762704F054B2FB24CB69C35D586C4E60F8827A87C81908D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xanlcmir.g4i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xanlcmir.g4i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

duckier-svc.bat

Path C:\Users\Admin\AppData\Local\Temp\duckier-svc.bat
Size 211B
SHA256 0fd6330447d6e195114cf640cfc38996a98feeb94c21a5f7c6aea13d1ff3863d
MD5 6311c062e8e7b9b68f651f53dd956cc4
SHA1 0ed619d9ce8d809d5961da2ed030d0410896c30c
SHA512 a04319b54f8024342406e468c7ede2669c033e12feb9d5494173d9686238390bf740742e068b6bfb61a3d884a318e42f26d297dd89a4ffdb0034ff8d9c8b081f
TLSH
T170D02222F841F402AF8293C12E175A42E9A1E20E1068B82312DAB17374C84C7CCF7D01
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn2577.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn2577.tmp\UserInfo.dll
Size 4KB
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsn2577.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn2577.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn2577.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn2577.tmp\nsis_tauri_utils.dll
Size 43KB
SHA256 067432f5b9d396570c5e99fb2b575daefc9dd7ab68b89246e74149fdc26948a5
MD5 bc2fc558fc66de3d28fdd7862e4330b6
SHA1 21b0d6e0a025799b6f42888be1a47b406e05fed3
SHA512 0757fe7bc59ef30c8801f121041f4bb147760a3042746523c969c66f99178855a6829fb389a0615ed69b16fedb5cc5625b01e8f1b4de923be967e5f36f1962a9
SSDEEP 768:p/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVGbLz205cKdec:xwODZzTrAV5Oevq4DtXHVG7oKdh
TLSH
T130137C49FDC57D66E7CF09712488853E4A7FC9081740C99BE3625EA2C992332AFD521F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 09df34b561898eec43ee01a6ff6872ab89d96a43f01db143e948341b0c9ceced
MD5 aae85828acbb0aa81c1dbbbd6ce2b117
SHA1 21f5d99dba493cd21251a377e8dac4538423fd17
SHA512 716c59d154a8decc6ac23cf3c29687d63cb8678ee1aa1b9d0ff1531a248a71eef04396305484cdef05e0a4d870d461d6cbd989cd404080c16bcef42c56dcda79
TLSH
T182D0041075040411D00434371437C35045004C4540053F4015D3401554DC55005071C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 83ea2e60828009d17e1c1ba6d275eea42a9e9ad92d7acedc9d4c65babc372aa3
MD5 20d30d5d56ed1234d0e8988e562b0044
SHA1 f34f6d9554610c5ecd29d2b779a6101b8f53ccde
SHA512 7b7d3b97efdc038706a2a9afca5df1afe0da19027edbb487fbbf74eb95ce5d635cddab126ceb61b171f028a6780cc618f8a4ac75067c5c1263f844196c81bb18
TLSH
T106D0121236010534C01034331423A3480800C90F80095540686AC52E6A5C4A00E074C3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4eb09874b45599eec90eeebb15d9aef974d2cce4f2607bcd78c01eedcf4fddea
MD5 07007781a757690254a4216bbf41f587
SHA1 058e3f19b95397fd021fb9dc91c590f0ebae8252
SHA512 4215ca8ce478da774943fbfa97b60f5e3c2b6a8f5d5ad3fc6c3dcef1ff41ab1d0cbf92b5e87fdb602e98b413445f8152ebfce8d4a96414585bb6601fb65238e8
TLSH
T1B4A00218D19468E5D195667138AF4A423E644A11DB114322ADF13547F8A11C87522040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9df2489d82613fb2c0601196083430c83c59ebb12edd563b0e2a179a991d5a43
MD5 31d18a566d0f7d2954e69e4f45c6fae7
SHA1 a67d5ca08b5569e4fc47298107d738f2b9e325a2
SHA512 fee945acac810f4884fe79b72f032f466d1915565011069e1dfbfb60ac23b69e945fb82f3fa6af07d498a37e4a7b2e0e3de654f5f8082e0aac8f826806441a55
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Network\Network Persistent State
Size 87B
SHA256 fa2ad76b2754362ec9a32c24a767d7739b3de717f8f28f786997d6da0ea50853
MD5 4664a2ce60135af283c508e03ff05d37
SHA1 b2ca7b306e58588f3e73ca5bd5ed15577ecc635f
SHA512 2e10b4fb34b859f5f3755f0bf2b3a010513765d782b128ea33f574e8db0bb255ebd22c484fd6122ea864f9bc3485c6709f416f03a80ea07a51463f666448a5d8
TLSH
T1D5B0122A58312D880B4743902718B40B803B0405220883BCE43C7BB841550284C1CC05
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Network\Network Persistent State
Size 200B
SHA256 36c2e1e29c9f644eca2ba86e840bdf05796e986fd38d3b4d7529af9e99dd1be6
MD5 4a9eaef194fe6e950dfcdac9852097ff
SHA1 e77d2b9a5e50e7df77f9ddd123801782d014afb0
SHA512 ffdf7f84d9722669e61359f7dce219947fc263503b9bd26d6990f8c1db9aa096152395b66d7b4d12604f25dc1e71e582c885c03bd2759132bd78b6510fa4bfca
TLSH
T18AD02209903038EE03838390122CB937C6FA50C3028CCEA8FA3CBB9E43F102C8824C07
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe591217.TMP

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Network\Network Persistent State~RFe591217.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Preferences
Size 6KB
SHA256 168027988c08c67e2402a6143ebd3767687d920a12c09062e6b75bf6e3b20326
MD5 3908f8aad5aee39b6e68ca122f878824
SHA1 407727b7972c20131c65eb7a5d3f373515e05ac1
SHA512 c5d50c947f82e8a26a2318e16963aa04fb97b0c0b702e390c7109065f8e0fe2ad1a15b46ca289282fce9a8c61536d89e31ceaad00df261272a99fef9c8779e06
SSDEEP 96:stu05PoY5b900PffnZ8i0vhELkrhm/7qx+WVHMSm+uecHbOSMFHdQjS+g3t0+MOB:stu0J5PffZ8pawk/S+Wixb5qdPBt0+MC
TLSH
T170D1B9435E28697B4CC7F6197A35BB12E2F9606225C51E58EBFCC71C09EA6CC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe591999.TMP

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Preferences~RFe591999.TMP
Size 6KB
SHA256 beab348ff4df5ca87765c8cb663739ab16ebb4fac92ed54ea4f52d4c37b1872c
MD5 9db5ae9e4ab18a520d04291a61070fea
SHA1 95767371cfe51688bbbaa7aefe024be0255120de
SHA512 ddb90426138466e722a88baded545c90487f80fb4c52a3c2d2311cce90ec446cb7f4c8b3da9833ff3f75feef173a07c0263c8eeb9a848a6c61f3f0edc891998e
SSDEEP 192:stu0JCPffZ8pawk/S+WixtkwdPBtAk+M8:strJumY/VUwX2g8
TLSH
T136D1A8435F28697B4CC7F6197A36BB12D2FD206165D51E98EFFC861C08DA5CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Local State
Size 17KB
SHA256 c60485e0a51ea9653c90137269257bb74fd792d1e022af609fb06dcd6d3fcd9f
MD5 521d42febb630b186014de22b0975271
SHA1 f3178349a5d21e37cef423baa68844a59f6545ac
SHA512 366344f867da1afafc30ecda274193567979d8bd789e197bca648cfcbb3300c83a7a3d1a58c3bb8846daa0bea77e8603ca7eadc69ef7f0a0e65ec8fd7e10772a
SSDEEP 384:zwh6GScwr1UjPBasgirch4FWUN6h8FNgaq42g/BDL4IITks:gwrOPBQWcu0Uyn4fDLfIX
TLSH
T184829E3198A0DBB31CF39685B506332A5B7041A7E4953FA88EED5F0E025B38D175BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Local State
Size 1KB
SHA256 178217683014ba91fa4224766068b82f2c7487522450be33c66f1a17870541ea
MD5 484ee2361a609d188fde5093323ee69a
SHA1 23565a5d1ab09e26bfcd94b8138e9c36f1ae7d42
SHA512 ee9fa2bcd30285ac3a298db9d8a416650906078a396783d32d309d63513a08e43bbfc5a19a31f65184a8879a67dcbfd834da302095bf3495fea3bc9d5cd07cbd
TLSH
T19F3195B3D8989B775CC3A54573866BC71F340062C2656F48A6EE4B0902EF68C5A25C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Local State
Size 2KB
SHA256 3f19f8951c4e95b6e87fb5ba88dfa21f96c54373d5ef45f36761be80ba20ca04
MD5 cbee6cf5f68bf928e6792be9e41234c3
SHA1 af80d39f82f8f547fa4dd4b885fcf003edc08bb2
SHA512 eee2b5ef939078dcd9f750cb79adb9719cbea9474cc446bc8243eb34066760d9cc4b6f3f51b350f5b8aa39f7161f2debb3afe88bde71b6094c92d3c076cfd158
TLSH
T18751C873AC5CDA7B49D3AA047A8E3F535B3900A28B963F5499ED4B0D01DF69C1701C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Local State
Size 3KB
SHA256 24e2615e627f689db4ff4301abd147d39f96033c0248d70108c64a7a8e60dabd
MD5 8623199687a23c2019df834f8085f456
SHA1 a20d9443b981470ec993cde5af25d6f1fe77f1ce
SHA512 6fbcbca78486ae8baaf56cef46b110bb51a31c3ebfbfacd064bf61bd61a0e532906aeee92bb19ce3faf11744bb84c1609e41c7a10c326a63edfe6d4bdad91600
TLSH
T112718463A968D97B4DE3AA04B9CA2B0767690163DAD53F98DAED0F0D02DB3981341C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Local State
Size 16KB
SHA256 a2902ba359ab86adc6972ece03da170ecaff3f7df9c80be91b9848566f76f14c
MD5 a952930c77d86dea24a13efb79ab542c
SHA1 089f0e7bfea3922c3a56df3a2277fc9260434d9d
SHA512 d0bbe1f738caaa8fd1f90ac2acafd3b77e37293470bdca49f75081460bf3045017a5f0329fc0790ed42b9f088fe3a452042573ca434ab46295d7e368e9f5b2b0
SSDEEP 384:zeh6GScwr1UjPBasgirch4FWUN6h8UNbcq42gvITks:uwrOPBQWcu0UyZ4tIX
TLSH
T14072AE3194A49FB31CF3D599B50A272A0B7044B7E4913FA89FED9F0E029F28C1756D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587ac9.TMP

Path C:\Users\Admin\AppData\Local\com.duckier.app\EBWebView\Local State~RFe587ac9.TMP
Size 1KB
SHA256 17c6af619d99dd289fd42aae71e4cb5660e9a6a297975180635ccf44c076f078
MD5 ab7e05b29aed4c4be9ef4447fae4772a
SHA1 fc746ca9e287aa809283e00c633d9d521777ef1b
SHA512 baf39f7fe801cb00826f152a893a70fc2099d28607c8820f54fe5d01f9a5f3ce6ef3aa0d535af4c288a7a06147e12bf3f4606a0ca1b40ef198ed7faf7c5e9f99
TLSH
T1B92198B3C49C9A7BACC665457345ABCB1F34007282246F0CE5DE470A02DF5DC4721C76
MD5 SHA1 SHA512 TLSH

Submit Download

wireguard.cat

Path C:\Windows\Temp\3F5C98~1\wireguard.cat
Size 9KB
SHA256 6beb0344558df571234365d925c9d1ff0661b4806d87a3a7ed10f86cbe1e16a4
MD5 be8c17a323efda06d86df34119ebe1c9
SHA1 e0ea2dfe6bd5ae19c6ed07ce674421ee7a26fcc0
SHA512 4462c25d2a710a5bbd1a35057e395e6f678b7845cb7ac4232886b8f5a65aa15d56a3ba064ded20a21b1a42fe4fa722e444c3fd2d5ce6646684bdc4d07c4b38b3
SSDEEP 192:ZrD7rFoUn2g/c2JCkXooyKfPFWQF8SidpT4uUgxfzfqnajggYfP90:HXU27rPFRhiL0Irl8xfC
TLSH
T1AC2218E28A6C54C3E96368A047E8F4D77C3D67DB6C5054AD209BF7950D933CAE70882E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wireguard.sys

Path C:\Windows\Temp\3F5C98~1\wireguard.sys
Size 477KB
SHA256 94def0c6290dbc32ebb9a6e72d2f76d0ffe66365606efeef952834768e47f1d8
MD5 f6092ec8f7abdb3c2c089bfb3279b65f
SHA1 432d2cdd982ee82fb0cfe2df025327c3692ef1a0
SHA512 6b62a0ce9f4bcc7c07afe2fe8c632f3a6bcdff73c3f1eeb5a4a8aebc2823f6f7edcd6d5ffd6c2d0b1adca486889b508271862217b553e5f2ee7eb9ba8e88b57f
SSDEEP 6144:xF6PqqMnT/FQuLHaDyNyQAq3N7nDAa16wIQG3:hqM7cyOcN7kW8
TLSH
T157A45A42B24617E8C12182FEC6D9C5BAA6F57C089B10DAFF5078F2653F322ED6539E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wireguard.inf

Path C:\Windows\Temp\3f5c988c4e5d063ee1f5b9e5c2815f749d74098b670a87b8f3c7afcf3ec48f40\wireguard.inf
Size 2KB
SHA256 079e58e9b00de894557bae8feb40cc578070376a52971bd733d74e8955b3b126
MD5 945faa0eff8b1a73afd3255e1f28aa3a
SHA1 cfde5c7ce0f79fece868606bf68493949a35d38b
SHA512 3f0850e254679e98769de5339a0114e44697108ef079bb3fdc1698d1a27fb63aec240ca17ecc72026a4c9d0f85b54ae1b31625691b656cbc962c15b4c78de213
TLSH
T1D74146E5B5E51E6D38E23232B33A7C82758C134100ED306FB58D8946740FD6DE6199FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/416-328-0x0000020DCF320000-0x0000020DCF344000-memory.dmp

Download

memory/416-326-0x0000020DCED80000-0x0000020DCED8A000-memory.dmp

Download

memory/416-327-0x0000020DCF320000-0x0000020DCF34A000-memory.dmp

Download

memory/416-318-0x0000020DCEDA0000-0x0000020DCEDBC000-memory.dmp

Download

memory/416-325-0x0000020DCEDC0000-0x0000020DCEE73000-memory.dmp

Download

memory/2784-121-0x00007FF983850000-0x00007FF983851000-memory.dmp

Download

memory/5044-305-0x000001A6B61A0000-0x000001A6B61C2000-memory.dmp

Download

memory/5092-240-0x00007FF983850000-0x00007FF983851000-memory.dmp

Download

memory/5408-965-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-974-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-973-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-972-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-971-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-975-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-976-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-977-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-967-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download

memory/5408-966-0x00000220025C0000-0x00000220025C1000-memory.dmp

Download