f12dbb75f2ea7376fb6c6d10725a667f7044709880ce99b16206f0cc5077f312

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
902s
max time network
479s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 253.5MB
Sample261104-3hhwlseh89
SHA256 f12dbb75f2ea7376fb6c6d10725a667f7044709880ce99b16206f0cc5077f312
MD5 7f2df289cbb7da0794fa6e9f4624f148
SHA1 1c7d529de27b95f3384383a0f2823332cafdf8ee
SHA512 0f5859c57e80a38f06e09ae0cdda77ba98244e4c157123cba06abcb2bc151c892c1b00fd3924cdf62a635e2bda9615e3d4b093d279cd1afc1c01e674c784c114
SSDEEP 6291456:bNcj/hJEpa2f4PWEqmIME2zdQnnSmKki65SNWQbV2IIa8r4SrGV6A/rDjN3b4:bOZk4aBSm9ONXbV2IIXrQV6A/rD5b4
TLSH
T11BC83311FD03907FD0DE00B1F43FD6BA7332EAA9936D41835579285A69A13B08993A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
4564	drofus.exe
4988	drofus.exe

Loads dropped DLL 64 IoCs

pid	Process
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4564	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe
4988	drofus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	drofus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	drofus.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drofus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drofus.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\dRofus\\current\\drofus.exe,1"	drofus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\ = "URI dRofus handler"	drofus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\URL Protocol	drofus.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\shell\open\command	drofus.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\DefaultIcon	drofus.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus	drofus.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\shell	drofus.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\shell\open	drofus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\drofus\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\dRofus\\current\\drofus.exe \"%1\""	drofus.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	drofus.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	drofus.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	drofus.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	drofus.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	drofus.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	setup.exe
4904	setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	drofus.exe
Token: SeDebugPrivilege	4988	drofus.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4564	4904	setup.exe	89
PID 4904 wrote to memory of 4988	4904	setup.exe	91

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\dRofus\current\drofus.exe
  "C:\Users\Admin\AppData\Local\dRofus\current\drofus.exe" --veloapp-install 2.19.10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Users\Admin\AppData\Local\dRofus\current\drofus.exe
  "C:\Users\Admin\AppData\Local\dRofus\current\drofus.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:552

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Frontend.Infrastructure.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Frontend.Infrastructure.dll
Size 775KB
SHA256 2d311d3cfa0e422bbb91f87383e0a9a471c815e8f1a961324bf1e55b37ce2a4d
MD5 7c77cb298e9f053f243b1c28ba8d0ac6
SHA1 92ed1c9e49fdbe8d4814fed5cf0ffa824f22bc1c
SHA512 6eb1a0837d58638f94a02b27888df5ef0ce3aa04f7c561a63a45c90aa073881d43054fc96128f738949d5a24057fe62dbd7beb799c283bddd890e0586b568391
SSDEEP 12288:2ppkLwAeq7XpATrhRAsI60ZNX6D70cczBnO/yO4JaJoD7lq6HYwbqkAgqp/S0l9O:2UwQXpATl+Wm630cnj5uX3KA
TLSH
T16DF4180233F887A6E5FF9F7DA9744215473AF9469B56E30F0B04A58C0CA27448DA6B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Frontend.Resources.WPF.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Frontend.Resources.WPF.dll
Size 1.8MB
SHA256 3091033679ac76b2e389074c4027ae3ba155089d5d8cb7a249a29fb4c4a6dc31
MD5 1aa1c72450e0208687ca35b349507c39
SHA1 64693a54b1b1f3490aa567aa0fcb7e5878be2bab
SHA512 fc5f5c355313c246ac078df233baebdac8dd42269f65be1e1e870afc4c6e7f0cd756d1721723882a15e89391d98701756bff34333db6eb2cebed046f4701c29e
SSDEEP 24576:icq4ea+smfBZ4mjW7Iw/fkxK4YgegmlLBjqGoQvLETp3:iausmkKWMizjgeX4B
TLSH
T161857B01FFB7BA2BC56529B1593202742528FF2062A1860744F9BE1778B177386D1EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Frontend.WPF.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Frontend.WPF.dll
Size 251KB
SHA256 1a7615f34f953f922a87e14ebbc1fd8ebf5f8c70c86512ea7731caae038bf368
MD5 938b7402ff2e83122640d44953a51593
SHA1 00a062cf3537514c8aa5caede2660b9c511ef545
SHA512 a8dc560f99b1782b397b6b84cffb98235a0df32211e7bfbbbc40be9fa166c7b089d5d02690bd7716c4dcde5fcfeaff66889a896ef4c9bae60742440d6a063d90
SSDEEP 3072:Q39YbKbqp6AU/26qAXH/4luLUnKGMOe4tQpXul+yM4shDJ3j1Bc0+wyBCHJCBKtF:QNYRpVe2lANoupUM4sDLOBCv19eho
TLSH
T12D446C1223FC8625DBFF6B76B46015458B71F94B90DBEB9F9A48A0F9188774299003F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infrastructure.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Infrastructure.dll
Size 941KB
SHA256 60f0ae83b67343a9dd5b6f33d0ed277c22636192bfe68daa1f22218e10cb5919
MD5 aa56129c809fad7fcbe52e80c7ed8794
SHA1 0798ee6b255911a27ee20f3dc29d653385ddccdd
SHA512 f4f9f812abd0b807696444d33023aeccb00d6e17143b05fb706cf49380124d85da349fb9437ea4e84b47c359b26dce180c317dcfc3c93fb6f181838bb6d9aa7f
SSDEEP 12288:pLzCJCNzIuHHQQ1++61nzmPQ9t94Ww2Ghaho9esc56dwAA67Z:HhozmYX94dPesc5awAA67Z
TLSH
T1E4254A5233B89E37E9BEAF7EB4B0125907B1E9C52617936F0604E5EDAC523040E453FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Licensing.Runtime.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Licensing.Runtime.dll
Size 101KB
SHA256 324c6c1809a0470e22200df02e5e4907baa860b6ec7e14816dfe6960faae8a2d
MD5 bfa8da65ad66f8e99235c93f9bbd581f
SHA1 4bf264d2739a154d9bdd69916867a1d05fc21f85
SHA512 b48defd359a22e3e358a0e8f3a57c238fdb41dd9f1e012f263a737dd0b28fefd7f956e47c6c14aaf95cbcf64ffea0db8239d31ed2b9d87d2551e6640d8b32e4f
SSDEEP 1536:ola0qWPHrbEOdhqSDRO1m+nC4dkeo2qBOWAGuDaL9SKlHgfIZR01:gaaPHb3DRO1mkIBrnhSsHhZQ
TLSH
T124A33A1477E85733EBEE1FB6BCB843064F75F443AA32D70DAD0895661C227845A103AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.DataVisualization.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.DataVisualization.dll
Size 2.7MB
SHA256 804c0228e6ae1f0f728340b1d6d0da9f311716a4d6a4fe46548068688db5e84d
MD5 a0185f0becfcc584f311da378f71bf8e
SHA1 2b0eaa69f706ca72aef7838741439b37fe64fe37
SHA512 a7e5e5df8b9444c6aa38180ed50a80fd1f08005f7169684f26acfbd3b00af42275f6dc2657086d9d4159cefa74c3384f9b4606f244adf4b51646d6a283314a5b
SSDEEP 24576:z0915DUHh9pyZ4iIz06lLVa2Pn+9xFJKDVQIkqnXjPmBL6tLqh1g+DE9i9Ah85jq:hzyqlLVa2P+93cVL+DE93
TLSH
T1F9D54C2137598E1BC24F6B35585025155370D20AE38DC6CDBF1AAAFA1E9FF807EB064B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.Docking.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.Docking.dll
Size 273KB
SHA256 8f1a65a807abe4bc301a52eb634918c8cd0da56aa367c378100592c2bf78fcad
MD5 da61359eb8ba2898896b2ee4910a9bdc
SHA1 67ef81f1cb6fb19be32c69e2c2b7dbd91fa13a05
SHA512 c3b5eceb62beab5768e2bd38bebb1092f82cc81658987e2e0775649916529f7257f2b9258d3bf9d83501a88593bfd5d9b328f916d629b03a2f49ed31dcddd1ad
SSDEEP 6144:eujZ1pvClwq8FR+ngUQdwKhWsqlaPlP1rhWDU8C:elwfmpWIDUD
TLSH
T14B546DE613BC8E2AC6EF0B78D16450048BF1FA43A5A6E36D3DD861FD1D8374196422B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.GridView.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.GridView.dll
Size 1.2MB
SHA256 4393a45202c231e2b9e062b985d277d4b2cd952469a96aeadaf7add10549afdd
MD5 1a13b995eb404acbd20db92cf1589b08
SHA1 a7b052366eb0578aac2fc001bb7540c191748929
SHA512 dc2d9108e27e7dc18e69105038dddec983f197126559f3fef9b39b48ffadd9c13b5245b8b7507d89972733b314ee26636ba83592fddd2dca9471e2d20579f7d8
SSDEEP 24576:fNpVO4OfOkLW0yi90ZInXdYDKw+KXB+JF23UaqxtRsMebuEsjKeg3saf:VPUf3HFE2sGKeIr
TLSH
T1B4455B6237BCCF1AC4AF8A36A03115285BF0D556A7D2E7D9A9C4F2B87D837104D422E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.Input.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.Input.dll
Size 685KB
SHA256 a92a71512302dfd9a7c271f4463af8cf5085ff5a5d6bf8607fe7985d361172d1
MD5 e9044ca606d0926b8059d2aced813db5
SHA1 044a2defde06c322a4955f6aa0f74ce150d12b80
SHA512 82f62922661d161276dfcb554f6a06f6671346428f0f9d0955df1f6ae1a4bbb793aa1b4fe0a249b5c732f18e0bc24057f2d25cf98bfdf1e6a80340c80338108d
SSDEEP 12288:486HrD99fBIgkTukF6w1eXffGNjMxSxvwnZ1ZI:48oPkTukEGNjn
TLSH
T119E45C5333688B2EC5EF0735E06000184FB9DA17B7E3F74B75A5A6AD1CEA3524E442A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.Navigation.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.Navigation.dll
Size 1.4MB
SHA256 7212a70e02053d60f8aad6066acb6b6f3d3d45a3e119ab16cf14dc6e3625e08b
MD5 b3d795d70307c36d379955b839ff7a9b
SHA1 67a772cdb2ee547c7c03af6dc08ca53c3175197b
SHA512 d60785014303d7a9885ccbb358e1319b4ccb2cf15d93b26029b45831ff4f50f3b25ad45c611aa320939dd84c00118920d4e8209d52152f21f66f91412a5e9121
SSDEEP 12288:fKDC1mN8SfHn8E+54anUd83l8PB8xdC0lJjLHMX3vH7Eu/aP2Pb+hKR9zvcwnZ3p:fKDCy8SfHv+KlwjTMPH7XauPb+hKZ3
TLSH
T166657D5073A8CFA6C5FF4276907062385BB6D586A3E3D3897568A3BD2ED33110D422E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.RibbonView.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.RibbonView.dll
Size 475KB
SHA256 3f993f92e9a42093a2f658badb2eeca28763ccd8ce15c315b8d2c6254919ee62
MD5 afeca4c675d00f6c62e6099873831681
SHA1 17ffd47d42a48effa46aa8c55067b109ca03aaf1
SHA512 e457d65186068c78ae8f7608fa99dfe72c20097b9c017902f3809862052eaf84eb6f643a9e93a99e98bc32a883295684f1eabfbe9ae4059a8d382c57911d557d
SSDEEP 6144:NLbPr1Q5Mv7o8Af6U6zrYbXiSUJINWE4hNpjKu496nKfO9HmRlpaKZZGWJfzu++y:Nfr1qfs495Rlpj8kf5Lp8TcQUFOOjy+j
TLSH
T132A46DA223B8462BC6BF0B7AA07212244B75F40372D7EB5B5681B5FD6CE33524E051E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.RichTextBoxUI.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.RichTextBoxUI.dll
Size 3.0MB
SHA256 c4fcde04e3cbe965328a3e64536112ff834df16728e2eb9949abb3a97eb321d7
MD5 ab0d57e4f544e6fe4b8dc0e6e665c0bd
SHA1 b6aff177fdaf1b78d5ac216b688033212d406bed
SHA512 3ebc49b11d1470240290735655d62ab753c60f3b693889dba921287cceb331fd011d802f8902bf3f22e56154f6dca9521bf0839084b3300e7e86166952ff725e
SSDEEP 24576:5053WjvyF2eCGbWau1GrodF3aMMfgEPn94/bU4ty:5053Evy4eSau1raMMfn4HM
TLSH
T1AFE5AF42BAB41918EABE6E351CF510029B7732489AD2E71C68D698DE5CB0F97CF051F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Controls.dll
Size 5.6MB
SHA256 17508fccbba01d02b88726e5756d29e62aad835664b3bc57a6fdd73cd4bbd546
MD5 1abac3179de1d5e4edbb00937d154f8e
SHA1 58ac4f12bc9a4fbe0189af38366a4a416cf3cd30
SHA512 9e0143a50aab503dc95abb10c326f0ee5bf18dc074b17dc2f60076e3004904380baef2949a6226f1b40438a7aaf08855a7afa17f30e21924e405b76e3da291b1
SSDEEP 98304:S+PC6JRbbJ45j7Ha/zsS2bu5MbbzOpJbrc3Me9DMbJcioxcKK2SewFiYCJc7vfm4:S6J45/9iD54eb
TLSH
T1D7464A01E3FD4B2CF6FF5B34A934063946B5FC4A3A56E10E2450AA5D0D92F448EA17BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Data.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Data.dll
Size 492KB
SHA256 d8da3e9a24b1ca11d58b237d083a2112fa6c56b2967e68d3686dd80f4127dafc
MD5 f69d4814ef4f2176fb08b722da2656d0
SHA1 b2a00c53b35d7ebac1da1324397111b470ecbea4
SHA512 f95c1ca38e625103330a7b7a4b22d81d4eadf4e43199ae480c425ffcf8de8e214701ab85348fa56a546daaf1ab8b22760bf43e0f0fa31cca40be542c3b131d3d
SSDEEP 12288:tPL4dcQNi8wwwsxez/PAkZxw0FBIELAGvaSAv8rYn2sPz2Wp+k7V23I1JaTVM5l4:tD4PpHwjz7BjF
TLSH
T13AB47C253BDC5736C5FF977AB0B8202583F1E096A2E6E74B2A44E1F46C837118D1267B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Documents.Core.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Documents.Core.dll
Size 1.2MB
SHA256 e854a9c1002bcce950fe70943fbbc15b4eb6995053bc4793e4b84b9165c4d82b
MD5 d33e61e4df133dc86c28e1aecf1b0941
SHA1 ffb574dd7f132e6a0876c417f1df6f857215425b
SHA512 a632263764b59db351450151ed60f02dafc992215bfd21243f4d1f5e01e127f08e362df7997c791ca7bba406145f2ed3585b13171c965761326279249af1859a
SSDEEP 12288:4O72bKzHQvZCCkwj5GiyI6c/riBbErP86F4/dvt7qlhDqeKoX1fFzQnUMBNYLPxP:BGLTHKnBcd6xfb1hu
TLSH
T1D7457C16B3E5C327C29F4771D8E0096712B0E5262792D78B2FA2B7F52D12B407E4276B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Documents.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Documents.dll
Size 3.8MB
SHA256 678c7ccf2d09fc92500d5198114efc18e6f5c969cc7d8822b62b4b62b94ae15d
MD5 06063edd34a72c67a453b6e54360a05d
SHA1 264e4d9e253f49ab11c6eb8b62fb443dfb97f38c
SHA512 a6779eaeb1dad1789c8da40448912b1f7f041e08e2fde5806611d1268002f83ce0f9fd4ba89c33ab3630a254c3d79bfb7c128ff2f8a33bb89a975a2f811c734f
SSDEEP 24576:pV3+uKwikJgY210En1gaEc+lqZidN36Jm29tUqK6i5w9WgjdratjfW9mVlhrfT7N:DLikJnEn1gag2iwQcvBraEmVlZ41q
TLSH
T1B2063B9F76BC0E5FC93F1C3110A1E5A0D9FAE8A81B6A895E124DB6C71C65F421F0136B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Themes.Office_Black.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Themes.Office_Black.dll
Size 3.3MB
SHA256 efa4f0685cc040b106e17103abb995efd3279855a9d0765372e85656eb256d8f
MD5 6b2de4eb51db80dcb29b264e9d855954
SHA1 700270b70c6031ac77ef4f880d6219245bc24c58
SHA512 7dc4f3b16ceacb31e92d97bb1f5b5ac79acf5482938557227402a5fcd71a76444f24c9907a8dab3dafd039204571bea2ee4fc8bd45a5cac6c7129280fe6bec36
SSDEEP 98304:u4FE4LToJKP4dC25y6x5YAr74K/jY3GnMRb9uJQ93L3X+jEXCxsgC3V82xZOfrAe:u4FE4LToJKP4dC25y6x5YArL/jY3GnM+
TLSH
T169F52A24123C06B6CE329AFF94578548782C715072F1E522399F6FAEB8D491503AB6FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Themes.Windows11.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Telerik.Windows.Themes.Windows11.dll
Size 3.3MB
SHA256 dd41a6321abd11fcc1e6a1406e7cdcb1e7f0ce64aed2e157e0097feb58162ba3
MD5 7b1697ecb3e3981908ae9567f7ab9d5b
SHA1 fb43b3a4184bec4292dc611e0c58c44c30390e57
SHA512 6824fd7c655d4fd5ac22a7a356703b81a09d3b2b7695544b27e5354580d7285d3154434ff10eebc81a46c25616c081bc6cdfba5ddde00846a863a402378a8e24
SSDEEP 98304:v8EgoE8p+Vn1Jkj8h5oF0+ITZZJbd1pxI+:0EgoE8p+V1J+8h5oF0+ITZZJbd1pxI+
TLSH
T12AF52A9011280A748B329FBE8926590C7938525103F2E85137AF2EBDFDD8D924B5F77B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToastNotifications.Messages.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\ToastNotifications.Messages.dll
Size 101KB
SHA256 9b851fe87183f16cf5043b4f3e55ee9659f9e111c44cc0afde84f8b7ca5ada5e
MD5 316658012d57f5c828f14a98b9678b3f
SHA1 ae492a807eae5bb2a17ff763ce5f2bc738ba60e2
SHA512 5ad9a21a471dfc1acfbb9743846d736e4c2868b8e96341cd8a17342e1a60b92770a2c8702471f51bd286b54c517f32c592dbab591d5d3b09f4f1a1d364263d96
SSDEEP 768:iBmw8LMMx7wFIB9xbBrp2mr2WDkrA+hLu:Omw8pwFIbxb9smH7
TLSH
T132A30A8567B61DE0C8223FFEE79DD2401A29AF91C4D84705B37C78185E7921FDE2226E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velopack.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Velopack.dll
Size 222KB
SHA256 c96a81e42d868a38855248cdf3e95b36a41924488509fd4f3b8aa6d1a632363f
MD5 c74e826a9ec9f700edb78ee47a2f5075
SHA1 933382b613fe3fb17f2dc7bf444bb10787ed1906
SHA512 8e903d5c2d5a373dc19c3b94a7fc8b6a7be8b84222bab2c00532e47f28b7cd9e98c45180485221f32b27ae94bcb1a6d8052eebf310151a226ae0163828dd966c
SSDEEP 3072:ssqPATMd8/RNsMyTYkjPTZQhNqJw86BJ58cOj1GNx0/w2KOzUil2JAYJHWQTZ3I:ZoAmj1w86BJGcO5Ux0obHWQ9I
TLSH
T1E0245B0567F84716E2FF6FB8F8B02111CA79F517B97AD78E0A8854DD1822750E920BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xsharp.Common.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\Xsharp.Common.dll
Size 63KB
SHA256 c221867f3ca6188c1cefe28d81203c70cdfe6b756c84fff12b1b5a77e0e45625
MD5 ee4795f4577bfcf526952628cc363afb
SHA1 36ec956bf3a69e19060e3e373c0c11c92ada03a4
SHA512 271e0f83dd538de857eccfcc5418ed1e5a2d60be7c4e0a71b89f18e3a8677b7a131cdbcc1349a80ff00ddcf4f8c7bb1b472fc2c3592f4958e0fa00f32c635af8
SSDEEP 1536:5X5s7OzZcKM0qhLQpnNTklIRTch93SIqHN:HIOzZhybqt
TLSH
T1BA538D2127BC8B7BCE774D742CE4D4100FF0A39A6192D3AF1E85A4DA59D6B220392777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dRofus.exe

Path C:\Users\Admin\AppData\Local\dRofus\current\dRofus.exe
Size 714KB
SHA256 422715e96da9f61b7da0cf6c50a0773a6031c53e8c016587f4a4178f6f4be6c0
MD5 de13e9d2f3c6053e2a62836a1bc1458b
SHA1 af495fd0c8e1788d7711af96c9d201e1b8978afd
SHA512 2029f76548204c3e2c4fd2e3432bb3314150ae1174cf0fa854e2824e255d7eeae3a76c333e2f486b6fbb17be841d7e145515f96a15e94358546563efd6db2d6e
SSDEEP 6144:ixoMxCXS8MUZH1D0+HATGsJ0y5+e0ZWyXcjvNcV0yfgb6IvCkxBsrsxR3nqkMSW:iGMMH1Q4AGsJL++dGs3Pswxw/
TLSH
T1D8F4F520FDB7B223D56E5638F41040F48A61FFB69586960B2039B99B2A753334AD1D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drofus.exe.config

Path C:\Users\Admin\AppData\Local\dRofus\current\drofus.exe.config
Size 11KB
SHA256 5d06e83e340807455f9293956bd11de513daf5eeed43cc59d72e4d6808e57aa6
MD5 14d1c6aef9dbd36795448a9067e04e16
SHA1 27f3a37808d249e29ce309e1fead8ac80fe54a7c
SHA512 89ec1408f8789146f19ea380151f51a91114b1ed9366326ac865a1886c4d4f051113475757f7be174d5ae6ce9d719f1bc2fa29a2b64049a63acc289d00947a93
SSDEEP 96:hr5UwQdCMv4J4cS4g4t4Q4c4p4E4b4Y4E4S46djXomG6aGlianD6mfG5xrorbn:hr5pUaSID
TLSH
T10B324021E4C8ABA58F7255B13E6B6428CB6E03B3298C05DD70ED6E4BCF35E96510B077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\net10\WebView2Loader.dll
Size 155KB
SHA256 bb5fda5f2d3aae5e0977ab28d8a8a00acfd63d73748aaac32daf4fc6645b6677
MD5 6d025364f66d8c2dcd882eaa3df83835
SHA1 92ea55b6f46676c3b4a684fee5d7c1ed4e2e8772
SHA512 d62f52c0aa0e54c6505e9a74e92424f378e40405ac4a383d9b6cf2cbee02b24187c72fb7436841a1ca249970e5ae60a703d1b85ad40a17aa66cd9a231ba04e17
SSDEEP 3072:17+r33Gx3Xe/uy0A4BBnkDC49KMNU9eAT8uEtJjvv8WD73pe:1wnGV4p4BnkDCEKXEtJwmM
TLSH
T125F35C57B3E90077E17BC278C9634A45E772B8115B609AEF03A4467A1F237D0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\dRofus\current\net10\runtimes\win-x86\native\WebView2Loader.dll
Size 117KB
SHA256 9873644f2668960d66e19d0c62f7812b1b3f35c1f53e8cd61edbb1be311666b0
MD5 cf0177234365051bcc159e0f5efc3cb4
SHA1 340dd30cacdb00bfbdd67b28c6bc9c7fc0f9fb7b
SHA512 a7ec5ad09110667e65cca5327c7fc3d3b025aa873d6f51e63b801b1c5ec81c240cfa54c56f7ca1dcc311f2ea83ac15c5c581997f71cbf46890d54f62ef529991
SSDEEP 3072:dXnSXunvjUnLGXBYeeesT2AIL9rF7A8TA/+XEtJIp1tl/Xd9kx:F+unL8ie5CXL++XEtJaXlfdW
TLSH
T123C37C00B5E48071E5AE55390838EAB65B3F7990DF609EEB379419BA4E353C09E34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4564-709-0x0000000007D20000-0x0000000008074000-memory.dmp

Download

memory/4564-721-0x0000000008460000-0x0000000008834000-memory.dmp

Download

memory/4564-705-0x0000000006F00000-0x0000000006F7E000-memory.dmp

Download

memory/4564-733-0x0000000008E90000-0x0000000009144000-memory.dmp

Download

memory/4564-697-0x0000000006FF0000-0x000000000715A000-memory.dmp

Download

memory/4564-751-0x0000000008310000-0x00000000083FE000-memory.dmp

Download

memory/4564-756-0x0000000073250000-0x0000000073A0C000-memory.dmp

Download

memory/4564-725-0x0000000008840000-0x0000000008B3C000-memory.dmp

Download

memory/4564-689-0x0000000005B50000-0x0000000005B98000-memory.dmp

Download

memory/4564-693-0x0000000007420000-0x00000000079B8000-memory.dmp

Download

memory/4564-701-0x0000000007160000-0x0000000007298000-memory.dmp

Download

memory/4564-665-0x0000000073262000-0x0000000073263000-memory.dmp

Download

memory/4564-666-0x0000000000990000-0x0000000000A46000-memory.dmp

Download

memory/4564-713-0x0000000007350000-0x00000000073FE000-memory.dmp

Download

memory/4564-670-0x0000000003030000-0x000000000304C000-memory.dmp

Download

memory/4564-717-0x00000000079C0000-0x0000000007A3A000-memory.dmp

Download

memory/4564-755-0x0000000073250000-0x0000000073A0C000-memory.dmp

Download

memory/4564-753-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

Download

memory/4564-752-0x0000000009B90000-0x000000000A5C4000-memory.dmp

Download

memory/4564-685-0x0000000005BA0000-0x0000000005C5A000-memory.dmp

Download

memory/4564-749-0x0000000008150000-0x0000000008216000-memory.dmp

Download

memory/4564-745-0x0000000007B30000-0x0000000007B6A000-memory.dmp

Download

memory/4564-684-0x0000000005CB0000-0x0000000005E76000-memory.dmp

Download

memory/4564-741-0x0000000007AE0000-0x0000000007B22000-memory.dmp

Download

memory/4564-680-0x0000000005AC0000-0x0000000005ADC000-memory.dmp

Download

memory/4564-737-0x0000000007BD0000-0x0000000007D06000-memory.dmp

Download

memory/4564-676-0x0000000073250000-0x0000000073A0C000-memory.dmp

Download

memory/4564-729-0x0000000008B40000-0x0000000008E8E000-memory.dmp

Download

memory/4564-675-0x0000000005EC0000-0x000000000647A000-memory.dmp

Download

memory/4564-674-0x0000000003090000-0x00000000030A4000-memory.dmp

Download

memory/4988-780-0x000000000AFE0000-0x000000000B024000-memory.dmp

Download

memory/4988-796-0x000000000BFF0000-0x000000000C34B000-memory.dmp

Download

memory/4988-767-0x000000000AD10000-0x000000000AF9A000-memory.dmp

Download

memory/4988-768-0x0000000009420000-0x0000000009478000-memory.dmp

Download

memory/4988-770-0x000000000AB80000-0x000000000AC7E000-memory.dmp

Download

memory/4988-771-0x000000000B110000-0x000000000B278000-memory.dmp

Download

memory/4988-769-0x0000000009F80000-0x0000000009FB6000-memory.dmp

Download

memory/4988-759-0x0000000008790000-0x00000000087A2000-memory.dmp

Download

memory/4988-757-0x0000000073250000-0x0000000073A0C000-memory.dmp

Download

memory/4988-772-0x000000000AA80000-0x000000000AA8C000-memory.dmp

Download

memory/4988-773-0x000000000AAE0000-0x000000000AB28000-memory.dmp

Download

memory/4988-774-0x000000000B280000-0x000000000B376000-memory.dmp

Download

memory/4988-775-0x000000000B380000-0x000000000B44E000-memory.dmp

Download

memory/4988-776-0x000000000B450000-0x000000000B51C000-memory.dmp

Download

memory/4988-777-0x000000000AC80000-0x000000000ACAE000-memory.dmp

Download

memory/4988-778-0x000000000B520000-0x000000000B626000-memory.dmp

Download

memory/4988-779-0x000000000AFA0000-0x000000000AFD2000-memory.dmp

Download

memory/4988-758-0x0000000073250000-0x0000000073A0C000-memory.dmp

Download

memory/4988-781-0x000000000ACE0000-0x000000000AD08000-memory.dmp

Download

memory/4988-782-0x000000000ACB0000-0x000000000ACC0000-memory.dmp

Download

memory/4988-783-0x000000000B6B0000-0x000000000B6BA000-memory.dmp

Download

memory/4988-784-0x000000000B8F0000-0x000000000B8FE000-memory.dmp

Download

memory/4988-785-0x000000000B960000-0x000000000B970000-memory.dmp

Download

memory/4988-786-0x000000000BBC0000-0x000000000BC2E000-memory.dmp

Download

memory/4988-787-0x000000000BE70000-0x000000000BF0A000-memory.dmp

Download

memory/4988-788-0x000000000BA80000-0x000000000BA98000-memory.dmp

Download

memory/4988-789-0x000000000BB10000-0x000000000BB24000-memory.dmp

Download

memory/4988-790-0x000000000BB70000-0x000000000BB82000-memory.dmp

Download

memory/4988-791-0x000000000BB90000-0x000000000BBA4000-memory.dmp

Download

memory/4988-792-0x000000000BBB0000-0x000000000BBC4000-memory.dmp

Download

memory/4988-793-0x000000000BBF0000-0x000000000BC08000-memory.dmp

Download

memory/4988-794-0x000000000BF60000-0x000000000BFA2000-memory.dmp

Download

memory/4988-795-0x000000000BFB0000-0x000000000BFEA000-memory.dmp

Download

memory/4988-766-0x000000000AA00000-0x000000000AA80000-memory.dmp

Download

memory/4988-797-0x000000000C3A0000-0x000000000C3AA000-memory.dmp

Download

memory/4988-798-0x000000000C3B0000-0x000000000C3BA000-memory.dmp

Download

memory/4988-799-0x000000000C4A0000-0x000000000C55C000-memory.dmp

Download

memory/4988-801-0x000000000C440000-0x000000000C452000-memory.dmp

Download

memory/4988-800-0x000000000C410000-0x000000000C41C000-memory.dmp

Download

memory/4988-802-0x000000000C420000-0x000000000C42A000-memory.dmp

Download

memory/4988-803-0x000000000C690000-0x000000000C6F4000-memory.dmp

Download

memory/4988-804-0x000000000C7A0000-0x000000000C838000-memory.dmp

Download

memory/4988-805-0x000000000C880000-0x000000000C8A8000-memory.dmp

Download

memory/4988-807-0x000000000C8D0000-0x000000000C8D8000-memory.dmp

Download

memory/4988-806-0x000000000C9D0000-0x000000000CAE2000-memory.dmp

Download

memory/4988-808-0x000000000C940000-0x000000000C960000-memory.dmp

Download

memory/4988-809-0x000000000CB40000-0x000000000CB4A000-memory.dmp

Download

memory/4988-810-0x000000000CC50000-0x000000000CD16000-memory.dmp

Download

memory/4988-811-0x000000000CD50000-0x000000000CD66000-memory.dmp

Download

memory/4988-812-0x000000000CDA0000-0x000000000CDC6000-memory.dmp

Download

memory/4988-813-0x000000000CDD0000-0x000000000CDE6000-memory.dmp

Download

memory/4988-814-0x000000000CE20000-0x000000000CE40000-memory.dmp

Download

memory/4988-815-0x000000000CF30000-0x000000000CFE4000-memory.dmp

Download

memory/4988-816-0x000000000CF10000-0x000000000CF22000-memory.dmp

Download

memory/4988-817-0x000000000D280000-0x000000000D3DA000-memory.dmp

Download

memory/4988-818-0x000000000E700000-0x000000000E708000-memory.dmp

Download

memory/4988-819-0x000000000E870000-0x000000000E87E000-memory.dmp

Download

memory/4988-820-0x000000000E8C0000-0x000000000E8F8000-memory.dmp

Download

memory/4988-821-0x000000000B0E0000-0x000000000B0EE000-memory.dmp

Download

memory/4988-822-0x000000000E9C0000-0x000000000EA80000-memory.dmp

Download

memory/4988-823-0x000000000EB50000-0x000000000EC1C000-memory.dmp

Download

memory/4988-824-0x000000000BA10000-0x000000000BA24000-memory.dmp

Download

memory/4988-825-0x000000000E950000-0x000000000E9A0000-memory.dmp

Download

memory/4988-826-0x000000000ED20000-0x000000000EE12000-memory.dmp

Download

memory/4988-827-0x000000000EA80000-0x000000000EACA000-memory.dmp

Download

memory/4988-828-0x000000000EC20000-0x000000000EC6E000-memory.dmp

Download