Malware Analysis Report

2025-08-05 17:08

Sample ID 230331-tgwawacg3z
Target cbSetup.exe
SHA256 9ec08d76e4b810de2c3cbc7bd90787cc462deb0accc6996cab2394ab261c7154
Tags
discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9ec08d76e4b810de2c3cbc7bd90787cc462deb0accc6996cab2394ab261c7154

Threat Level: Known bad

The file cbSetup.exe was found to be: Known bad.

Malicious Activity Summary

discovery persistence ransomware

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Checks installed software on the system

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-31 16:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-31 16:02

Reported

2023-03-31 16:05

Platform

win7-20230220-en

Max time kernel

147s

Max time network

31s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cbSetup.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cbSetup.exe

"C:\Users\Admin\AppData\Local\Temp\cbSetup.exe"

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

"C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe" "C:\Users\Admin\AppData\Local\Temp\"

Network

N/A

Files

memory/932-105-0x00000000001D0000-0x00000000001D1000-memory.dmp

\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

MD5 1405ca134c2b41efcb9e7381e945a8cc
SHA1 9673bc6b45563c2e32babbe60d4329861891b7b8
SHA256 60ba85a1170d52a439fda22eea9ef4c8100dc6190aa40ce16c2c6614dbd1fbf7
SHA512 ee91604134d1e392903b377ccd7091e29dba93070212067b448db6eb207bdf2946a71b269d20a0853bd52ebff8028ac61801783f1c54a4c0eb8dc9d11beb0c45

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

MD5 1405ca134c2b41efcb9e7381e945a8cc
SHA1 9673bc6b45563c2e32babbe60d4329861891b7b8
SHA256 60ba85a1170d52a439fda22eea9ef4c8100dc6190aa40ce16c2c6614dbd1fbf7
SHA512 ee91604134d1e392903b377ccd7091e29dba93070212067b448db6eb207bdf2946a71b269d20a0853bd52ebff8028ac61801783f1c54a4c0eb8dc9d11beb0c45

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

MD5 1405ca134c2b41efcb9e7381e945a8cc
SHA1 9673bc6b45563c2e32babbe60d4329861891b7b8
SHA256 60ba85a1170d52a439fda22eea9ef4c8100dc6190aa40ce16c2c6614dbd1fbf7
SHA512 ee91604134d1e392903b377ccd7091e29dba93070212067b448db6eb207bdf2946a71b269d20a0853bd52ebff8028ac61801783f1c54a4c0eb8dc9d11beb0c45

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Languages\english.cms

MD5 39c89fa8be425804173803a7a83a0bb9
SHA1 509433338e73ef0a75a0a93c5e5ad5259e5b66d0
SHA256 36b224b14272969b0ec3cd2dbc7eb6db9310c406c7e6418c6c5fd8cac233e62a
SHA512 b3b3c0f6263be680d6b9aaaba94169525fa88bf78054da495e35676099dd04914e5f2474986743312327e95877b86a7b5b6b3362a9b98bd334de0c41488375e7

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Languages\english.cui

MD5 2fce4744e2a675b2a3ee4a630139fe1f
SHA1 ab0055ce13a7737407a7dcc33a2f9e897dde0cd2
SHA256 1bfa160dddac2ad84cd9b95d5f5dd279b9630c678a6a7606781a7633e93302f6
SHA512 15d23108c0e864acb9e166efe0f6a0c989363643e1267a01bffae3ec335c2fe24fb6323c4cb8386f3b44355232ccd8b5c40465c96908aeda26c4c12d9c4e076a

memory/1924-654-0x00000000001D0000-0x00000000001D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\License.txt

MD5 394b71d5be906737f7dae3fda89cbf9f
SHA1 0164d2e79a2e566d1df292abf25741d1d1bab6c0
SHA256 0ff51bbb01c6493f52a43bef5a862ab105b287dc1356081eba16e9567d1c5e46
SHA512 bfe880458b6b6616cfe1a97d4c8033c35dd4584fc82edba9a55ce8f8a7fd2212c2954084bc92e570bf16f6ee7a12b00bf644e3c2d92e6fa149097ca9b72856c1

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSrvCtrl.dll

MD5 cabf1a359fc4d9a7529b7985fbf1e8e4
SHA1 35c40f2fcb89066dadcb4c2746c015ed87f8337e
SHA256 b2c72ebb0e928eaf8ac32a47f54664ad3e6b3fe63608f743cd8d563c10110432
SHA512 e46d8ac23e54e386922e534e5450c42242a1f8ddc75b16399bd1b130ebd09ae78787f497b96e9f0dea966baaf7a7810a30824333bddc69af642deb2bea9b9778

memory/1924-658-0x0000000002180000-0x00000000021D7000-memory.dmp

\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSrvCtrl.dll

MD5 cabf1a359fc4d9a7529b7985fbf1e8e4
SHA1 35c40f2fcb89066dadcb4c2746c015ed87f8337e
SHA256 b2c72ebb0e928eaf8ac32a47f54664ad3e6b3fe63608f743cd8d563c10110432
SHA512 e46d8ac23e54e386922e534e5450c42242a1f8ddc75b16399bd1b130ebd09ae78787f497b96e9f0dea966baaf7a7810a30824333bddc69af642deb2bea9b9778

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbCommonDlgs.dll

MD5 839fc1c600c76689ef0009015a94f130
SHA1 bb5e784b7df15958ff6f57e9b2015a2454da8418
SHA256 60b0760f80d06975ad89a4508da6b035f302407ebcd6873ac6bf1c93624f0125
SHA512 6b18ca992b10d55905252461e871bace0b0e02a62cf377ba9e4a51b21751c83f31ad2cb1d861f19978750004dcdd7249788f35bc64cf60ac230f2a3d920bed0a

\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbCommonDlgs.dll

MD5 839fc1c600c76689ef0009015a94f130
SHA1 bb5e784b7df15958ff6f57e9b2015a2454da8418
SHA256 60b0760f80d06975ad89a4508da6b035f302407ebcd6873ac6bf1c93624f0125
SHA512 6b18ca992b10d55905252461e871bace0b0e02a62cf377ba9e4a51b21751c83f31ad2cb1d861f19978750004dcdd7249788f35bc64cf60ac230f2a3d920bed0a

memory/1924-661-0x0000000002FB0000-0x00000000030BA000-memory.dmp

memory/1924-662-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/932-663-0x0000000000400000-0x00000000016D8000-memory.dmp

memory/1924-664-0x0000000000400000-0x0000000000579000-memory.dmp

memory/1924-665-0x0000000002180000-0x00000000021D7000-memory.dmp

memory/1924-666-0x0000000002FB0000-0x00000000030BA000-memory.dmp

memory/1924-688-0x0000000000400000-0x0000000000579000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-31 16:02

Reported

2023-03-31 16:04

Platform

win10v2004-20230220-en

Max time kernel

98s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cbSetup.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cbSetup.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cobian Backup 11 interface = "\"C:\\Program Files (x86)\\Cobian Backup 11\\cbInterface.exe\" -service" C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_4_en.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_4_es.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\command_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\new_es.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_4_de.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_6_es.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\cbRemoteManager.exe C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\8_fr.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\recovery_ca.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\index_es.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\index_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\Boletus.gif C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\turkish.cui C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\index_en.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\recovery_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_6_de.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\1.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\11_fr.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\13.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\polish.cms C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\faq_cz.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\AlphaVSS.Common.dll C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\copyright_ca.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\faq_es.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\new_ca.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\cbInterDlgs.dll C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\10_fr.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\espanol.cui C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\parameters_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\install_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\new_cz.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\tasks_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\7_de.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\cbService.exe C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_1_en.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\4_de.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\chinese-Simp.cms C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\faq_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_5_es.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_6_en.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\readme.txt C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\2_fr.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\system_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\backups_cz.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\compenc_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\copyright_cz.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\system_cz.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_10_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_14_de.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\chinese-trad.cms C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\cbEncoder.exe C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\13_de.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\catala.cui C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\turkish.cms C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\appserv_en.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\Tutorial_Images\13_fr.jpg C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\Tutorial\tutorial_12_en.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Languages\ukrainian.cms C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\cbServiceControl.exe C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\faq_ca.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\copyright_es.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\parameters_ca.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A
File created C:\Program Files (x86)\Cobian Backup 11\Help\theory_fr.htm C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\cbSetup.exe

"C:\Users\Admin\AppData\Local\Temp\cbSetup.exe"

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

"C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe" "C:\Users\Admin\AppData\Local\Temp\"

C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe

"C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe"

C:\Program Files (x86)\Cobian Backup 11\cbService.exe

"C:\Program Files (x86)\Cobian Backup 11\cbService.exe"

C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe

"C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe" -service

Network

Country Destination Domain Proto
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
GB 95.101.143.145:443 assets.msn.com tcp
US 8.8.8.8:53 145.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
IE 52.109.77.2:443 tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 13.89.179.9:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 52.152.110.14:443 tcp
NL 8.238.20.126:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
NL 8.238.177.126:80 tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp

Files

memory/1896-146-0x0000000003490000-0x0000000003491000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

MD5 1405ca134c2b41efcb9e7381e945a8cc
SHA1 9673bc6b45563c2e32babbe60d4329861891b7b8
SHA256 60ba85a1170d52a439fda22eea9ef4c8100dc6190aa40ce16c2c6614dbd1fbf7
SHA512 ee91604134d1e392903b377ccd7091e29dba93070212067b448db6eb207bdf2946a71b269d20a0853bd52ebff8028ac61801783f1c54a4c0eb8dc9d11beb0c45

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

MD5 1405ca134c2b41efcb9e7381e945a8cc
SHA1 9673bc6b45563c2e32babbe60d4329861891b7b8
SHA256 60ba85a1170d52a439fda22eea9ef4c8100dc6190aa40ce16c2c6614dbd1fbf7
SHA512 ee91604134d1e392903b377ccd7091e29dba93070212067b448db6eb207bdf2946a71b269d20a0853bd52ebff8028ac61801783f1c54a4c0eb8dc9d11beb0c45

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSetupI.exe

MD5 1405ca134c2b41efcb9e7381e945a8cc
SHA1 9673bc6b45563c2e32babbe60d4329861891b7b8
SHA256 60ba85a1170d52a439fda22eea9ef4c8100dc6190aa40ce16c2c6614dbd1fbf7
SHA512 ee91604134d1e392903b377ccd7091e29dba93070212067b448db6eb207bdf2946a71b269d20a0853bd52ebff8028ac61801783f1c54a4c0eb8dc9d11beb0c45

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Languages\english.cms

MD5 39c89fa8be425804173803a7a83a0bb9
SHA1 509433338e73ef0a75a0a93c5e5ad5259e5b66d0
SHA256 36b224b14272969b0ec3cd2dbc7eb6db9310c406c7e6418c6c5fd8cac233e62a
SHA512 b3b3c0f6263be680d6b9aaaba94169525fa88bf78054da495e35676099dd04914e5f2474986743312327e95877b86a7b5b6b3362a9b98bd334de0c41488375e7

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Languages\english.cui

MD5 2fce4744e2a675b2a3ee4a630139fe1f
SHA1 ab0055ce13a7737407a7dcc33a2f9e897dde0cd2
SHA256 1bfa160dddac2ad84cd9b95d5f5dd279b9630c678a6a7606781a7633e93302f6
SHA512 15d23108c0e864acb9e166efe0f6a0c989363643e1267a01bffae3ec335c2fe24fb6323c4cb8386f3b44355232ccd8b5c40465c96908aeda26c4c12d9c4e076a

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\License.txt

MD5 394b71d5be906737f7dae3fda89cbf9f
SHA1 0164d2e79a2e566d1df292abf25741d1d1bab6c0
SHA256 0ff51bbb01c6493f52a43bef5a862ab105b287dc1356081eba16e9567d1c5e46
SHA512 bfe880458b6b6616cfe1a97d4c8033c35dd4584fc82edba9a55ce8f8a7fd2212c2954084bc92e570bf16f6ee7a12b00bf644e3c2d92e6fa149097ca9b72856c1

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSrvCtrl.dll

MD5 cabf1a359fc4d9a7529b7985fbf1e8e4
SHA1 35c40f2fcb89066dadcb4c2746c015ed87f8337e
SHA256 b2c72ebb0e928eaf8ac32a47f54664ad3e6b3fe63608f743cd8d563c10110432
SHA512 e46d8ac23e54e386922e534e5450c42242a1f8ddc75b16399bd1b130ebd09ae78787f497b96e9f0dea966baaf7a7810a30824333bddc69af642deb2bea9b9778

memory/3760-743-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/3760-742-0x0000000002280000-0x00000000022D7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSrvCtrl.dll

MD5 cabf1a359fc4d9a7529b7985fbf1e8e4
SHA1 35c40f2fcb89066dadcb4c2746c015ed87f8337e
SHA256 b2c72ebb0e928eaf8ac32a47f54664ad3e6b3fe63608f743cd8d563c10110432
SHA512 e46d8ac23e54e386922e534e5450c42242a1f8ddc75b16399bd1b130ebd09ae78787f497b96e9f0dea966baaf7a7810a30824333bddc69af642deb2bea9b9778

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSrvCtrl.dll

MD5 cabf1a359fc4d9a7529b7985fbf1e8e4
SHA1 35c40f2fcb89066dadcb4c2746c015ed87f8337e
SHA256 b2c72ebb0e928eaf8ac32a47f54664ad3e6b3fe63608f743cd8d563c10110432
SHA512 e46d8ac23e54e386922e534e5450c42242a1f8ddc75b16399bd1b130ebd09ae78787f497b96e9f0dea966baaf7a7810a30824333bddc69af642deb2bea9b9778

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbCommonDlgs.dll

MD5 839fc1c600c76689ef0009015a94f130
SHA1 bb5e784b7df15958ff6f57e9b2015a2454da8418
SHA256 60b0760f80d06975ad89a4508da6b035f302407ebcd6873ac6bf1c93624f0125
SHA512 6b18ca992b10d55905252461e871bace0b0e02a62cf377ba9e4a51b21751c83f31ad2cb1d861f19978750004dcdd7249788f35bc64cf60ac230f2a3d920bed0a

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbCommonDlgs.dll

MD5 839fc1c600c76689ef0009015a94f130
SHA1 bb5e784b7df15958ff6f57e9b2015a2454da8418
SHA256 60b0760f80d06975ad89a4508da6b035f302407ebcd6873ac6bf1c93624f0125
SHA512 6b18ca992b10d55905252461e871bace0b0e02a62cf377ba9e4a51b21751c83f31ad2cb1d861f19978750004dcdd7249788f35bc64cf60ac230f2a3d920bed0a

memory/3760-747-0x0000000004160000-0x000000000426A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbCommonDlgs.dll

MD5 839fc1c600c76689ef0009015a94f130
SHA1 bb5e784b7df15958ff6f57e9b2015a2454da8418
SHA256 60b0760f80d06975ad89a4508da6b035f302407ebcd6873ac6bf1c93624f0125
SHA512 6b18ca992b10d55905252461e871bace0b0e02a62cf377ba9e4a51b21751c83f31ad2cb1d861f19978750004dcdd7249788f35bc64cf60ac230f2a3d920bed0a

memory/3760-748-0x0000000002230000-0x0000000002231000-memory.dmp

memory/1896-749-0x0000000000400000-0x00000000016D8000-memory.dmp

memory/3760-750-0x0000000000400000-0x0000000000579000-memory.dmp

memory/3760-751-0x0000000002280000-0x00000000022D7000-memory.dmp

memory/3760-752-0x0000000004160000-0x000000000426A000-memory.dmp

memory/1896-753-0x0000000000400000-0x00000000016D8000-memory.dmp

memory/3760-754-0x0000000000400000-0x0000000000579000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Languages\ESPANOL.cui

MD5 2c2f53506c99537239fb372940816329
SHA1 3acb20852739ed778192ce1e7faf6782475da7bb
SHA256 5972e0ff0c6ce1ca8108c8c7a941ab9e38ff4aa140348ee3d72fb4c67655b48b
SHA512 044c48730600373fadd6df83da8010a8a025d8aee39a9af19551354cc2fd8a6b071b8d5f95f0805c800b8e5e0b7fb8b5b609f90462b338d73dbfa64f35431faf

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Languages\ESPANOL.cms

MD5 b1325e5d7ec6d2b28c44f14a1d09b474
SHA1 10ba5a217b645846d6b4974a658353b193792c2d
SHA256 8665459d4b0c8e30b9f380568275944111e309ff3cc516a048d30c9bcfde6043
SHA512 886aebc2c066be1fcd9255c7d6fb892f182277273d75a41b66b405647528fe282551dde2f9af0c49a03d806f683e7e7e282012fce5c3703b81710b8ce83fc2c6

memory/3760-760-0x0000000000400000-0x0000000000579000-memory.dmp

memory/3760-764-0x0000000000400000-0x0000000000579000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Cobian.exe

MD5 4eb0e1de875819141c23491b1bc39d74
SHA1 fcf9bee8502dc909fc6f864b57958ca3ea96cf95
SHA256 4e3a6704ba54271501cb7bf2c3567c359b4451158c6441e5db76a7d3c7e00ee2
SHA512 932d36668790ce528811d3e13b5d151814dd6d339d9ca7fc3ee42f8174379c2ef8746fe8f6817f2c5fddb304c64ff8aa396fe7efceda2081f9eac3f9497f818f

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbAbout.dll

MD5 8e95bc3fe95571a34a7052a00f5ca174
SHA1 fa1898effbe58ed8f54333787e7769cc59e633c5
SHA256 bb69b95bb47ac72ac3eb9f2991f783443e0941809e68e03c9c3d519d2c7ca996
SHA512 3ab14e78c29eb98342de49eab23cdf078d0996d8498bff1a3f035579f4eed2c311eed6464e3e87995cad4403ef26c9518a30b16142b863e814021376323ee8d7

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbServiceControl.exe

MD5 55201c5f532652368d2195fc6c20f680
SHA1 e51e6513b28ab8eb07d3db884ee0c38256138368
SHA256 8a48de5a83fa624bf157e5152d5a4afc60896dbe98b9157fd6236e5d36dabc70
SHA512 eca1bd02177868a0a9c8074908db6c77eb31782ee7444650942d02736d248dd876680f4b8f47630aa98f03d161643ec37b5f6a130a7aa3655e7ee022a82c8709

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbTranslator.exe

MD5 f97943e222df15d35e1edc35b6ac6610
SHA1 7f7458d07408d7a754ff1dc3218cc3b4bce861d1
SHA256 75fe3812246a6ea2f08c5645072c8cfcc97796a2b58b5d83c95d8e70ba5b6b68
SHA512 7dad4f2be495de47391a462fe85de71bdc02ebc806d01e421fe95bb7439ea2131cb020868578f23125edf4f8d37ba31032f8f235098ef521d92df4fffafa65f1

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbEngine.dll

MD5 b0b55aa55522ef90bd15b6fb92cac4d8
SHA1 5a1b652bde502eb05792d8f9a9443cbb682f5110
SHA256 38350e4b736e4c5372b1989327a87f27bafacbb2b9bbfb67b843f7c14f556447
SHA512 92f4ce13ea41fa68431a065dfd586eb299c5251092fb02376db9ad42ddb322672563e4d098f50d5f37f25ef8d06bb671b898f35f0060603abb40ef5a9da1fe6c

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbInterDlgs.dll

MD5 1933314354c6d8d4da6749ff805b2711
SHA1 b75f0bbc8f628ad2b35b10b9f85b565e2c463846
SHA256 004b0f14f31e91f779f081441fd975dcfc7d98981fb05db7ffeb344d48b65bf8
SHA512 8e41784b828fb008fcc94f64e2aaf85c7d8617abd152928001987c707ea1af85da5cc96beeb60c5fe3a788c2d88d6b20715ce151ab55a8335edc7756ee0739e5

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbPermissions.exe

MD5 544fdee34e7816ddfe8879892880c167
SHA1 9079422c6a4601c9be6f688980c073d1a573d231
SHA256 6afb10f16d6146525ac00fe550a13ed0584e1049c6ab76b2b80f0602714f1bea
SHA512 f355d3bc6b996ebb3f0b42438edf3eb1b3acdc75d39d3275db8501b49b25f403365cc077bc039bf1399afc5265c629543c8367bd28a75ecfbd638674402385d4

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbDecompressor.exe

MD5 34a1fac54299b856c213f6ec4248d3ca
SHA1 9cfac6e6df376b27532a5025f319a169255f8f87
SHA256 e43c098ce83a254b0728ab094a6e8fb131dc859d517e2acdd16c1f6d5b43b170
SHA512 5acb6d490492ac01c4ebf8637617ee8ca3189b5f87ea93c6637641daaf1f2a2ecabea197bbaabe89ac29ab7b31b8d21dd2675cc4d7efd41b26d142a3d41df53e

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbService.exe

MD5 7ea8ac41a2e8426ec7079c44dba1d254
SHA1 8877afb33ade2c8429607a1982473ae299ce4f97
SHA256 89c9242d0838551aeaf811f29b48b2338a05dc2f072a16a671d7b021d7b9c225
SHA512 74c1eb305538af252a74f1b338e9b0dfadd6679866b5627e69de42ba5b15b6e564443e85badda19175e0a6c8ec870e5ecd89d7f94158c8ee3202cdf511276150

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbEncoder.exe

MD5 1cb5abf0a93230672155ad8e9b1ff426
SHA1 759aa22d45f6fc2618116d882f0118c89bca6adf
SHA256 b0af1890189146c6554f28e285b8f307051096fc04e0238496e74fe65504f0a4
SHA512 4c1849413e7ae008429151a685ebbced1a136ed740fc8174b92b7f62f289a7acf027dc17b264882ce00d53baf2916fbbc5f84f2e19ff8c199587ea1215e1927d

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbSrvSelector.dll

MD5 8e5e4aa996a5fe2ae97d4988ec5e479d
SHA1 3a570838c2ef7d7635b9b524aadb13896c4ee46c
SHA256 863a99c83e7218a26ded6042aebac70412e2f9ea7c7c82d90a297324f3f5fb2c
SHA512 b836b63192cef6773e8542a168e5705c946c8ef6e422bdba99d8aceaa35a75861dd62455eb186ab8dfb9e3c8af7295895b4b3530b0f01187d7767caadf372e07

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbDeleter.exe

MD5 3f65398bde56fff8d3d19f395baf5480
SHA1 e7b8326ceacaf53accd33ce16bac46bca84b4256
SHA256 b2ac00fb7eb2c05566e2e97b65efb3f3acca2b518577d1fc1b9d855a26f3fdbd
SHA512 2df80ea9c3b9556cdd664cae673957f686d648aadd5b3691970f7b3003c744a1e3e46cb4892af31b3694a16295ee58838d851da16d5e00d57e3bec8cb253e6b2

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbVitalFolders.exe

MD5 f2f67bea827bd8849f07a569482d4b64
SHA1 b9bd965af9e2fd26cd98057311a3605c6610ff18
SHA256 30a81605cb5ecec1029f5500a809027b4883ad34ddbb04fd6f4e3ccb02997518
SHA512 c0312df51401d86b528081c2023c3d88844654268edf14a86265228b5c90d5d0c9b0d77e089addeb58792c9733e3e34ae4904754ec9908410ec620381eb45345

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbRemoteManager.exe

MD5 70b5852cb5538e19c380335cedb3fc6e
SHA1 8f444207f966a09deb14765af1dd3935b5041854
SHA256 e4070478c12cd6a3ff7ebf27fbbfd7ab93c9a3b41da68c3878387052cf219bbc
SHA512 7f3b933facea615f013aac0f76e1b2d88495df32099359728cb635ef7ecccfd17a088d8ddf7ae89d1578dae97ccaccd7bb688ac8551f4f296e0ac6486badd771

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbUninstall.exe

MD5 24f83e82d8ae4a0ecdd923eb64e3f6e0
SHA1 edebbfe12ff2403ac459a8d6c1b6465cfcac9f30
SHA256 e9694274d5b919741dfa81cd21534fdfa425a61d0c12bf7f6377b575a1bed6d3
SHA512 6be7f16f07f03c5ed42b77e3d20638c5344a1e10a7098ed269b0aa6271f8e417806fa46c637eb7406314f22bcbdbf048c0094039e61631130f0bddb988af302d

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbInterface.exe

MD5 6bdb90d0d8235a746f3c0f554b6f7181
SHA1 b8690161df8887cdc4859079fe882637d39ef0cd
SHA256 a67b5916d4b5017b3f1c212ba1f2a45daa3abafbf600dfc952bd4e8506f02223
SHA512 0caa32dbf9e974baf803194511c5265db816ed9d21dd4e654cf7f2d3cc50c300c1f22fc7d1816a38d69f7341f603c52cd1d9192b61f5439315924aa9b554c1f8

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\AlphaVSS.Common.dll

MD5 53efc4d2b0dba778b52af27c7d26d640
SHA1 f40db4d3fb3728bdd580312841fbdf35d69df6b4
SHA256 7e59285f5db9121b875908ade80019af3b42cb32d6cfa31818eeadff9bf07e4c
SHA512 6d306c7302cc424fdff82e52224a7fcaf0880a82b17024137048c0fe0e9d511f719955547d0f4c823e636d232a0c6fdc60f599fd5c67ccbe22c144d1d28816fa

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\AlphaVSS.Win2003.x64.dll

MD5 c45323af631d40ca293ff5a58d2a7d27
SHA1 90c8b3a91b662b15119188da74553549996696f7
SHA256 569432b0446c0644b771775c38ffa5934d79068ab9731c744f73f8d262d55f30
SHA512 8f9569a240137e9de4169ce9d7f08b689429d92391b914ae9ca8ca85fff6e6d71e4cc68dcb3662f81bf4236343d25b9479352b31e157eaab838d8efee64ce43f

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\AlphaVSS.Win2003.x86.dll

MD5 7878d16249767605afe37c1432fcfa74
SHA1 2749e330cee83d90574334a9ec24760049121aba
SHA256 e017d0f00fa2a55e08accf25ebd2238e16c9d969152c6fc611b6bddaa4fe2c5e
SHA512 60bdce65bfe19f8c3b053d09b8a1547b5aaf713bdfbee256954423cd182c7d4377e781f6a78ab0f9f1dc26a36801f569b56e3fd981902aca5022fdfeac2a682f

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\AlphaVSS.Win2008.x86.dll

MD5 03de077968175c048347c1285d5b7998
SHA1 648784deaacd369329117ed561c85a56e63b2101
SHA256 069d8ecfcc80ebc132ad2e0949109b28fa97f34b9521789445ad40480cc2af2b
SHA512 bd6b74c8db8fae3b12339f0cf9aceb734e525f01f59501f2e2eaac12929808716c6fd6400931692820d492db4100813093aeb2b5823a0d9e01e9355e4252579a

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\AlphaVSS.Win2008.x64.dll

MD5 dcc786796a858db76acf36e16f07e7a9
SHA1 a324aefca1e6c53e82bc0ca73a6df990339940da
SHA256 3785b34189b6d324d8fc8c46f2db8c8e6f23603f91505db4d9b5e8312277634b
SHA512 f689850b7f34d11aafd94b5d2afb415aa896035305e496a27977d0d6577d55d020a56e743070c72602adb1deab831f303b9decb4fa3c2ef64e491f4097292fc8

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\AlphaVSS.WinXP.x86.dll

MD5 5305bf27c2f84ab1aa3283e1b6aea49b
SHA1 bdfca604e4263c3f7633534f879a65856f44dd12
SHA256 1ef82607b9d863385e09d88f53cce1937416ee415f328882848f7777cbc8cb81
SHA512 ef4737f7b400cd9d437ec36dc3f7b2e1fa95c78bf4686ccec7ec1a49ec1222216d4b4e123868e36d9acb339afeddae9e8f5e64286fc64a8de7579d1c3669a0ff

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\AlphaVSS.WinXP.x64.dll

MD5 585cda20c4f67d814bce3346503c6db3
SHA1 d941648398039aaa1ff9b01f60d7edb8811bda71
SHA256 94927c969224125a2d62c434269a027cd676978a71905add6f753c01b19e98ee
SHA512 3a65fec0dc4560f153474e75eed46a4ca6228cebb95ecdfcb5312183f1534a93d1f4754a54db63dcc0eeb6a0e7e973478452fd880a0cdf95f1b15245739b0dc7

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbVSCService11.exe

MD5 58bf7714a312698108a96d0de2bb6825
SHA1 c59633998136c91c166e288cdb68380842a1ada0
SHA256 87e0ec24520c9c421af6a680fef42e18911aaba373a9f927c5ce77ad50f8196f
SHA512 88e7d31e4eb8cc87f3ec40899053d81765af9f58f4f7a297d29aa0cc1be9535f8ada47aab8c512eb3114492d6f529c3210923164bf31b7752f7b553d1077e329

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\CobStringList.dll

MD5 cf6b9e075464ba8be42fc69c46ee2ee3
SHA1 2f7357f77c84355cfbdeee7669a406abda07dabb
SHA256 7d9a43f6ae90c8af65697939b88c1f08ee306e5d9cfb95396e68ec9f00096d38
SHA512 7eff14e9e8d12ccb9ff7412b985e7764f713523ada90700e643faec21c5e15853b6e7a905a04af44d634ba0962454262f54ab6dc3f1489205fab34e0480dd945

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\7za.dll

MD5 97bab7fabb615f1f24de85e5068673b8
SHA1 9ef018974f73332505f638f4ba64e94925f2eb98
SHA256 3ad935efcde4ecd93a4650294038beb4c1cb71f14ec464256c44aafc2728ef9d
SHA512 8a5afde3aaadec08b7c6d46c6fdfe6bf3536cef48ca606eae4579c5e65021b6387da876e71504933417f0256bb3081ed4867a1ff8fe1ba55f025d59f52ca1894

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\ssleay32.dll

MD5 98fad6f306fbaa1b6fa9d22d864a9bdf
SHA1 688611cb51e2cf1753c42ba00ab190edda3f1338
SHA256 57d22eb6322cf37c8ccbec1c63e5186917189843c337e5b887af93a63ced2ab1
SHA512 06fa53e677e6294fbe75e0c8da63b2305368985a6be25607adf197dd26fca867f93588e5434943bce6a8040d1026dc4e0d60a2747c010cf060d8eca210c737c9

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\cbLegED.dll

MD5 9cdd347e03eab7740530d8aa91fd646a
SHA1 c06159c844793a13a8df2d2a15a2833a4e7000f7
SHA256 6e75bfae9271adec87bc4dbe1e9a7cbad206617ff906ea26fdafc2874fcb0de4
SHA512 739fa1012e8669ec2b1f831b941a27a32df9e00cf205cb8184752b799a977819f5fa65ecad338b3ab8b070a45f7b5dea204fe43c15fa9348b4041132c2059c38

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\readme.txt

MD5 b4c10c3ba5fd67ace916b3b6fd4acaca
SHA1 e6c40bedfb1d75124739524230a8f14e197a28bc
SHA256 77a55c22121a5d6c1a6d6611963a5a32a228236ace8d99ca1fa2b83cea3ec69e
SHA512 b7de972fc89f5481cd256ee754c9e585c03e675dfab1180214d247370938bef8d3ce0132104f10168931c269710ec04bc90cb9da7abbf802010cad6946eb93f4

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\zlib1.dll

MD5 99e402544e67c8b57be64cac89760f3f
SHA1 67a0bf698c3a58f4b1a6e1f4c11165d494017bef
SHA256 91ca3a9d557ea54bb7283c3df0772f856f53f825c67af22c59b973c31431c530
SHA512 f950d4030d541fd2767544883cdb8d10c01b4c34f85c318a020bd9bbfb5c4e15a2b1dc6ef5e0095f7c397ef798db9a8f7b3b9cf9fbcc9f80c6766d1cac989e1b

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\libeay32.dll

MD5 701b20e1081812c3b21bca03a987dd48
SHA1 24f4c132adf6a0809b832193537fbf7fb3c1cd87
SHA256 5c10a4a2ad82a4bc16fc0007f68a8fee67521a184750349cfc5e5c8aa7530aeb
SHA512 b6789ecbad97fa5703e44ab4525800ee9a4b30c7ac199f72e5e14282daf96053456d0782edd61f93c357c4e6e8380e08604be7b848504eec57533ff3f8cd2f46

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\TReadme.txt

MD5 0225616f79044d86e4e3bc913a2dd1b5
SHA1 11cfe353c1572f4fe2f4026f49fc17cd69523ba6
SHA256 61e7b95ea10d1bdf5bf418305ebb2db07d8859ac3b0a2bb0a923a8d7ecfdc8f5
SHA512 9036e91265d33ea74246dbd9ca40062c44827ec6fedc96914a5631712f19e12554b130cd8a890eaf6592446e9e761180d2a6302b1e721844457893dec0f7ae82

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\versions.txt

MD5 2f7954c906b9a3bfa2ae5bddcd2de849
SHA1 babf43bd6103f8a7c9fa71e161238e9b5b22b851
SHA256 ad9232b4f1e8ce4f4177cdeb2e799464b16692f83865250f1367ea074e3498da
SHA512 14cfe3692f9befa94cb25ad2427a801d4307899034386d16e87a39eac59114a8cffc45ed38f1e33f0c82675626e507f143087c95420a54eb0575e1769b769560

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\history.txt

MD5 8533de0998479e79ea9f71ee2748cd10
SHA1 7c7180edc61f494cda5eab404dce869d0631190c
SHA256 603f1e43498ee6265430cf50c6d51a75de9b8d9af508741d0986a9deda968bf5
SHA512 382b974595c731380cb9cc2f5a91c20cd2ec5fb137dea2cd6a0d22f4899c71c25b57bb2fd9b2220d42b18269e9aa35d832636476fe8ca13f751031553360a341

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\appserv_cz.htm

MD5 e33c1fc86e0b4cb7f20cd7fc6ce96351
SHA1 c70ff5206d96a670b7de79c533954a08c3b14d86
SHA256 8632f92e6a75651c9e878ffb25793b1a2c4bf70feb4a07f8ce13c9eb1023ec09
SHA512 b5d1b7a98022349c363b603b35ccfde981a6ced6af1c9f57a0d12693a2820b9065beea5863cc8c6983b32d70fff4bd522dfb57bf89b23495189feba6fd549282

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\appserv_ca.htm

MD5 6a56e2b9e60268fb3bf6cdd7fc870efd
SHA1 df7b9cadbb439834af6b266190403f10232949f0
SHA256 60a17df48a46e24351dcdc4ea18e8acb352b4e28caa864b215d31a0d3aec8d4f
SHA512 35c38e4b3d66a1bd34fa8b2389bf1f0017cea1b47f7beaaaad381378418806336316369ba4a7bc0678cce4d862292e9dd9d3313ebdb5c83040d43783537127ec

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\appserv_en.htm

MD5 137e572c991844fb3d7979e1e3d7d069
SHA1 21107b3c8e119a1b32b007d084addd78d84ae3f2
SHA256 a9eb389432c75baa4027fd7427027d28ce568acf47deb0a9847eb01963efaa11
SHA512 6213c4100eaa531b4d5b306abe6c2b8164adc642731e2ffe2c6b4a67552730feba08b8a8e7b631cf38deffdecdaaf9dd77e893f9d7e84abdfe7f5942e8633f5f

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\appserv_es.htm

MD5 de40effb74262cf5b7489460a6a61c45
SHA1 13d190fd58034d6d43fc3f05de3908b3c42ab50b
SHA256 c0d86df27f68d3af440979c6a6aed2a70fd80c0579983fa4dff8bc5913e99aab
SHA512 0c9d90c425ac32988dcef8a93b49e4f126e29330f2948178b4ce9b787901f8ab0634a445c4dd610ac9cdcc3b6d0f1dcb9c7669c8ca607464eed9aff3cdedb813

memory/3760-847-0x0000000000400000-0x0000000000579000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\command_cz.htm

MD5 968ebd57d967d67813733405d69437eb
SHA1 ade59a31220b00616afb282b18d8186c14f00b8a
SHA256 566889154632f7e58382c45299cdf90f57062d6ad8ef14d2b287fb6965a29ef4
SHA512 90f761d699a2cb3b74396d6f680c4024b7136493cfae9d56e09eb8fdd0be9470f57a2af6de30fb5330bd21f447dfb8c3732b546f4ff77f96abfa0753e6214b36

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\command_en.htm

MD5 5da379fd8d9116d7df7eb7205b6be79c
SHA1 19539e325a069198dc8809727fd6ea3bffcc4e40
SHA256 eac84d1fee8ad176fa02de6b1f87efe5d36203630c3c145af3d525a8c04ad10b
SHA512 c0ce5751e9d2fb1085d5d4ac48e97ae267db3b1c5847caccd8c7b69ea4f0ac6419e2feea795a7ae013170edb1fd368f459d0383856e1e2e04de960928262d6b4

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\compenc_ca.htm

MD5 6123dc7050863d1e98842f756996c7db
SHA1 5adfad2a499ef9f147173199782d771d994c6bbb
SHA256 143bec6a617518142640a8a06d0b3fe01ebaf553326f4ab99bf4899543149dac
SHA512 ee5fcbf29fbf3eb27648b8eefa07f82bbfeefe949050d8b625fa566f80bf135a1d77ff09620beb27ba43f80e06053b37e923827f6a80fc8b59847fce34fa5c0a

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\command_fr.htm

MD5 43df7ab3d293951a1137a82e723dfbeb
SHA1 6eb465cafbab3b1f744f3a3d06d97bc1385c8039
SHA256 45cb6ebc5dd1bd07fe41d0511629e293431fba257e68c9695514391643d441f6
SHA512 2b5f41e6943e8c86058a3a57a21b1a47957045c3dd0856bb9f3cb74ba4455004ed6534d27238f7f547f897c28c4fc824d4ec3708c585a56c19a353726ada87e4

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\command_es.htm

MD5 fd3faf2e6e0e5a8a62d7c402e040a85a
SHA1 e7fdaa451024735f1d2ea6b2ef70a836d8bf85c1
SHA256 62526c884cabc570f5d1fb2442a10accc35051d16604e3234af8c45e3b7c5f07
SHA512 f1c284a7653e1a9402dee2d27ce656e2f42e77a1003723b116cff2279ffc423bbb28d0d6fc0c8b271e049b9da36df390fac0662366cbc7bd8944d2ed773f067c

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\backups_en.htm

MD5 3b932b1d05897bc65391df926eb7ae7f
SHA1 e93fae2899b393db240ff832500f1270ae815d50
SHA256 278463a98a8978ec636bc013acb9b5bac7f4a081fc3c4e1e748a6315fe3c2c29
SHA512 3a76de9975421bd19ef44294f4cefa8eb6c7c2966508834cc0f23e3ac2e4a5e89210f9d60b12cf3af550e34fc79e4c86c8c11629d38190d4d7e69a9df2544b85

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\command_ca.htm

MD5 0f68c862a38ca1bf60be561349ad8323
SHA1 98f0bc73fcac2cc666f887780a2434d30d13c727
SHA256 fa304d60fb3770134a68de200c3a71ec193b3b03033cbbbab09d08ec9c8a86ae
SHA512 f84f706168dfd2a2617db5c40abd81ed063cedf8d611ee705f7d71a767b8a758e675a79313f0259757a3bd2fae92f117d3ca37204536d010205932320871f2b6

C:\Program Files (x86)\Cobian Backup 11\Help\CobStyle.css

MD5 aa302557c3bcd619dfa661d7f2cb33ed
SHA1 7e9fcce2bf86481231462d1b3c4721a9c64620ac
SHA256 a21bd4c2f392e2ffab9dfa01f3d77821ae181b61593f8941f69602874e0dd8d8
SHA512 8a0e4d92ceb9b4c240c31905e45ed9e568e33d314b56b1e2d1499e9174165fcf29e44eff09f9f6c2e6542661c8d06c3da9e766f2cb2aa0a1c094cbc77110ca02

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\CobStyle.css

MD5 aa302557c3bcd619dfa661d7f2cb33ed
SHA1 7e9fcce2bf86481231462d1b3c4721a9c64620ac
SHA256 a21bd4c2f392e2ffab9dfa01f3d77821ae181b61593f8941f69602874e0dd8d8
SHA512 8a0e4d92ceb9b4c240c31905e45ed9e568e33d314b56b1e2d1499e9174165fcf29e44eff09f9f6c2e6542661c8d06c3da9e766f2cb2aa0a1c094cbc77110ca02

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\backups_fr.htm

MD5 ec318d2cb0bdd84d60221cb9498b40dc
SHA1 fc3bcdf0064fa8c4cc7fec45681d2751e5b12c2a
SHA256 af212bbe5490ee0804444fbb81f9115d627c529640d3f04583f75bcc6926b80e
SHA512 1d1bdcbeac5869afcff58d17c4346232359a544b852138fc1c3ced1711aada4c6201d5ce90a20bd5499f8c11d5e471c59380cbad0e8757596e6919b378c73fb3

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\backups_es.htm

MD5 0073ff463e731d1c42b8fe635027f667
SHA1 a97b0a7b478817973642dc17279178ddd358fdfa
SHA256 62a5e65f4acdb9d383e5a86f40925d5a42ae913050c1d06c301f6947294c1e41
SHA512 b242b64591b47fa149dbdd298b40d883364e30453dc571d6820dbcb775014987183134192008bd44519613cf84b0d799de799007958c4658ee113330d5e30bec

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\backups_cz.htm

MD5 8de6fb2e40da94ed5e49f26a875fc89c
SHA1 ffd33f166cf7257a826d06812863151a2b40fb24
SHA256 82dc03edfc53179658f337b7aab6ca00582759d042a0ef6e3d7b286f90a9336f
SHA512 72b9b308e5df59230224f40e094ff81af265be4ba35a24af2ba5befa342212653403f6c6d160e4e0e3cb66383c55b633a321305fada8c46eb5dd786e6d81a1bf

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\backups_ca.htm

MD5 6d8f28d6a23b5256b1a8444dce5e1718
SHA1 83fa9c7155bddf959711ff48c182905245ebf070
SHA256 fa73a85608b13c30a79ba95a413f2352b6b6b4d01b6ed8ae93834e25b21cef23
SHA512 816f6cddc06e29b07656f8aea30ae953e072dbd103e3a3ed503d502574a818bb0628d6257d2d9e676b6ef15cacaad20cd7b8158742e161284e58578031c0c803

C:\Users\Admin\AppData\Local\Temp\Cobian_Backup_11\Help\appserv_fr.htm

MD5 11b1dba773e9eaacf07f889046f3418b
SHA1 e74d468bf536add7af6eeb94b3cde4317ad53e8d
SHA256 4fdecedb07a50a3061be0378dcceb09453f4eb4700eeafcae31fe331402e660f
SHA512 660ecb73ef6805289f0ca3520cdc458e4553b4541450dfa721ad7b447cc6a9f0c3aea89f318eff3f7b2adee86e0fabe047779ef9e951f398a45598525f8aa985

C:\Program Files (x86)\Cobian Backup 11\Help\Images\english.jpg

MD5 5ffc0cdcfe0969255b0287d90dcdb5d0
SHA1 0568414d178e8d4599078304d90b494da10cb9ae
SHA256 caaf4db94ff973efec3306471cebdbf29fb6c195c93a90e8e0a3820e91748bdd
SHA512 fe616633d63c9c34f5eb6b46b9f2afd4d952ec3202300b14098a52a8e8b2dde862e199b7c96828c61f99c5621f94f7be18418dd0dba70f6ea5d1f30fe9542c2c

C:\Program Files (x86)\Cobian Backup 11\Help\Images\french.jpg

MD5 0e351907dd832eda9c00e4b8d9352c5f
SHA1 f92a43ce9ce31d875df806fa44873af6b5a75f05
SHA256 f6d850bd4f99681e8007a8f715cf5661c70c759d670a71aa3b18ea1903c2c303
SHA512 5b1fd6f90b0cd8639cc3ff5793ddc648d321fa65828a4e225d3089d08c4f6664c022fe394874f0fa2728b6461d235a3d649bb89114a766f9c122861c5179f50f

C:\Program Files (x86)\Cobian Backup 11\Help\Images\spanish.jpg

MD5 efea81e5eb2f265b2f378a1937e59c7d
SHA1 ac654874d77866c28f92861c9257f83a2c2b88b1
SHA256 ec9fa0128fd820846ab0eda42dc2e4a3ed1c7deba839558a8d908c3f99667b8c
SHA512 8678bed7e9e00bdfde4bd26bdf445816a8ba950bbe70834408c6cd99165ee7a08146da7bbe1c79af139f550ba2314140e640f30b9134f004155cb2c4966491bd

C:\Program Files (x86)\Cobian Backup 11\Cobian.exe

MD5 4eb0e1de875819141c23491b1bc39d74
SHA1 fcf9bee8502dc909fc6f864b57958ca3ea96cf95
SHA256 4e3a6704ba54271501cb7bf2c3567c359b4451158c6441e5db76a7d3c7e00ee2
SHA512 932d36668790ce528811d3e13b5d151814dd6d339d9ca7fc3ee42f8174379c2ef8746fe8f6817f2c5fddb304c64ff8aa396fe7efceda2081f9eac3f9497f818f

C:\Program Files (x86)\Cobian Backup 11\cbInterface.exe

MD5 6bdb90d0d8235a746f3c0f554b6f7181
SHA1 b8690161df8887cdc4859079fe882637d39ef0cd
SHA256 a67b5916d4b5017b3f1c212ba1f2a45daa3abafbf600dfc952bd4e8506f02223
SHA512 0caa32dbf9e974baf803194511c5265db816ed9d21dd4e654cf7f2d3cc50c300c1f22fc7d1816a38d69f7341f603c52cd1d9192b61f5439315924aa9b554c1f8

C:\Program Files (x86)\Cobian Backup 11\cbPermissions.exe

MD5 544fdee34e7816ddfe8879892880c167
SHA1 9079422c6a4601c9be6f688980c073d1a573d231
SHA256 6afb10f16d6146525ac00fe550a13ed0584e1049c6ab76b2b80f0602714f1bea
SHA512 f355d3bc6b996ebb3f0b42438edf3eb1b3acdc75d39d3275db8501b49b25f403365cc077bc039bf1399afc5265c629543c8367bd28a75ecfbd638674402385d4

C:\Program Files (x86)\Cobian Backup 11\cbUninstall.exe

MD5 24f83e82d8ae4a0ecdd923eb64e3f6e0
SHA1 edebbfe12ff2403ac459a8d6c1b6465cfcac9f30
SHA256 e9694274d5b919741dfa81cd21534fdfa425a61d0c12bf7f6377b575a1bed6d3
SHA512 6be7f16f07f03c5ed42b77e3d20638c5344a1e10a7098ed269b0aa6271f8e417806fa46c637eb7406314f22bcbdbf048c0094039e61631130f0bddb988af302d

C:\Program Files (x86)\Cobian Backup 11\cbRemoteManager.exe

MD5 70b5852cb5538e19c380335cedb3fc6e
SHA1 8f444207f966a09deb14765af1dd3935b5041854
SHA256 e4070478c12cd6a3ff7ebf27fbbfd7ab93c9a3b41da68c3878387052cf219bbc
SHA512 7f3b933facea615f013aac0f76e1b2d88495df32099359728cb635ef7ecccfd17a088d8ddf7ae89d1578dae97ccaccd7bb688ac8551f4f296e0ac6486badd771

memory/3760-1136-0x0000000000400000-0x0000000000579000-memory.dmp

memory/3760-1138-0x0000000004160000-0x000000000426A000-memory.dmp

memory/4684-1139-0x00000000012C0000-0x00000000012D0000-memory.dmp

memory/4684-1140-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

memory/4684-1141-0x000000001A720000-0x000000001A740000-memory.dmp

memory/4684-1142-0x000000001A960000-0x000000001A968000-memory.dmp

memory/3760-1144-0x0000000000400000-0x0000000000579000-memory.dmp

memory/3760-1146-0x0000000004160000-0x000000000426A000-memory.dmp

memory/4684-1147-0x00000000012C0000-0x00000000012D0000-memory.dmp

memory/1956-1148-0x00000000016C0000-0x000000000195C000-memory.dmp

memory/1956-1154-0x00000000006B0000-0x00000000006B1000-memory.dmp

memory/1564-1158-0x0000000000A10000-0x0000000000A11000-memory.dmp

memory/3760-1159-0x0000000000400000-0x0000000000579000-memory.dmp

memory/3760-1161-0x0000000004160000-0x000000000426A000-memory.dmp

memory/1896-1162-0x0000000000400000-0x00000000016D8000-memory.dmp

memory/1956-1163-0x0000000000400000-0x0000000000520000-memory.dmp

memory/1956-1164-0x00000000016C0000-0x000000000195C000-memory.dmp

memory/3760-1167-0x0000000000400000-0x0000000000579000-memory.dmp

memory/1564-1168-0x0000000000400000-0x000000000083F000-memory.dmp

memory/1896-1171-0x0000000000400000-0x00000000016D8000-memory.dmp

memory/1564-1172-0x0000000000A10000-0x0000000000A11000-memory.dmp