7744a41dbb9d90dda5347d2b426f6b05dc86b8df2aba148f85f18ac46d0418fd

Analysis

max time kernel
45s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

install_backblaze_512ffe191c8ceb07c.exe
Size

28.7MB
MD5

ae54e052659116f06da71c2b326b1be3
SHA1

07eb40d4b2bdd054fa04b61919b51a93c7214907
SHA256

7744a41dbb9d90dda5347d2b426f6b05dc86b8df2aba148f85f18ac46d0418fd
SHA512

a7d924900e05859f76f732c7eca85cd8b9c0fcb7175b38cc9673feb149904c5f01f1cb5e663396b60d26951141ba580b371ce033cff302552eb812531764fe9c
SSDEEP

786432:EmHsdkHfbHPSWyGuq5IdwaOxCXb800mo9kvLGCCZyMacvR/:3sdyfD4qaOxIb800mo9yLrncvh

Score

7^/10

credential_access discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	bzdoinstall.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	bzbui.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 64 IoCs

pid	Process
4928	bzdoinstall.exe
4328	bztransmit.exe
1620	bztransmit.exe
4220	bztransmit.exe
2744	bztransmit.exe
1704	bztransmit.exe
4476	bzbui.exe
3492	bzrestore.exe
3548	bzserv.exe
5896	VC_redist.x86.exe
5912	VC_redist.x86.exe
5520	bzserv.exe
5772	bzserv.exe
5568	bzserv.exe
5816	bzfilelist.exe
3552	bzbui.exe
404	bzbuitray.exe
5308	bztransmit.exe
5520	bztransmit64.exe
4168	bztransmit64.exe
5812	bztransmit64.exe
4768	bztransmit64.exe
1688	bztransmit64.exe
6020	bztrans64_thread00.exe
824	bztrans64_thread01.exe
3896	bztrans64_thread02.exe
4244	bztrans64_thread03.exe
3368	bztrans64_thread04.exe
4584	bztrans64_thread05.exe
388	bztrans64_thread06.exe
3816	bztrans64_thread07.exe
1452	bztrans64_thread08.exe
3840	bztrans64_thread09.exe
1252	bztrans64_thread10.exe
2408	bztrans64_thread11.exe
2528	bztransmit64.exe
1400	bztrans64_thread12.exe
5220	bztransmit64.exe
5276	bztrans64_thread13.exe
5320	bztransmit64.exe
5492	bztrans64_thread14.exe
5500	bztrans64_thread00.exe
5948	bztrans64_thread01.exe
5952	bztrans64_thread15.exe
5552	bztrans64_thread02.exe
376	bztrans64_thread03.exe
5628	bztrans64_thread16.exe
5872	bztrans64_thread04.exe
5844	bztrans64_thread17.exe
4608	bztrans64_thread05.exe
4768	bztrans64_thread06.exe
5104	bztrans64_thread07.exe
468	bztrans64_thread18.exe
5632	bztrans64_thread08.exe
1476	bztrans64_thread09.exe
6004	bztrans64_thread19.exe
4604	bztrans64_thread10.exe
2560	bztrans64_thread11.exe
4916	bztrans64_thread12.exe
64	bztrans64_thread13.exe
232	bztrans64_thread14.exe
4164	bztrans64_thread15.exe
2744	bztrans64_thread16.exe
2716	bztrans64_thread17.exe

Loads dropped DLL 2 IoCs

pid	Process
5912	VC_redist.x86.exe
3552	bzbui.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Backblaze = "\"C:\\Program Files (x86)\\Backblaze\\bzbui.exe\" -quiet"	bzdoinstall.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_52B132EF36E2DE3A8F3688EF48BE4DD0	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E	bztransmit.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_52B132EF36E2DE3A8F3688EF48BE4DD0	bztransmit.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Backblaze\msvcr100_x64.dll	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread05.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzwinrt.dll	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_restore_arrow_dm.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread05.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\msvcr100.dll	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread17.exe	bzdoinstall.exe
File opened for modification	C:\Program Files (x86)\Backblaze\install_log\install_log19.log	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_skin_logo-4x.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_skin_langmenu-4x.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\animated_cloud_win_120p_dm.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\still_cloud_win_120p_dm.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzinstall.xml	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\redist\VC_redist.x86.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread12.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztransmit64.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_skin_langmenu.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_restore-4x.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_skin_langmenu-4x_dm.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bzfilelist64.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzserv.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread01.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzcustom.dat	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_animation-4x.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread18.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread02.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread17.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzinstallername.txt	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\license.txt	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread16.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzrestore.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\animated_cloud_win_120p.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread08.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread09.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread19.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztransmit.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_skin_computer.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_skin_logo-4x_dm.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_restore_opt_zip.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_skin_bg.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_restore.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_restore-4x_dm.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread11.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread07.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzdownloader.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\windows-cloud-4x.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_restore_arrow.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread13.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread14.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzfilelist.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread01.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread11.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread00.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\install_log\install_log19.log	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzdoinstall.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread03.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread08.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_animation-4x_dm.gif	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread15.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\x64\bztrans64_thread06.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzfclean.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bztrans_thread04.exe	bzdoinstall.exe
File created	C:\Program Files (x86)\Backblaze\bzbui_animation.gif	bzdoinstall.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztransmit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzbui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztransmit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztransmit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfilelist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztransmit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztransmit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzbui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzbuitray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztransmit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzdoinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzbui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install_backblaze_512ffe191c8ceb07c.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	bzserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	bztransmit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	bzserv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	bzserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bzserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	bztransmit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	bztransmit64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bztransmit64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	bztransmit64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	bztransmit64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	bztransmit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	bztransmit64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	bztransmit.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	bzserv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	bztransmit.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	bztransmit.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	bztransmit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	bztransmit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	bztransmit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	bztransmit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	bztransmit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	bztransmit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	bztransmit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	bztransmit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe
4928	bzdoinstall.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
404	bzbuitray.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
404	bzbuitray.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	bzrestore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4928	4116	install_backblaze_512ffe191c8ceb07c.exe	84
PID 4116 wrote to memory of 4928	4116	install_backblaze_512ffe191c8ceb07c.exe	84
PID 4116 wrote to memory of 4928	4116	install_backblaze_512ffe191c8ceb07c.exe	84
PID 4928 wrote to memory of 4328	4928	bzdoinstall.exe	85
PID 4928 wrote to memory of 4328	4928	bzdoinstall.exe	85
PID 4928 wrote to memory of 4328	4928	bzdoinstall.exe	85
PID 4928 wrote to memory of 1620	4928	bzdoinstall.exe	87
PID 4928 wrote to memory of 1620	4928	bzdoinstall.exe	87
PID 4928 wrote to memory of 1620	4928	bzdoinstall.exe	87
PID 4928 wrote to memory of 4220	4928	bzdoinstall.exe	91
PID 4928 wrote to memory of 4220	4928	bzdoinstall.exe	91
PID 4928 wrote to memory of 4220	4928	bzdoinstall.exe	91
PID 4928 wrote to memory of 2744	4928	bzdoinstall.exe	97
PID 4928 wrote to memory of 2744	4928	bzdoinstall.exe	97
PID 4928 wrote to memory of 2744	4928	bzdoinstall.exe	97
PID 4928 wrote to memory of 1704	4928	bzdoinstall.exe	99
PID 4928 wrote to memory of 1704	4928	bzdoinstall.exe	99
PID 4928 wrote to memory of 1704	4928	bzdoinstall.exe	99
PID 4928 wrote to memory of 4476	4928	bzdoinstall.exe	101
PID 4928 wrote to memory of 4476	4928	bzdoinstall.exe	101
PID 4928 wrote to memory of 4476	4928	bzdoinstall.exe	101
PID 4928 wrote to memory of 3492	4928	bzdoinstall.exe	102
PID 4928 wrote to memory of 3492	4928	bzdoinstall.exe	102
PID 4928 wrote to memory of 3548	4928	bzdoinstall.exe	105
PID 4928 wrote to memory of 3548	4928	bzdoinstall.exe	105
PID 4928 wrote to memory of 3548	4928	bzdoinstall.exe	105
PID 4928 wrote to memory of 5896	4928	bzdoinstall.exe	107
PID 4928 wrote to memory of 5896	4928	bzdoinstall.exe	107
PID 4928 wrote to memory of 5896	4928	bzdoinstall.exe	107
PID 5896 wrote to memory of 5912	5896	VC_redist.x86.exe	108
PID 5896 wrote to memory of 5912	5896	VC_redist.x86.exe	108
PID 5896 wrote to memory of 5912	5896	VC_redist.x86.exe	108
PID 4928 wrote to memory of 5520	4928	bzdoinstall.exe	109
PID 4928 wrote to memory of 5520	4928	bzdoinstall.exe	109
PID 4928 wrote to memory of 5520	4928	bzdoinstall.exe	109
PID 4928 wrote to memory of 5772	4928	bzdoinstall.exe	111
PID 4928 wrote to memory of 5772	4928	bzdoinstall.exe	111
PID 4928 wrote to memory of 5772	4928	bzdoinstall.exe	111
PID 5568 wrote to memory of 5816	5568	bzserv.exe	114
PID 5568 wrote to memory of 5816	5568	bzserv.exe	114
PID 5568 wrote to memory of 5816	5568	bzserv.exe	114
PID 4928 wrote to memory of 3552	4928	bzdoinstall.exe	117
PID 4928 wrote to memory of 3552	4928	bzdoinstall.exe	117
PID 4928 wrote to memory of 3552	4928	bzdoinstall.exe	117
PID 3552 wrote to memory of 404	3552	bzbui.exe	118
PID 3552 wrote to memory of 404	3552	bzbui.exe	118
PID 3552 wrote to memory of 404	3552	bzbui.exe	118
PID 5568 wrote to memory of 5308	5568	bzserv.exe	119
PID 5568 wrote to memory of 5308	5568	bzserv.exe	119
PID 5568 wrote to memory of 5308	5568	bzserv.exe	119
PID 5568 wrote to memory of 5520	5568	bzserv.exe	121
PID 5568 wrote to memory of 5520	5568	bzserv.exe	121
PID 5568 wrote to memory of 4168	5568	bzserv.exe	123
PID 5568 wrote to memory of 4168	5568	bzserv.exe	123
PID 5568 wrote to memory of 5812	5568	bzserv.exe	125
PID 5568 wrote to memory of 5812	5568	bzserv.exe	125
PID 4168 wrote to memory of 4768	4168	bztransmit64.exe	127
PID 4168 wrote to memory of 4768	4168	bztransmit64.exe	127
PID 4168 wrote to memory of 1688	4168	bztransmit64.exe	129
PID 4168 wrote to memory of 1688	4168	bztransmit64.exe	129
PID 4168 wrote to memory of 6020	4168	bztransmit64.exe	131
PID 4168 wrote to memory of 6020	4168	bztransmit64.exe	131
PID 4168 wrote to memory of 824	4168	bztransmit64.exe	133
PID 4168 wrote to memory of 824	4168	bztransmit64.exe	133

C:\Users\Admin\AppData\Local\Temp\install_backblaze_512ffe191c8ceb07c.exe
"C:\Users\Admin\AppData\Local\Temp\install_backblaze_512ffe191c8ceb07c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzdoinstall.exe
  "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzdoinstall.exe" -doinstall "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe" -fetchurltofile https://ca000.backblaze.com/api/clientversion.xml "C:\Users\Admin\AppData\Local\Temp\bzt0919191218_0000001_3672_0004928.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe" -fetchurltofile https://ca001.backblaze.com/api/clientversion.xml "C:\Users\Admin\AppData\Local\Temp\bzt0919191218_0000002_8841_0004928.txt"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe" -at_install_time_checkuser https://ca000.backblaze.com 353132666665313931633863
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe" -genpubprivkeypair_hex 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c627a65303931393139313232345f303030303030335f313630395f303030343932382e70656d 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c627a65303931393139313232345f303030303030345f363639395f303030343932382e70656d
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe" -at_install_time_addhost_hex https://ca005.backblaze.com f8a620b5b8340cbc94230611 6d646d73635f696e61776a406f75746c6f6f6b2e636f6d 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c627a69303931393139313232355f303030303030355f323533315f303030343932382e70656d
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1704
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui.exe" -quitbzbui
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzrestore.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzrestore.exe" -quit
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3492
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzserv.exe
    "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzserv.exe" -stop_service
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\VC_redist.x86.exe
    C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\VC_redist.x86.exe /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\VC_redist.x86.exe
      "C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\VC_redist.x86.exe" /q /norestart -burn.unelevated BurnPipe.{B23A34A0-5039-4E82-9050-7B7745F455E2} {1BD93B31-CB1C-414C-BDC1-C0A762C8DEE5} 5896
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5912
- - C:\Program Files (x86)\Backblaze\bzserv.exe
    "C:\Program Files (x86)\Backblaze\bzserv.exe" -make_into_service
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5520
- - C:\Program Files (x86)\Backblaze\bzserv.exe
    "C:\Program Files (x86)\Backblaze\bzserv.exe" -start_service
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5772
- - C:\Program Files (x86)\Backblaze\bzbui.exe
    "C:\Program Files (x86)\Backblaze\bzbui.exe" -quiet
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Program Files (x86)\Backblaze\bzbuitray.exe
      "C:\Program Files (x86)\Backblaze\bzbuitray.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:404
- - C:\Program Files (x86)\Backblaze\bzbui.exe
    "C:\Program Files (x86)\Backblaze\bzbui.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1884

C:\Program Files (x86)\Backblaze\bzserv.exe
"C:\Program Files (x86)\Backblaze\bzserv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Program Files (x86)\Backblaze\bzfilelist.exe
  "C:\Program Files (x86)\Backblaze\bzfilelist.exe" -first_install_time_urgent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5816
- C:\Program Files (x86)\Backblaze\bztransmit.exe
  "C:\Program Files (x86)\Backblaze\bztransmit.exe" -synchostinfo false
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  PID:5308
- C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -is64bit
  2⤵
  - Executes dropped EXE
  PID:5520
- C:\Program Files (x86)\Backblaze\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\bztransmit64.exe" -fixbztransmitversions
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Program Files (x86)\Backblaze\bztransmit64.exe
    "C:\Program Files (x86)\Backblaze\bztransmit64.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4768
- - C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
    "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -version
    3⤵
    - Executes dropped EXE
    PID:1688
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread00.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread00.exe" -version
    3⤵
    - Executes dropped EXE
    PID:6020
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread01.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread01.exe" -version
    3⤵
    - Executes dropped EXE
    PID:824
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread02.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread02.exe" -version
    3⤵
    - Executes dropped EXE
    PID:3896
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread03.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread03.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4244
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread04.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread04.exe" -version
    3⤵
    - Executes dropped EXE
    PID:3368
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread05.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread05.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4584
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread06.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread06.exe" -version
    3⤵
    - Executes dropped EXE
    PID:388
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread07.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread07.exe" -version
    3⤵
    - Executes dropped EXE
    PID:3816
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread08.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread08.exe" -version
    3⤵
    - Executes dropped EXE
    PID:1452
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread09.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread09.exe" -version
    3⤵
    - Executes dropped EXE
    PID:3840
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread10.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread10.exe" -version
    3⤵
    - Executes dropped EXE
    PID:1252
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread11.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread11.exe" -version
    3⤵
    - Executes dropped EXE
    PID:2408
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread12.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread12.exe" -version
    3⤵
    - Executes dropped EXE
    PID:1400
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread13.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread13.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5276
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread14.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread14.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5492
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread15.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread15.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5952
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread16.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread16.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5628
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread17.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread17.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5844
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread18.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread18.exe" -version
    3⤵
    - Executes dropped EXE
    PID:468
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread19.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread19.exe" -version
    3⤵
    - Executes dropped EXE
    PID:6004
- C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -updatebackupstats
  2⤵
  - Executes dropped EXE
  PID:5812
- C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -completesync
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2528
- - C:\Program Files (x86)\Backblaze\bztransmit64.exe
    "C:\Program Files (x86)\Backblaze\bztransmit64.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5220
- - C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
    "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5320
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread00.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread00.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5500
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread01.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread01.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5948
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread02.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread02.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5552
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread03.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread03.exe" -version
    3⤵
    - Executes dropped EXE
    PID:376
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread04.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread04.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5872
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread05.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread05.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4608
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread06.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread06.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4768
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread07.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread07.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5104
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread08.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread08.exe" -version
    3⤵
    - Executes dropped EXE
    PID:5632
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread09.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread09.exe" -version
    3⤵
    - Executes dropped EXE
    PID:1476
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread10.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread10.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4604
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread11.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread11.exe" -version
    3⤵
    - Executes dropped EXE
    PID:2560
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread12.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread12.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4916
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread13.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread13.exe" -version
    3⤵
    - Executes dropped EXE
    PID:64
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread14.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread14.exe" -version
    3⤵
    - Executes dropped EXE
    PID:232
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread15.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread15.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4164
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread16.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread16.exe" -version
    3⤵
    - Executes dropped EXE
    PID:2744
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread17.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread17.exe" -version
    3⤵
    - Executes dropped EXE
    PID:2716
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread18.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread18.exe" -version
    3⤵
    PID:2488
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread19.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread19.exe" -version
    3⤵
    PID:3816
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread00.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread00.exe" -threadpush "C:\ProgramData\Backblaze\bzdata\bzthread\bzt_000_20240919191245_instru_2528_00001_bzt.xml"
    3⤵
    PID:4168
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread01.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread01.exe" -threadpush "C:\ProgramData\Backblaze\bzdata\bzthread\bzt_001_20240919191246_instru_2528_00002_bzt.xml"
    3⤵
    PID:5656
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread02.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread02.exe" -threadpush "C:\ProgramData\Backblaze\bzdata\bzthread\bzt_002_20240919191247_instru_2528_00003_bzt.xml"
    3⤵
    PID:4132
- - C:\Program Files (x86)\Backblaze\x64\bztrans64_thread03.exe
    "C:\Program Files (x86)\Backblaze\x64\bztrans64_thread03.exe" -threadpush "C:\ProgramData\Backblaze\bzdata\bzthread\bzt_003_20240919191248_instru_2528_00004_bzt.xml"
    3⤵
    PID:6100
- C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -completesync
  2⤵
  PID:1596
- C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -completesync
  2⤵
  PID:5424
- C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -completesync
  2⤵
  PID:5300
- C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
  "C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe" -completesync
  2⤵
  PID:5436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Backblaze\animated_cloud_win_120p_dm.gif

Filesize
260KB

MD5
80343201cb8c51eabf5d156f7bdb315f

SHA1
15d4bb8629687c1f6fc7d2ba3b912eda8766281c

SHA256
299b2f51082be17228e853456a5b8b3841a436ab6b37ac6e55bc99a9edb78428

SHA512
6941f7b47875b022f0353fe4e0b41c430ab7523aed8b4eae4e5619ceaef61b72faaeffb1f519e33bfc4c352639f4a961ee98943a2b781da8535d2c02bb01ab2b

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_animation-4x_dm.gif

Filesize
20KB

MD5
02227567cf3edc2767140f759a4aea3d

SHA1
5bb59827e38d46a174a8d71ac4aab11c57dc3b21

SHA256
166495b4f9102517361b46540b5a12735da0a3dd090f3a663a49efaf9a68dad5

SHA512
7b962051a471dc230840bcbd4a4b9613b5d236ccc2f1b723ab56c261599620756f127d7cdbd105a387d2fb0ef72e9d9c8eeba255bbe7fca204dcd211a36e4c41

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_interface.xml

Filesize
541KB

MD5
77da623be87a4acf7cab073d3dce8c8d

SHA1
a9ee5ea150dfbe1e2dae55b1b4dace9000aee3ab

SHA256
a16d261f0f582611e4f2463157e4011ac7d06029b9ada4266bc70d4cdf934f67

SHA512
01a2404a379ba7d085818ba98172a3d21b27b0b066c2bcfa7d9c876315f96277b6194944a0afc841f3871a741c0db9988e64155036be8e4c7b28d7dadb86bfef

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_restore-4x_dm.gif

Filesize
22KB

MD5
dbba97300e6b2e986e1ed1f0019c76e8

SHA1
0ba139a2deafc77b44987b50b928ddb146b364ad

SHA256
83bfb09c68a26ae4a956a063165741a0fe96e688fef17b4ddbefc6555eea02ec

SHA512
2aaf95e12a2e22a72d76a9f50774663c76ebcb57d0ac532c813143662cb3738567bea070e83bd2c22538a6e4cd6675c739fb16f898f7ff3928ccc1d71ee39732

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_restore_arrow.gif

Filesize
39KB

MD5
fa93a9ea22943d4885d03cb60f401121

SHA1
02872cf934f34e555dcc608958a0a2a5ee88176a

SHA256
91740c87e7364e2f8aced911026307a59a566bcb0a2e8a727ccbf5816f7fece3

SHA512
44bc5101a11aa117ed94805c0bf16e3f781979f695f76b54a96a7b8f97732b42a1591ba95fbe63c258e8a92d4eca1a504ca5385faa178d8213e650e53a76d65b

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_restore_arrow_dm.gif

Filesize
40KB

MD5
0008c1e4b17c16324be10b5157becc52

SHA1
a5dfa279b593ff17c30168b8219342d15d4977a2

SHA256
a0fb5ac9cdccae7bd038dcfa592aba6cfd9d25c8d54a31219664ceb57f975d63

SHA512
77f92111fdd7b3d7cec582099e270a7d2205b749d9d84c928eb08a7bfa2ac50adc31de726303dd9cc5fcd780265fbfa4f4fa209ac754b02e2a245213c0bf2f68

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_restore_opt_app.gif

Filesize
2KB

MD5
57e12a8339ca174f2c58403ca098da25

SHA1
c02582f4535889aa48ccc038ab6c15babb566bec

SHA256
041c8267a31bbb881b1a70f201be9c1ec4cdfb510fed4e1fa3a123bcf9c3d17a

SHA512
fc1f5d01a77ff45339110077d77466cb4639e26f842ad5d0d8d1a8374d5c178945449a4ccf6d09ec1429357c5379a3d7b9d024efbd53007a145402c619a5dfa2

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_restore_opt_app_dm.gif

Filesize
3KB

MD5
165c400cd07d0b5c09a25f3e019db56e

SHA1
6abdc6448562aa880c976c80d1d1484505e38fd0

SHA256
33085b65a127fe15fc907ecd62b53d521522bf9c00531288700edfa52cf48750

SHA512
d1acbcdf1731267094632f9b8a885c662c6f0d3bb31b7f1f54dac3bbf6aac101f2115e5bb84eaf6ca2f44474d1de6b5ce6328160a981bcb47b42e8e4ad036be9

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_restore_opt_zip.gif

Filesize
2KB

MD5
3db303c72b533bf42e2e8f7cdaa8ca95

SHA1
712ead637bbc6fb6efb1bd15e9d401658b20489f

SHA256
62ccfd5e63d3f6fe0a66222ac391d53e4c173ef4d584995cbfb14017f8501a73

SHA512
11abe6958b862128f03fb68b8e94ba75ae3e30556592d5d4af3038596cb80471aa5eb31b0d2582a4a515d440bf6b82ef1decae5f3e643d0d820377073276cc14

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_restore_opt_zip_dm.gif

Filesize
2KB

MD5
4536c383fc2c1dc44bf6bc8aea66122e

SHA1
c42d72843794cf24ae322e9a4c8f6d674400812c

SHA256
4a98235338785b8fd9a6380cb8a0954129d8b75f527b58e410da02bcd4d1b247

SHA512
9382aa7b5b51f0c374d4966f23ebc108250ba65d4914488da2596144f577f4e3657fbd2af2697cf21c877110b4603f39d5112c66f924f3475d5c9e36a3aa965c

Download Submit
C:\Program Files (x86)\Backblaze\bzbui_skin_langmenu_new-4x.gif

Filesize
65KB

MD5
9795d6c4b7ce1870d945d7c47712928e

SHA1
128c43322ade9063877a4f80835e2f6529630d96

SHA256
71ebce0d2118e82041e37cc5ada7847e1c3310ace80468d93c81d60d2c0fcaa2

SHA512
a933f65fb3d938718150fe6377fd5a8fbe284986a96db67e4445505774e269e0ce65f1892d0ad95cd59275c6e248826f0716c1c55fa0fc04d19ebd1d1d3a7783

Download Submit
C:\Program Files (x86)\Backblaze\bzdownloader.exe

Filesize
3.0MB

MD5
59ad955493ce6ffa265961e3caf2166f

SHA1
fcca77028108c7aa12ae46d28b3322a070783c02

SHA256
0705a5cceae9b73cf82d0dae4a30c3c6f067f5719c4ab943ab4a5bd41f9c3bab

SHA512
249d77838f50c22ccf7df7793b16e873860ef39d42e44cf30aeeaae64e9e86c7ac1466290bab0b521785d6fc243091ed6a43abb2c4880be10a196384a9edcc5c

Download Submit
C:\Program Files (x86)\Backblaze\bzinstall.xml

Filesize
282B

MD5
9497d5ab36ebe516cdd925931178c512

SHA1
1fc34ad780897f8008d978a812d1df553e22eea9

SHA256
0fa46068bc3dfdaefc7289ebf86a8c19be30fa84b34403af42c1916596576b08

SHA512
6dc34ec17469ad9b713fb315cd316ee4c05ba646ce493b10dc10d509501411ba0b6eab26e6846ef263401e560cc70977a0eb96491c62dc85ea63d8267e3374d5

Download Submit
C:\Program Files (x86)\Backblaze\bzlogo.ico

Filesize
83KB

MD5
fa460af4d8b51bf03e735821940b69d3

SHA1
874a925badc43631342de1649aede86121d5cc4b

SHA256
b61847597517a636519484b17e6fdd4357b8c68c0817519a76aad7a3985f6dd9

SHA512
394bef072debb31208c00fe912af1df5786dce27682fc403d9416b03711cab9f03386205553dabef9f0fca62535f919a710fbf352a099b12cf6836c34fc46939

Download Submit
C:\Program Files (x86)\Backblaze\install_log\install_log19.log

Filesize
1KB

MD5
9e05547188ff4e7476ea082af727adb5

SHA1
0cb83b671e5fcbf73e19008c4271036b41ac2ee3

SHA256
893eb59c46104131716a8cb455f4684ee85b115a791658acbd94a204efdade55

SHA512
0983368bf00ee029c522de08539e764446c7bd4abf02bf7f7a65f8267756d04ab1d6d70c978f49d9067a3992d656ee57f672b3cb8ec965fca5bfb33a84b1e451

Download Submit
C:\Program Files (x86)\Backblaze\install_log\install_log19.log

Filesize
6KB

MD5
35b77278ab19deb06371c38517261dbf

SHA1
2aa8c298cdaee179f40d36379b6b6d07bec0a893

SHA256
d3dc6a21030937a7051d188025794a8804fcd2ba14902b5badb91c87609d997c

SHA512
9fc9cb0a8ccf91a869c75eee5fb96b6552392ad80232511d50ec6c5f0d4a6fcdb86922f1ff35c7359693b3e4dc70b3e271a6594617c5e5db385752f3563dd718

Download Submit
C:\Program Files (x86)\Backblaze\install_log\install_log19.log

Filesize
1KB

MD5
36d2fc20c888c811b72d513a1fb82653

SHA1
ab4a534bd9d080393ac2fc1e66d0c3be3dae2ad2

SHA256
b098a8eb6e29fc6d86b4944248018ab36340d7d34045ea73ea03c5aa26bcbe33

SHA512
0d1814e4f00c684f0b16dc61c697b994fd5320c86787a775879a1ae0d2863f232f1ee12e6f9d16f429f9f38de4ea9b057bcf4c9c392a3049855f5ba02467b14c

Download Submit
C:\Program Files (x86)\Backblaze\license.txt

Filesize
7KB

MD5
4bc3298873d59531f93ac415e885732d

SHA1
727aa225f3948a20dea088e966ccb10d797d5e2e

SHA256
b19f1bf1e95eb365d82353e045760707912a1c29fd6c7c342c2564704714e315

SHA512
c813aa6ee270926b6f6a7986ee121ecce0821de9eaa9041cd014a9a6cf8a681fcc0c794b81a9123704ce4db30af80e5716408ed90ed25b43d9bbba9840c11d01

Download Submit
C:\Program Files (x86)\Backblaze\msvcr100.dll

Filesize
750KB

MD5
2b92a88e329f4845d31941967a3baa90

SHA1
bbf341e7ed9947de0b5d84d93ca0bc4c8beb5500

SHA256
649a7ab8e3b5c0940812e40eafc8f004979bb48bfc8f4bc7db9f2cbcdd715344

SHA512
b94862e3f516402317a5467c6e0ff3dd23a967d90dae87dec1687157e43978c2d73c24fee71b4febeada54bb433ea4fcd16568d02fde1c4f9f50f6d7ba02408a

Download Submit
C:\Program Files (x86)\Backblaze\still_cloud_win_120p_dm.gif

Filesize
6KB

MD5
a7b5f907ecdfa4a3211fb75f25354a42

SHA1
d3dc08188c0ef839e565c6c11b02415a993989dd

SHA256
5310941538a5e73bf199e7e825eadbca96cf3dc353df2e87341ad37d3c9687ed

SHA512
a79f2472155808943236f8e859bead20010bb93af93156e9ea91697bc2f161921fc96ffe89196935a05424f4f86361a99aeaa95cf6b31bc1a5e39f94361222cd

Download Submit
C:\Program Files (x86)\Backblaze\windows-cloud-4x_dm.gif

Filesize
7KB

MD5
575ae077e36c8ea938db64204d842ada

SHA1
a5f880cc67ce0c05a4a1416aa7056fd7ebd3d752

SHA256
cbc2d622030f2d8ec0d7e2c60fa83a66385db842d44bb90192cac57b7a5cae76

SHA512
6b5c424ab712045cf67db8c4b8174287518c6fe176167ae3874b7571143e88bd4ab807fb9ab79ba28f93fa09d78cbe355a57c0fb429c02640dfecdc1ae0b75f7

Download Submit
C:\Program Files (x86)\Backblaze\windows-computer-4x_dm.gif

Filesize
9KB

MD5
f7c2708a343d47fe1c3ab685ffd6886c

SHA1
b6d9fdb9420860c6f1518a2020d8761e220a569f

SHA256
cf49468a19de3eb585670eef13e97f284e6fe9ac305806aadf30a5edbee9ed64

SHA512
13d2503445fbc20818b5b6fc3e28f854fa93669e1c2d73dfa4548d83864d26f86d1ea820ff7053f4689729570dd6ae4fc458ab0a3fc5a48fa77fe648229c556e

Download Submit
C:\Program Files (x86)\Backblaze\x64\msvcr100.dll

Filesize
809KB

MD5
df3ca8d16bded6a54977b30e66864d33

SHA1
b7b9349b33230c5b80886f5c1f0a42848661c883

SHA256
1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

SHA512
951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

Download Submit
C:\ProgramData\Backblaze\bzdata\bzbackup\bzdatacenter\bz_todo_20240919_0.dat

Filesize
272KB

MD5
e83218b66171856b521415ed382f4c02

SHA1
aae5184c9a0e8bdabd171ed7fc7d486032914fa5

SHA256
8a368925ef251eeb2d4f4a79a2d3d3ed7b3d54b01a9916b6ba3311d28d7138ab

SHA512
687b96221be60127f1281f9bd3b27c9b086777597144348c59a23fab7090f801b30d47481bca80ad73d6db90b5da4c9e0614967d81d68e98bdd2f9fb5b5930e4

Download Submit
C:\ProgramData\Backblaze\bzdata\bzbackup\bzlastassignedfileid.dat

Filesize
3B

MD5
19f42e77c95b7a5a9a6f36d0b95f0e9f

SHA1
8b87c260b6734f68475f1c35d18877786e254d4b

SHA256
38187e6635f46361f858f5e319095b090f556a74ad3cc98391d71b51016f4fe9

SHA512
6a1248f4736b9db8b155555c6287e389a566f33d34eb0f35114ae0bc0bbfd57c2ff2954f27ba1f5c30ddebf76c3193927550860a2c57e2efad73b0260700d045

Download Submit
C:\ProgramData\Backblaze\bzdata\bzexcluderules_editable.xml.tmp

Filesize
23KB

MD5
0751dab33fd033f8feb4d342c9c7fc5a

SHA1
e0c47cc0b9a52d437606c67cad5692c6e5da0fb9

SHA256
76e2e570fb65a5f91e5ec6727df02ff8ac68b0042da237a37d4a8dcd4acef952

SHA512
dbf92c53cc4e32727e66e46fe5756515917a0a20716a570f3a0b1223eae4d5f40bae164a2864799339d4632e7e9d1f37210496da31784bda75a943f49e6955ea

Download Submit
C:\ProgramData\Backblaze\bzdata\bzfilelists\v000cd264045b8340cbc94230611_c____filelist.dat.future

Filesize
162KB

MD5
6a3f539da90302526172ec99ea667ad7

SHA1
704bf40d9aa317b5363191c97b897047bc07380d

SHA256
3549bc78919aba032c8ab985b24c6db76816b5a001e76277c7528b38ec52619a

SHA512
e8564d65ea96bbc50501b3c725299a5d6b9a081a55b2b9cd2a3b16310096fc4067239ddf09cacfd40fd1d30d795d516871dc3b778c8646605dccb985b400aa02

Download Submit
C:\ProgramData\Backblaze\bzdata\bzinfo.xml

Filesize
3KB

MD5
db8d18109cf64804ca02c9e3c8e3e244

SHA1
3b2ca05f31d30f72c11b7b0ec07e0f34dea3bd5d

SHA256
68a6c8d6389b587f251b4ced972f3547a77850f01e700218435969fa0e43fc6a

SHA512
e92158d3f0374aa2fb0260436af38d0f9445df0c6271b02aaaa7a6ebabfc15e78fe080df71175a50bd7f998177bbeac67255a285176e0c6b13ff89fa5ebd1f66

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzbui\bzbui19.log

Filesize
755B

MD5
2199a480c8db521c4303985454cd7b59

SHA1
e2afdc9d5d555a15e4427b0cca7240bda0f0cd0d

SHA256
c2ac064a9fce576955dcf860d67dda45d25e728385e6c9e95c3f82d3e934ca31

SHA512
ff4e94f1e9bbf9fbe4df00b9b611f2a8f24cbd1c49c3317d3b90defcc7deb0c59e15b3162276004259fc944ec33214d96926577c06cd4ba62b4d836232d45ff6

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzbui\bzbui19.log

Filesize
2KB

MD5
82fca1d40399cfaf0e7e303976e070f3

SHA1
f87c64d89f5c693ff1d8b3fec35dbd493471adda

SHA256
40ec6714c6312b404962bcb783ea9fb922a2d2c98382094946302a9c634068bf

SHA512
3d9807f1e777bbd875d21ee5863deb3a19cad4adbdb3eeae72a44a545b46b79a8bba01f5d9e0919d8180943ec4acdacbedd338e8c27ed8182466e03074045226

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzbui\bzbui19.log

Filesize
4KB

MD5
934d486dc438dfcf02c303bbef1b1b77

SHA1
5af8d8f78c7ecafc19f1e3b4bf4d310293f2cf6b

SHA256
f90198b3d9fe2d0c9ad05492a96d11e8d7ddf11ea2af09f640ae09bb96def241

SHA512
714624f29990e8384280b8c5a028cd963f398a13cd294b2e39f3fa45be66369f0c47ab6c691698d416deb823f5e9d4201a30ff6899ba4e2a73519dd237763b58

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzdoinstall\bzdoinstall19.log

Filesize
2KB

MD5
50abd7fd2ce0263486b5fa9c0e568b3e

SHA1
055a580cefec2b48e04205036295ce597eaa31c5

SHA256
e2bbfc203d62fe4528cab03c57f7c720bf2af8d07b66c1fe4993383ed3b663da

SHA512
1188bedf47d21c21c736c2981d424a04dc9feab7fe26912b390f363ace15fd3b29560813dcf19878b6265ca4c5fcc214d198bf55d2217366619f42d648214e92

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzdoinstall\bzdoinstall19.log

Filesize
4KB

MD5
854f45c63675a8135447345ba9505f75

SHA1
e18a71ee1d1a957ada731c84703df0d093838799

SHA256
485f7ff329a99aa70140d95c6ab6274a5af64893df704f6323b1986c13770388

SHA512
079a1c0541171fb5905ed608d2dbb0a0a1c9eff3ebb1a7d03839fd16dfb15593d2a040749c2397079a8d31238efef9a1cb868f844b6304da24e209643ff33f88

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzfilelist\bzfilelist19.log

Filesize
754B

MD5
b4514947591124de9cd20b1731218267

SHA1
34971246dd292e4e1cc3ef7fae7f98ee2f4504b5

SHA256
4abe4b993d53000f9df1ad96d3a5598caec0a260e8f3ffb51805e6c8f4145199

SHA512
d1ca46d16e5295b6559487a8b58b7fd66baafd1b3ffc453706affd2ac58d95b7f355ceba5cde0ed11016e80999c6789c801920352058a1c9efce379442e86afd

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzfilelist\bzfilelist19.log

Filesize
3KB

MD5
1e2cd3ff8fc24fd5b0bc1f12c11451ce

SHA1
6a70a48ca1e8c955bddf176f81a5725ff570f124

SHA256
b948832b4adcaf1d20679ef5999ac4a6d4d574189d4f1d9b77e08c0fc5ce3a83

SHA512
b6247c050fc47d35c917f3253a284c7fd451422820f084c3b517d3871bc6bdd26a58bb0746d24e44ad6c8a68d647adea369a5e9530ca1a7d6a928bb5c3cfee21

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzfilelist\bzfilelist19.log

Filesize
9KB

MD5
68ed0df029cba70e4386e64da64b909b

SHA1
6c4eda68bb2044787edc26b12993b2b143b973ed

SHA256
0b841b7616f4e64d7b205fbea3226ab9e9ec154a7a1bb81867245aeb5f225226

SHA512
19217c2eed3ceaf256e1f409c1d19b7eda17e121edad58f05c9b3d5d4342816c53520722f8ca9df041d8e8fdd14563f5e4d30a39ca2498c3a66801d1a9589681

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzserv\bzserv19.log

Filesize
2KB

MD5
0ae3c2eb3ac94aede20caf7cf76cd756

SHA1
a29e01534c72bed4305273a3b86aa4fdac88cf9a

SHA256
cacadbf0b2cdeb78599bb4d56f4f044a7b18f56eb1e62fe7c8d60a9f3e69b7ad

SHA512
b25c3dac9e7b52f28303abf5afc5cb93d8f3fe610d14487b0c4e5fe489821d09b030f88e537b1a15ee286936f365dd6e4753c7623275374c271afa828329aaf9

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bzserv\bzserv19.log

Filesize
6KB

MD5
218cab813f35416097bb0004eda38cc2

SHA1
a6f568fdf3dfbd37ec70b2e98da38c3b02d2ad9e

SHA256
189af4e700b1603e31b236f445affa72e5c300e1dd5bb26812b8323550139247

SHA512
0ed0125bc8d585c39b23f160f01e479a64df7d794834790154bbcc083897fd16a0505609e55fd61b8ba07f4d78889ab98ead06e649bdc3142d9e6f42e6e338df

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bztransmit\bztransmit19.log

Filesize
818B

MD5
7b39036366c5007ad46dabd254fb93ee

SHA1
647db08a31cf882443256c6bd719d20b23c09a8d

SHA256
71470e2d884cba9bcf8400335764e8cd18c9a65c695b1a0f744d275c4877023c

SHA512
80e365549f4e43f617754758e500297e8db819efa499880d5d0f22403abdb2b34442d5c612d38eb0d4521d1de63128ecd6be869ea2b6c64fab5a53dfc453e3c5

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bztransmit\bztransmit19.log

Filesize
1KB

MD5
4d7b3961d6e68136c6f4b489de2d0eda

SHA1
82db8400409cf9b4af3177f69568c75b63f664ab

SHA256
dfcadd3ecd81cdc6273f069b04326a88502332a2645c57cb5fde56ff2133781e

SHA512
4ae2c87b11ff28974093f0b8a9c0ee953112e2c08f52c61aa337ca3a3f88a26306364c302adadf8085ccbc43d35d4e47c56825e850951dce9bc175c9dcf5379d

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bztransmit\bztransmit19.log

Filesize
1KB

MD5
7fcc12a61ab624ff0873e2533c2d3001

SHA1
800e5b131fb9999c7e31f07080286c4981f4afb8

SHA256
d7bb719e3cdde9d25b01e7a9e66377f8c4ecae080048b9f398852f858aa637a6

SHA512
ac7f45c5ef4cf0036043684e0eed0261f1f45fe53306eb6835f4691919a84cceb2dbb57c14b9430b0faf8a1e629e1a13efadd86f15eca41a4b664a023dcfffd9

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bztransmit\bztransmit19.log

Filesize
2KB

MD5
f78802f894fb26b7402e60459f7b6802

SHA1
8b042fb2e0aaa985992111da5da64536bd1b7f32

SHA256
003a04cd41886ae037d4f172daf411c7c485456b80f8318099f23d8f658ae39c

SHA512
e78937845957ba085cc49379ca805ef23eaf112f178efbb59a49acd1b1d0c7e656b23179cb7ced6793483ff6e4b95cf3dfa53e88592d4c06c98c4675d3934d66

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bztransmit\bztransmit19.log

Filesize
2KB

MD5
b99ccfffc796a7003943007f361574d3

SHA1
58edc3c5fa3713cd11c88ab744de5d949d7f703d

SHA256
6819923eecc09890f05df8a7b936337aa57e68ae6af3352d9b86d03b5112b6d0

SHA512
0ac3b7f99f2d0b6d3923011d0aff07ca7b808c980fd115a8ec63eb09910938ccd426f5d4665a296cde7a45758c7c5949e5317cd820db8e79c027be991f9214c2

Download Submit
C:\ProgramData\Backblaze\bzdata\bzlogs\bztransmit\bztransmit19.log

Filesize
4KB

MD5
be07f5cc5c329202179965fce1683706

SHA1
ae56b533e6c1f6a39fd807fa89fadfb5375c47ba

SHA256
f0836df3e91e90e98370b624735569d23ec5dc914dab83d06dbb7718f2088409

SHA512
3f41fa3606205d2900fa3ba530f6e3e603ac46d30420a9ce7609bafb5c1b68c6808f5cb502d71aaf3456bee6040909bd48f6e2565428928d38f621a08bd4066d

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\bzdc_synchostinfo.xml

Filesize
1KB

MD5
8c3c7df34e907de00bb6ddbfe5e9b4b5

SHA1
3df8ec48816f8203adad74b2023a1c5d57f69cba

SHA256
b307b95aca6db200afe04be02cd8b5c75f8523692d5a68cebb11d3b43822ee79

SHA512
f4f7555ff7fc4e07660a506547403ad8f8a0f135ead9b7987efd165bd1c2316432dede2d9883c8f84394ed0b5b7f60772417340a94818b2dc8bdea9158bf5b39

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\bzdc_synchostinfo.xml

Filesize
1KB

MD5
d32f93668731ee4d8f199543ec3f4523

SHA1
049b2916b0d7fb098516d7ec4317bce5cb8b89b3

SHA256
f59ca293a4de91119d5b9a4645955ad29ceb9295b1e9ab542fac0ba7baf1cbe9

SHA512
6168b5e9971a6b6649d1c79daf5275ee006f64402a31970261d1af1ee8725ac4e668c923c690ba8002765e591be733fa14403d76ac3baafe73c8b74acfdaf235

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\bzexcluderules_editable_mergelog.txt

Filesize
164B

MD5
51427de4901cdc3811287050f7352e75

SHA1
ba6c742644471da65bd38cde27657ac1a8982973

SHA256
cd7afe3517c32b759b8527799263517034892704e4acf9fd9c2d8399fbcfba4d

SHA512
a9dd67b47cb1b6fd1dfb97e221f49ef435c4635bdfc29482fde1babc917557d13dfded9c260dd40e0ba23a4b5f678dcbba5f87c42762e409b50643095eb799e4

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\bzserv_version.txt

Filesize
9B

MD5
97d80420ae4e8dc428fa09f28b97c14e

SHA1
18628ac742331ebabbb5c484e54ab35f9f90e06b

SHA256
674e3420f3252b5c921cb5f7a80be9e0e8a738039bf74fc723eefee02f1b7950

SHA512
1ff597f53e9ce1e9f7c3ad46767fcab12c061df6dd1eb752f2a574db14d3a694be6f04bd83822cb1450cbb1e122e0ebb70bab765aaf6766f6a6c97c79cc0bc5d

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\bzstat_max_verify_mounts.txt

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\bzstat_timeoffsetmillis.txt

Filesize
4B

MD5
a3e05d7bc069cc9218c89757db62ef37

SHA1
cbbd1438504d05bb196eee7ed035ba8a15b93370

SHA256
192d2e6e5bfe00e1afac88cdac2da4838797eedc076d77b024a8a552689a9788

SHA512
a8969c56cf3d16800604eeb6f224a0cc3ad8da3b8f4fa0bf28491987ddb7bb81b296441878d6e717a35d158c4f0bedbbbde7e14ac19070014f5aee926e0dea0d

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\bzstat_totalbackup.xml

Filesize
273B

MD5
6ed0f26d89a76d021c2327b42feb3cbf

SHA1
58064ed86db4899cd74826fa69a06edca6d7b8cd

SHA256
d5cb2f53a547203a8fbd44902f83719796b7eed665b1d258fdb8a09e8cca61b7

SHA512
5223389c115020a55444b3b9330617db03574d6bac12e206633a258526fb8ff7539b70be460243f13918f2a13f1772f707ebb2a62a7055c3befc67cd7008bb7a

Download Submit
C:\ProgramData\Backblaze\bzdata\bzreports\rollback_settings_hist_recent.txt

Filesize
4B

MD5
334c4a4c42fdb79d7ebc3e73b517e6f8

SHA1
71f8e7976e4cbc4561c9d62fb283e7f788202acb

SHA256
140bedbf9c3f6d56a9846d2ba7088798683f4da0c248231336e6a05679e4fdfe

SHA512
ab93a9e95d70edb06025511cea4e2b8047fb7e1deaf7244fc0d3edf5e7cb57d8fb7b951bdeb3c6b552714878749eb19b9103e64a83635e8885c7d3e1d0fc5649

Download Submit
C:\ProgramData\Backblaze\bzdata\bzthread\bzt_000_20240919191245_output_2528_00001_bzt.xml.tmp

Filesize
125B

MD5
70ecb4f276072a250fdb30f18f921d34

SHA1
eefaee7dc867163b0fb246ce8e7dc0e9259a56ff

SHA256
e0ed148034cde66c0ba74207737b2bb6d31a611cbd6ba2ccdcecc1337ce086cd

SHA512
6282ebc693c75dcf79a944f0c60253085fce5fdd19bd84538133bc66bee5debecf1feb00f26831d12d0b0e3c99e2812cee3af16d51cd923443ae894dc06b8c62

Download Submit
C:\ProgramData\Backblaze\bzdata\bzvol_system_volume\bzvol_id.xml

Filesize
262B

MD5
c4b7581be38c28858bf34f5b9e1d52e0

SHA1
08c0e86f5623324c133dcad2145ace99df4d9685

SHA256
7d9b1d4d283005fc20b242a48bd8577d4aace4e4b3b90b31aa9fddfd720828c7

SHA512
876fad91c7182cfa31065e571ef0de408939db941072f5784e5e20c40a620fe6182d9908c208e29f61b1072660fd8ef8f9401fb65495b369bd475e709eb6e183

Download Submit
C:\ProgramData\Backblaze\bzdata\bzvolumes.xml

Filesize
479B

MD5
7b073c475ee4631c7b8f2e3d0bfa9aa6

SHA1
bc8f0b6526c83de71cb01593aa9c8b27ce97c78d

SHA256
97c9c694ebe9bc04b052ef550b809fcf91e0a4fcc11e9105265d67289abed9d2

SHA512
6e2c8fc778dfb85959f28daf2beee7a57c88d02fee389431b32c90681be76ea57cbe0b390526e668f3670e7b5f6e3e58b538af810dcca6150153e1e85194f487

Download Submit
C:\Users\Admin\AppData\Local\Temp\bze0919191224_0000003_1609_0004928.pem

Filesize
451B

MD5
7135966ed8570784a2c13b0b942d2053

SHA1
8309aeb5488ab72514a446f6b745308043fea51c

SHA256
b337c941d294c995ee5dcb18e8a41989c7334347ce55652ea5ed5442c01e5167

SHA512
4fa944c240211b38e42373fdcb93dff494f824af8955d5a1a92eacf35c88141eaebdb5ea12ee32c7f2f5de82c20157667a37f8f18cbdf9df759075294d23cce0

Download Submit
C:\Users\Admin\AppData\Local\Temp\bze0919191224_0000004_6699_0004928.pem

Filesize
1KB

MD5
71c2a0af80c06aeadd6df6a988b07a91

SHA1
728055a7391dca5d9cef9299e932a79a4fd9a019

SHA256
ab570772f0d924e9ac935125cf7cf783f20a3f29265aae5695be4fbf5af4ed8b

SHA512
88c9b3eac137b999f6b67a2fb6fda71f0510045735cce197fa87be206fd5aeddd125d7de1567e6f73be87dfbc03618379f85d5f43120ce9e5e668888a57d3593

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\InstallerConfig.xml

Filesize
111KB

MD5
e98982bc81b82b074d12de0e1fc99e53

SHA1
619d8c777a6c224b313933ebb4e0d0b5c6543612

SHA256
618969f88e5d5a0dd29805a1437b923737394da0e244b2a4c9606b23fff426d2

SHA512
0f0dac703aeffeae70e25302f335ca5a344adc13a839f3f7b29918b457eacf9f5d0bc98b33ffbf1d42b9b17bdc26842ecbe51fae915547274d060f836f10f77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\InstallerSkin.gif

Filesize
45KB

MD5
a3ce91f588deaf660d57ec1da5b92a63

SHA1
a7ef2877b08f427fc60b108c841b4db702e122a4

SHA256
04a2b4893d58766ca0283c01bb80ee0592317743c984dcf46899d5d75543e728

SHA512
b2d8195df3d59b72a6d7bad589b2fe489b63f2b0924b69c64fe49007df44740da09031b5bd20220005bf6c7f16ba130731f2d3ecf579d307bc0532186b1c560a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\VC_redist.x86.exe

Filesize
13.8MB

MD5
8dac0e58fdcd659c9de1715aed297cf2

SHA1
370583c380c26064885289037380af7d8d5f4e81

SHA256
2da11e22a276be85970eaed255daf3d92af84e94142ec04252326a882e57303e

SHA512
ef9a9430ade4d511c1514a1ea688871f4b5c010ec886e45d6df3f3d6d769752f675ead243e3f1dfd0bb7e48ccd7d085a18484de3777cc55cae02b962e384304b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\animated_cloud_win_120p.gif

Filesize
59KB

MD5
dd3aada7ff4742b1d82ac926ecf844cb

SHA1
310fed0efd7f1a657db523e14307f2a25734c3b2

SHA256
2d0c512c5219fe1f38ffdf78366e2ae52ed892a43d47e3501d80f2eaaf896f21

SHA512
cf36ff99e8a715838ed3d33eff62b339dce5ffc6be99aa17d61a72416f6eb58f9332939b4d5f9fa8c0bb82737ae8b41dc342d755f416f01b9f88f29b44f1d4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui.exe

Filesize
1.8MB

MD5
599577dd273065ee42a6186859f233cb

SHA1
442e26db0ae39161992ebbb08adb8a56fa9dbfbc

SHA256
e475bd11ea26d33e1af5077b22606d826654f5fdb84b235d9932bbd6fcc58033

SHA512
616b7a57e21e93c4cd2624a0176e6ea84ed6808a7bdd042b1f70093234a54b81b64b91634decce5421efee191fd67f35e9d31e1ca89e6dbabb848e5987861f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_animation-4x.gif

Filesize
34KB

MD5
05b498ab846ca5ac26d31d5199abc45f

SHA1
a13953a8d54b353ddac2137beff9d011730376a2

SHA256
f022a43db9d7e656ec7cd393110aee1e688a28a16de5fb4657e4fe01c1c87a3a

SHA512
2cccd4f057ef0becc0564ffc0bdc78cb925289ca184b3975e1636336d50585444d65e498ce0bc83fe42005dea6ecb55ac47ad4971f8ba87f31ab1b005986cc87

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_animation.gif

Filesize
8KB

MD5
286f84f41ead9938df6ae8c62bf914d2

SHA1
9248afa6037758ae5be8fa5b971c2c67a8ebd932

SHA256
322d559a83963891c72caa38fbf8919f6ffd9880c8c3bc9337497c2740dfe4f3

SHA512
02990c2c011cd5db88fb84e2f932c5fcd807ff5e375d8449d9dfbf18dd2b00c6b3d3c3364afb700301503ea368def0e1825fdcfe50a9fbaca4e4b47c1b825672

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_restore-4x.gif

Filesize
22KB

MD5
5b443284dceb209344d32e44cfbd313f

SHA1
1eefd674aa8c664cca0bd54998af7fb1775de61d

SHA256
418663cb43e9e578bda9f9def8910fea0963d45bf0165e93b17155aacc9c0ef6

SHA512
5877928d94f94c1eee5730663523933658358866e9656cfdcf1334a23a8ec5b8d3b7c2b0f052c850bb9d700c3e49887b55f77ab11547f36866556291c54da167

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_restore.gif

Filesize
7KB

MD5
582b5863d1f645c572a6f0221b3ac4f2

SHA1
0b3a953e401b04a62f6a2b7f1d729a6687da04eb

SHA256
963afb7321d2ea8caf351f8812e03e0fe13a05014a2e78b2815f828df02ed5f6

SHA512
19b8f5e4a7ee8e80041ae699645d76198dca2598e4dfbfa2f6a48ff81c43a9ab0e301b997782c138bc02673c38f0f57b37ad33efc9650ab737ad92b5149f6017

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_bg-4x.gif

Filesize
239KB

MD5
4e75c99a0df6ee8cf4085aad7ce3af77

SHA1
a81686b143b0c06ac58578b13ec86d1dd7491af8

SHA256
b0e476dcb7862970101fc654c781aa28de2c0b8338d3488d23fb1ad433f05547

SHA512
4d8c20aa44d28b5fc04cd717547076a970cc902bebf043353250a2ed265219538f7278be4bfc93c21969ef5ee507945240d710f292a122de16d83dc5ba84fd46

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_bg-4x_dm.gif

Filesize
79KB

MD5
b4c4335390abe739e3d9698675e4fdb5

SHA1
f23abed958bc6909ce08ab9fc079e378db36a524

SHA256
34d604a74d3046657776b5c59cc46459ca82d4389e3edd3584c468084578c77d

SHA512
1db590405e78ef148ad0a8770215781eff3e04d11eba9c1c3fafa105ea22edda9fde868fc779e232bec859cbcc461cf4c626e1e4adba9db3ae979f78020f7a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_bg.gif

Filesize
45KB

MD5
3782ae3b83250b21db16455022d1b74d

SHA1
f7cd150e60cd4db42c12082f227fda7dbd113ed1

SHA256
9a07d871789105f1bcc3bccb00dc6a4d279a68d8e693d21fc0a48e241e071e23

SHA512
ce3d71ee82f27b0b019f9f7832bacec4d80c1dca9d5019163e2b5ddc28a9bf1cff8ac86d7a78c55beeff6c6c2b4e863defa4e110f7b30f4ffb6fdbbd717c5dcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_bg_new-4x.gif

Filesize
96KB

MD5
93de0959fbbc980f8489ac639094b8aa

SHA1
af1f6d009d198ddb2e9641f73f63e99e6a7004f1

SHA256
4276ae2134375f8d12e4b4e3ca917063404ac15950835a0647027ae1cf811c72

SHA512
6058af140de758cb943e3c8752f4dbf234fbb333d268e3d967f896549716a992e9ad155c75f87977ddf5480620a5681753a2f7097a6f55118105ca8186a2dafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_bg_new-4x_dm.gif

Filesize
79KB

MD5
fa686036c9302dafdc1e81a1035fcb62

SHA1
e309989bab3e590ae524f3958423138d333daeb3

SHA256
d4c34e1fbbff225c11abf11b5d5d9423b68a2744260296ddedad28f686968637

SHA512
4fcb35bfcbace0e1b1a8497b030530667471022483f8190cda0c48257b0878dd97c00bf8bd7878754b8ac65200091699f952b09a9b39a4b4fc81c43e4db44300

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_computer.gif

Filesize
3KB

MD5
0347bc6f20c62c8a8ae3c2fef6552502

SHA1
9e7d3cf738b760dda6070185187a8bd896ea7e48

SHA256
d4a1b733a8a2ce80c7809dfd85eade57fc9a01b05fedb2613a4c7fcc2792df3c

SHA512
f674eb7848b532a31731cd834979296e465d6c55735e43393978c2f784b10a2df025a6fceb5285b516eea8734866bff986f75d0b82372bb9046604f86284c298

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_langmenu-4x.gif

Filesize
94KB

MD5
fd00bd7ad227c542cf700f13526bec1b

SHA1
420454e5aa30251d299f598cfab0dc2db26b37b6

SHA256
37cf04a8a058f75d7e170073689fdd675fd7284159df319c3ad18cb260c4ff2b

SHA512
65486ddbc77657698e043fe8ae63bb2e1868623d7379e380bb329db60a0b9ff70a7fd842e6a8b53da0c6996303f6eb9b532a9b22e047da38ba03f9d47da8c0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_langmenu-4x_dm.gif

Filesize
112KB

MD5
b435a8e5b93d02a9b26f71d6839eaeba

SHA1
d5e48ce56363a52427a1f420a63f6f98c6662b38

SHA256
e44f536f21d121f7de196ed48224938c45b8a367d866212b434fc77757286972

SHA512
18da0df4229caf146422b201881e667d46756878f292d5f6045407c6a9e7b4890ead5b539d3a1b0e69504f40541642a4a1f6977a027ad85d7192d658d2f64ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_langmenu.gif

Filesize
19KB

MD5
111169ea8d294b8989cefe2347718e01

SHA1
1f935743cb64a1ddd11d52cbf613cf15b12c27c4

SHA256
2f30a922842d18cfddec9e3d745a253d5fcb4cb8ecbe4c96594df6ad2d16ff29

SHA512
e7b6dca44aadf8b867fd3ed8625e77839393dc1416b27d7866ce70fd5465756646783bdc76d6a363add8089c8f6d5c39bd8305decab3a6765f6d3e36b55e139b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_langmenu_new-4x_dm.gif

Filesize
67KB

MD5
e1ebae2b2203a31400fe68466e5cadae

SHA1
72735cae2a778f10dc20150122ba7b53ed3c11ce

SHA256
d0a80105ead46aafb7350d8b704a1b26f207181f718f37c1ddd22d45624ebde3

SHA512
5c112a0006566a4dc23d6c2e2e0a3c5b90d0f12ac45f44383d743afeb89a5466c4fffd1390fbe19b73d8b65b2a90b5bc5c9f54260bcdff812b9ec33076c9ba20

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_logo-4x.gif

Filesize
8KB

MD5
e362d57571a64cbae70019e11aabb371

SHA1
29a2d64cae7587860a4962968a7951212f88d304

SHA256
3b98f042a6b71ecf40bea69002007ef1fdbfc193499fa1e89dd6e1fa512aa83f

SHA512
a77a2d5afe6c44faf84d51e03fe96d6c45891b45b83ffced429a42cb924a1d70860418a2672d8f7e692e0c8465f3d7c5ec84376f85912931c3e3e0d963901d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_logo-4x_dm.gif

Filesize
8KB

MD5
1212a067e52a9d25a4f118a5b21e8f1b

SHA1
532bf306f4bba6c2aae1d42a64c99ede3c36e8dd

SHA256
7cd72772c87a314f079bcfc15c37f6ad0dc0622895cc3a13c3687ab35a037380

SHA512
c945f0e7a2b9c8fcb171b40956ca1488c287feccd14a54dd780ae4783fae6ed491c89c205db1fc30f5baccd51d12af3fb6a764717b40765fe5a76cc020540c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_logo.gif

Filesize
3KB

MD5
e323d560e40ce53a57371c89329b8d87

SHA1
7330d0476fbf9fbf6a96e7cd5f290ee519df774b

SHA256
81eb8b972d291fbf75b5f853845fa564fd250594daa037469ec7ab8645d5b00a

SHA512
2f4b196049b9a8f59b48888654508eb6ccd2f9d644933a1aa7981e7c9ce1177838da262e1a08b7b1203b7705b89a99a0d114ce190d7a1477db7cf30c6c8c155c

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbui_skin_vault.gif

Filesize
3KB

MD5
bb16131ee37cb9de0c7ada5033006ef1

SHA1
f50e08602b044a9461330fa667f2bd10912c25ff

SHA256
e35a5c675838aeed0982d6e863222e5d97b80af8e896f707998c95d424ebcb4e

SHA512
db3c41c6cc835bccbac2c48145dd2146cd4d75a6ce0decab8d509f323670c2283ae18a8a30e1e7471c965f3eb990b11886d9faadb5a3eeb34175435244b571eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzbuitray.exe

Filesize
517KB

MD5
d0aa1412f1160a012371f2fa0647ec27

SHA1
b727d77944410751a0a76e0d8a7ebc40c3530da0

SHA256
6ebb1bf3f6d6e997437075f06d905de0b796165e1ed8bcd42d8c2ababd47acba

SHA512
a80b0ee699145fb72ef3fcaec9a8409f4b0a0936cfdd5121ce4e6953bb534ac7fe66fb4ef840ec3fc2ca5054de2598695f47ac2e2f5a3cc6896bf633d02be4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzcustom.dat

Filesize
200B

MD5
fbaf48ec981a5eecdb57b929fdd426e8

SHA1
c45d01b195decd87a0bf097784fba6734005b8ea

SHA256
6d9c54dee5660c46886f32d80e57e9dd0ffa57ee0cd2a762b036d9c8e0c3a33a

SHA512
72686058f765941bfda046f7890a4b70d0c7a40a14baa73ebb1fdcd47cddc9072e5452f183b2f419b471c5b0c7d7ce074bf0b8ed004ebf418c7059737e6c093d

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzdoinstall.exe

Filesize
1.2MB

MD5
5aa008e117e5c6440a6f0b85fb9d10ba

SHA1
334d9a0443f0e33a89879228a86f5d479db25dd1

SHA256
f3f7c80d42f4df8b8f00ba2b19c30b17ffdf205a3386d367ffb41bc56716887e

SHA512
b4dab4181297ec03fab61c4ef3440d378df453eca215ff18112b188b21cc9f7039a5372bce56550266466fda8e825b29343a7971e5720d1e8bc84c3d894a571f

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzdownloader_ui_strings.xml

Filesize
109KB

MD5
450c0393b3292ef91a11f0f5c8dfa755

SHA1
5342b0c5a46b4a8c05425207ec7bbe50979ad8ad

SHA256
835a7893a0a1cf1414f7aaf9ea6fa6dcfb4310b23d8bcbf661abf4a99a68fc5b

SHA512
fd489c72aee1913512c82e6818f672b4ecbf73bf534eced5a2e03db3ac619cb4f9083644b7a7867c521ba3fdacd6916c5dba2e7412465d5dea12bee8a9633e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzfclean.exe

Filesize
162KB

MD5
5da3374069372609b45ee2920a14be7b

SHA1
a04f86f180c281d843fd5061b4f076e6d8d6a95d

SHA256
a612efffe5214ccbab3c5b26b0a751fe8c1cc6103fbc3182c641112c838bb5e8

SHA512
959f07cf11d0fb034de2200b42d6541da07f4c202bbedee00373423714377c7b505c35c77fc645081d2eef4874844e3f3dbea6caeb20e8d371acd73b3fb17055

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzfilelist.exe

Filesize
948KB

MD5
76a99363c25a8db4392990626e084246

SHA1
76fd3232a0d201e361193256e77b845ee1a62def

SHA256
0cd0ed9b210e69d7edaa3fd7b4a2379d99bc72c37d343f7fde55aa8809dcc5bf

SHA512
790c54703ed5c43d447dc1396f205adc5ecbde6e9cead5e1bc31bece4a505cfbe720a188863e0708f6036e1920dfe59013cd4febdee2ff951dcecc0ab55899f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzfilelist64.exe

Filesize
1.2MB

MD5
70b22b12825e71f73c402aa1c03c9866

SHA1
d3f2dd61fe672fe5bf4e9c3fe8b7895d4496ebbe

SHA256
c53cf36b32e7e43c6df8d17fa3dbb38f3e05205923295915ac26275f5e889fb9

SHA512
a2cc7f1dc62dd7367cac2a90430c4d117e0ba5cc2f9477ff9971a24aebe39e73631f630f314fe30a56b37d10e2d5ed925f82ec92dd5970d3c14414b5870aca33

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzinstallername.txt

Filesize
73B

MD5
e7ca57627a2e2b8b57f3d6d37815f54e

SHA1
2f1f4a2a7345267b7f20d80d280e6c5455f29b6e

SHA256
30c885b420a347f8c60310cd978df15c71b6c3c61ee21a55c2aceec5f56380df

SHA512
b34b4ba83878ec0194dc5f9cf189f0d58b8517dfb5e69de667ac7514d9070111549accd6af227b0313914cb0aba5414ee199249037b4b59bda0f0602ffdc52c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzrestore.exe

Filesize
8.6MB

MD5
c44ed243219a42bf7ac5f5b14332e4fe

SHA1
b9e575fe8db0fa0401b150a1eccd40b7ccd45140

SHA256
a378916bc3fc7b46bba65f3a5dabd062fc295b06201b2d48caea33816adfa0a5

SHA512
87b6321109b0872c456d562304743930ba41b29aaa4244c9b9a3ff90ac35f3ac19ae6008aff8c1077241bd61a9ea02352950a446bfda7eec781882bdd2d9c718

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzserv.exe

Filesize
827KB

MD5
7ab5c77b8bef46b817fed64028370157

SHA1
d5cefa53383dff87da3b3d08dee2137584073e05

SHA256
1406902ae86b64134cdcad15e58e3fb72d6d83c854001bec1ac15c598eac418a

SHA512
345ca67854ee33b3a9a7986098eb411cdcefbc0a4955afb42cf060f8c359d1b4b24770a25bcf17d8e501c0c7b028c8876b290f2c412ed9a29a84485a12ffca06

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit.exe

Filesize
4.3MB

MD5
fb1b42dfab590c1e36f21302dbab5fa7

SHA1
1eddaef68763a6551424141ba1e679b960870966

SHA256
e99398f2d994fbf74553b41dc3999948495ff4ea320df3fe5fd47021f3467ac3

SHA512
69cd79d5195b6e3816589cbe5f820320d5fc953c54657e5e248c1595d9d7ef9627612adf282e2c653dca2453690a31f37b90a7dd99e5595e46547431870bf909

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bztransmit64.exe

Filesize
5.3MB

MD5
b96330a88110ce93beb4d67299bd500d

SHA1
781d26370e95a277464b037bc03d086b90cff31c

SHA256
1573a6991ceb15719e346a009c73be6bcc426e50a3d3fbb2879a206321671d13

SHA512
9ddcd74bc1f14565e790bbd837e8f70c5182ef452fc09a80530dd67c9a57b8ba3639301e2b24ad1fa5dad5292e6c7de9bb26d573c4a0e26f7c476fbe9f685e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\bzwinrt.dll

Filesize
40KB

MD5
c751cfdb887a88c8e50974fd8a8daa14

SHA1
b5431085c937de19d899b907f49a60f8156a54d2

SHA256
245655311b352358901af072b7789bc076005189905e0bd0a5c322cd1dd3874f

SHA512
59e3e87de1ccb7a536612cb08c153e8a283d638b721cb17f427cc62ed211d9adb0206ee1e8ed0fd3d35a78d676eae36124ce78cecf9688fa89dd46a28939df1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\still_cloud_win_120p.gif

Filesize
6KB

MD5
bd3371d7807024ee2fa3e7b2ede629dd

SHA1
8f154d0b134ac3356af8866de8f2f172bb90c978

SHA256
0af0126b100344d4c5ff333c763a9d4729e2b43fbfe8a863083135ed67fcafc2

SHA512
73b7593a584595b655628123c03ea0375e5ac42eb440cb189a6d0ba1956b3d08d5fb6474ed3416e6e6c0a57a58296423f0f6322129ebe1ebfab6f24a3114a3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\windows-cloud-4x.gif

Filesize
7KB

MD5
a170a009a9db214721f150ee4d976f6b

SHA1
cc210758132d8c1328a46122d4e889f8b6815087

SHA256
9316ca14c33bbb1e533c441ff67f46f545a9a6d5f1ad34d1a4407d3869d3d36b

SHA512
c81e7069615f3b70677738c45303963a002e3d91f63816412ba0ebe6f91833771900b89f7b07770426817d253e3dd4f34fa222ab20df9191b9ab45af7bf14c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzi0919191216_0000001_1742dir\windows-computer-4x.gif

Filesize
8KB

MD5
c96cb4426c0432488c85a5f9b26b4e17

SHA1
b9b25a3bac4e99539bdc3813790c59a5af79ff81

SHA256
08fd3d6dae2021c4ef2309e1c72b615cdf1511bca03bf7e0b9cda8e355fe7b42

SHA512
441e3c1aaaad9e919aa6ff17b12db58f06ca6bdd21fde77b0c8632a5340e19fc36ffad23a99c21319e3840851938ce680569fc8df36d8bf77b0ebb764a6023da

Download Submit
C:\Users\Admin\AppData\Local\Temp\bzt0919191218_0000001_3672_0004928.txt

Filesize
24KB

MD5
34e14dacfd1d448a1086d403f6684932

SHA1
5f15d414a7e7b269e6e4669026803ffa7e2c38cb

SHA256
9a9b1e48bd5e3fab0af8f86f32363ff1380ce952c2b1a67b02fde94727d0fbce

SHA512
898f1d59a7dc56d9a31cae1126416314f5b9dcef43ba9705542d2b10fe38b1fbf0a72eac69aa801a4791100da495362308175bd059ad9bd5c699602a29d2660e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{404c9c27-8377-4fd1-b607-7ca635db4e49}\.ba1\1055\license.rtf

Filesize
177KB

MD5
f1a281f74d3e91d16dd26d1f313cd8a9

SHA1
ddb2ca9032c5a9c091eac53b679f6ba428077b00

SHA256
f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25

SHA512
484c5ca26275427e1fb74d3217a22a0e4aac409aba973e78d7ad68834e7ad1d86c7855d34b227925200f941d288dfc09477b2d7dfe0856810c6c847297b8d625

Download Submit
C:\Users\Admin\AppData\Local\Temp\{404c9c27-8377-4fd1-b607-7ca635db4e49}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\bzj0919191257_0000003_7996_0002528.zip

Filesize
6KB

MD5
6a3759d32aadd46d9bfe34eb6997942c

SHA1
d8cc00096ea934393ceef408353180f94be46806

SHA256
8b792bee29b5bdc5e7ab281f34ab569a0b6134f3074c7dba4b5a8015351a3998

SHA512
d81dc5ab6e6e003f75a320b9a07c79114b397490869ddcb16b4a62510eae04e7245c696b31d02dcfadf644456162550068f2a5e642aa255e042ac1583eed83d2

Download Submit