babadeda | ebaa5af691e844929d2cad60baf36b118db3fc4b0616ce8b9585838aaf4c34b6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AdvBackup.msi
Size

7.7MB
MD5

25ad5262c29d2ea7404bda26ef0188bd
SHA1

83f9194b6224defe5827c94c67c2d32808d71919
SHA256

a45f49a2506f2353a72a287630f6ce1ab002554c75fc65a19321366bdd29ed0f
SHA512

7c990871346fe2e9d18cb4a46cd8f7cec07f1d4d5430362f2c6c60d2cbd34ac3cc61da121e50cba5f3a3a964876e6f4dd34c5a93344daae959e0fe030d532088
SSDEEP

196608:Ou6xR3okM5G6HO1XvOJeQDlG73LDl8cgdtNb4Ccgyftd:Ou6n3O5G6H8/YND873nyZrIt

Score

10^/10

babadeda cryptbot crypter discovery loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

cryptbot

veocou63.top

morizu06.top

Attributes

payload_url
http://tynpdi08.top/download.php?file=loungy.exe

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral3/files/0x00050000000195c2-75.dat	family_babadeda

Babadeda family
babadeda
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f772bd1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f772bd1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C5E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E90.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f772bd2.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f772bd4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f772bd2.ipi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	backdata.exe

Loads dropped DLL 6 IoCs

pid	Process
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
1320	MsiExec.exe
2656	backdata.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2368	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backdata.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	backdata.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	backdata.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1368	timeout.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2072	msiexec.exe
2072	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2368	msiexec.exe
Token: SeRestorePrivilege	2072	msiexec.exe
Token: SeTakeOwnershipPrivilege	2072	msiexec.exe
Token: SeSecurityPrivilege	2072	msiexec.exe
Token: SeCreateTokenPrivilege	2368	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2368	msiexec.exe
Token: SeLockMemoryPrivilege	2368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2368	msiexec.exe
Token: SeMachineAccountPrivilege	2368	msiexec.exe
Token: SeTcbPrivilege	2368	msiexec.exe
Token: SeSecurityPrivilege	2368	msiexec.exe
Token: SeTakeOwnershipPrivilege	2368	msiexec.exe
Token: SeLoadDriverPrivilege	2368	msiexec.exe
Token: SeSystemProfilePrivilege	2368	msiexec.exe
Token: SeSystemtimePrivilege	2368	msiexec.exe
Token: SeProfSingleProcessPrivilege	2368	msiexec.exe
Token: SeIncBasePriorityPrivilege	2368	msiexec.exe
Token: SeCreatePagefilePrivilege	2368	msiexec.exe
Token: SeCreatePermanentPrivilege	2368	msiexec.exe
Token: SeBackupPrivilege	2368	msiexec.exe
Token: SeRestorePrivilege	2368	msiexec.exe
Token: SeShutdownPrivilege	2368	msiexec.exe
Token: SeDebugPrivilege	2368	msiexec.exe
Token: SeAuditPrivilege	2368	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2368	msiexec.exe
Token: SeChangeNotifyPrivilege	2368	msiexec.exe
Token: SeRemoteShutdownPrivilege	2368	msiexec.exe
Token: SeUndockPrivilege	2368	msiexec.exe
Token: SeSyncAgentPrivilege	2368	msiexec.exe
Token: SeEnableDelegationPrivilege	2368	msiexec.exe
Token: SeManageVolumePrivilege	2368	msiexec.exe
Token: SeImpersonatePrivilege	2368	msiexec.exe
Token: SeCreateGlobalPrivilege	2368	msiexec.exe
Token: SeCreateTokenPrivilege	2368	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2368	msiexec.exe
Token: SeLockMemoryPrivilege	2368	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2368	msiexec.exe
Token: SeMachineAccountPrivilege	2368	msiexec.exe
Token: SeTcbPrivilege	2368	msiexec.exe
Token: SeSecurityPrivilege	2368	msiexec.exe
Token: SeTakeOwnershipPrivilege	2368	msiexec.exe
Token: SeLoadDriverPrivilege	2368	msiexec.exe
Token: SeSystemProfilePrivilege	2368	msiexec.exe
Token: SeSystemtimePrivilege	2368	msiexec.exe
Token: SeProfSingleProcessPrivilege	2368	msiexec.exe
Token: SeIncBasePriorityPrivilege	2368	msiexec.exe
Token: SeCreatePagefilePrivilege	2368	msiexec.exe
Token: SeCreatePermanentPrivilege	2368	msiexec.exe
Token: SeBackupPrivilege	2368	msiexec.exe
Token: SeRestorePrivilege	2368	msiexec.exe
Token: SeShutdownPrivilege	2368	msiexec.exe
Token: SeDebugPrivilege	2368	msiexec.exe
Token: SeAuditPrivilege	2368	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2368	msiexec.exe
Token: SeChangeNotifyPrivilege	2368	msiexec.exe
Token: SeRemoteShutdownPrivilege	2368	msiexec.exe
Token: SeUndockPrivilege	2368	msiexec.exe
Token: SeSyncAgentPrivilege	2368	msiexec.exe
Token: SeEnableDelegationPrivilege	2368	msiexec.exe
Token: SeManageVolumePrivilege	2368	msiexec.exe
Token: SeImpersonatePrivilege	2368	msiexec.exe
Token: SeCreateGlobalPrivilege	2368	msiexec.exe
Token: SeCreateTokenPrivilege	2368	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2368	msiexec.exe
2368	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2656	backdata.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2328	2072	msiexec.exe	31
PID 2072 wrote to memory of 2328	2072	msiexec.exe	31
PID 2072 wrote to memory of 2328	2072	msiexec.exe	31
PID 2072 wrote to memory of 2328	2072	msiexec.exe	31
PID 2072 wrote to memory of 2328	2072	msiexec.exe	31
PID 2072 wrote to memory of 2328	2072	msiexec.exe	31
PID 2072 wrote to memory of 2328	2072	msiexec.exe	31
PID 2072 wrote to memory of 1320	2072	msiexec.exe	36
PID 2072 wrote to memory of 1320	2072	msiexec.exe	36
PID 2072 wrote to memory of 1320	2072	msiexec.exe	36
PID 2072 wrote to memory of 1320	2072	msiexec.exe	36
PID 2072 wrote to memory of 1320	2072	msiexec.exe	36
PID 2072 wrote to memory of 1320	2072	msiexec.exe	36
PID 2072 wrote to memory of 1320	2072	msiexec.exe	36
PID 2072 wrote to memory of 2656	2072	msiexec.exe	37
PID 2072 wrote to memory of 2656	2072	msiexec.exe	37
PID 2072 wrote to memory of 2656	2072	msiexec.exe	37
PID 2072 wrote to memory of 2656	2072	msiexec.exe	37
PID 2072 wrote to memory of 2656	2072	msiexec.exe	37
PID 2072 wrote to memory of 2656	2072	msiexec.exe	37
PID 2072 wrote to memory of 2656	2072	msiexec.exe	37
PID 2656 wrote to memory of 1532	2656	backdata.exe	38
PID 2656 wrote to memory of 1532	2656	backdata.exe	38
PID 2656 wrote to memory of 1532	2656	backdata.exe	38
PID 2656 wrote to memory of 1532	2656	backdata.exe	38
PID 1532 wrote to memory of 1368	1532	cmd.exe	40
PID 1532 wrote to memory of 1368	1532	cmd.exe	40
PID 1532 wrote to memory of 1368	1532	cmd.exe	40
PID 1532 wrote to memory of 1368	1532	cmd.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AdvBackup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15D75EF5E9FACFC181244786749F5212 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A7AD20D45176D076C9596E7253E68581
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1320
- C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe
  "C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\jyXbRNRTm & timeout 4 & del /f /q "C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2568

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E0" "00000000000005DC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f772bd3.rbs

Filesize
12KB

MD5
1bb78af4e4723c2085def6ffdbe48600

SHA1
aae314f40ee77eb4aa3bc190164bf88fd94167a5

SHA256
69bc6ec4ca347c2c63495d861a00621c7af7a42709df95dd2aeedb9e16bb53a5

SHA512
78f623a90351fc1f49c439a44dd4767c160e9fec1118bdec54a16ed8a4e8daab2603ab15a9790b6458b4a395f9913166fc9dd5e10abc7e2bb704298eeed0a193

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB6E1.tmp

Filesize
393KB

MD5
3d24a2af1fb93f9960a17d6394484802

SHA1
ee74a6ceea0853c47e12802961a7a8869f7f0d69

SHA256
8d23754e6b8bb933d79861540b50deca42e33ac4c3a6669c99fb368913b66d88

SHA512
f6a19d00896a63debb9ee7cdd71a92c0a3089b6f4c44976b9c30d97fcbaacd74a8d56150be518314fac74dd3ebea2001dc3859b0f3e4e467a01721b29f6227ba

Download Submit
C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe

Filesize
10.2MB

MD5
b4f358fb5e2687505a7793a1c3fd30b8

SHA1
665fdf0bfece66a4e65684e4a8022ba18ea90b29

SHA256
843daace027b06df1ceb220a8dca85099e6249d3cd588f192c19105dfebd9008

SHA512
73c875846ec43aa2db3d0d45cedd330e8ae2bc1fe58298a08e6ad9824a5caedb00d670a7d1816ff7c778e4ac0bd6b166107a1b64cc0ff5d5ed50893ded8d9aeb

Download Submit
C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\libmetis30.dll

Filesize
3.8MB

MD5
5a9963267a59111458cc97cffe054699

SHA1
233cd89ab6cef194b2aaa9cc17bfb7f3f24e7411

SHA256
21b706d416bbdaf6037e8efbfa86cf1eb10fc1834dfa8fdf2386a7f0492246db

SHA512
03c7b50185b084e6ccf4c09be1eeff7fc6c254e22e36eb4b8a11e3d6b239f378df1659274fe2341a5a54b8b0043fc44678a2405716c54109391b67925fe5edd8

Download Submit
C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\mlg

Filesize
559KB

MD5
d3cefa732bbfb96d5e9ac98650a85733

SHA1
b6a914c0e61d1640b83849ae77d2aa3e0b28604b

SHA256
025545351f15a7e62b271453eb5f2e12e13d53bf8b08d466d3e6e62a5c530e81

SHA512
fc582f7e19d843b854e75f5f7b39713152c3b1c3d5f599eae46c78d9cfa358a2b81de47dda6c0769f346fed98d7e00cc0a4a46c126a5d2b4b78268ec163fdf4b

Download Submit
C:\Windows\Installer\f772bd1.msi

Filesize
7.7MB

MD5
25ad5262c29d2ea7404bda26ef0188bd

SHA1
83f9194b6224defe5827c94c67c2d32808d71919

SHA256
a45f49a2506f2353a72a287630f6ce1ab002554c75fc65a19321366bdd29ed0f

SHA512
7c990871346fe2e9d18cb4a46cd8f7cec07f1d4d5430362f2c6c60d2cbd34ac3cc61da121e50cba5f3a3a964876e6f4dd34c5a93344daae959e0fe030d532088

Download Submit
memory/2656-72-0x0000000001090000-0x0000000001B2D000-memory.dmp

Filesize
10.6MB

Download
memory/2656-82-0x0000000001090000-0x0000000001B2D000-memory.dmp

Filesize
10.6MB

Download