Analysis
- max time kernel
117s - max time network
118s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
10/01/2025, 23:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_f0b05b2333d9f421e29ea1c9d0ba0260.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_f0b05b2333d9f421e29ea1c9d0ba0260.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
AdvBackup.msi
Resource
win7-20240708-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral4
Sample
AdvBackup.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target AdvBackup.msi
- Size 7.7MB
- Sample250110-24eweaskdx
- SHA256 a45f49a2506f2353a72a287630f6ce1ab002554c75fc65a19321366bdd29ed0f
- MD5 25ad5262c29d2ea7404bda26ef0188bd
- SHA1 83f9194b6224defe5827c94c67c2d32808d71919
- SHA512 7c990871346fe2e9d18cb4a46cd8f7cec07f1d4d5430362f2c6c60d2cbd34ac3cc61da121e50cba5f3a3a964876e6f4dd34c5a93344daae959e0fe030d532088
- SSDEEP 196608:Ou6xR3okM5G6HO1XvOJeQDlG73LDl8cgdtNb4Ccgyftd:Ou6n3O5G6H8/YND873nyZrIt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cryptbot
C2
-
veocou63.top
-
morizu06.top
Attributes
-
payload_url
http://tynpdi08.top/download.php?file=loungy.exe
Signatures
- Babadeda Crypter 1 IoCs
resource yara_rule behavioral3/files/0x00050000000195c2-75.dat family_babadeda - Babadeda family
- Cryptbot family
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f772bd1.msi msiexec.exe File opened for modification C:\Windows\Installer\f772bd1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2C5E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E90.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f772bd2.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f772bd4.msi msiexec.exe File opened for modification C:\Windows\Installer\f772bd2.ipi msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2656 backdata.exe - Loads dropped DLL 6 IoCs
pid Process 2328 MsiExec.exe 2328 MsiExec.exe 2328 MsiExec.exe 2328 MsiExec.exe 1320 MsiExec.exe 2656 backdata.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2368 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language backdata.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 backdata.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString backdata.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1368 timeout.exe - Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2072 msiexec.exe 2072 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2368 msiexec.exe Token: SeIncreaseQuotaPrivilege 2368 msiexec.exe Token: SeRestorePrivilege 2072 msiexec.exe Token: SeTakeOwnershipPrivilege 2072 msiexec.exe Token: SeSecurityPrivilege 2072 msiexec.exe Token: SeCreateTokenPrivilege 2368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2368 msiexec.exe Token: SeLockMemoryPrivilege 2368 msiexec.exe Token: SeIncreaseQuotaPrivilege 2368 msiexec.exe Token: SeMachineAccountPrivilege 2368 msiexec.exe Token: SeTcbPrivilege 2368 msiexec.exe Token: SeSecurityPrivilege 2368 msiexec.exe Token: SeTakeOwnershipPrivilege 2368 msiexec.exe Token: SeLoadDriverPrivilege 2368 msiexec.exe Token: SeSystemProfilePrivilege 2368 msiexec.exe Token: SeSystemtimePrivilege 2368 msiexec.exe Token: SeProfSingleProcessPrivilege 2368 msiexec.exe Token: SeIncBasePriorityPrivilege 2368 msiexec.exe Token: SeCreatePagefilePrivilege 2368 msiexec.exe Token: SeCreatePermanentPrivilege 2368 msiexec.exe Token: SeBackupPrivilege 2368 msiexec.exe Token: SeRestorePrivilege 2368 msiexec.exe Token: SeShutdownPrivilege 2368 msiexec.exe Token: SeDebugPrivilege 2368 msiexec.exe Token: SeAuditPrivilege 2368 msiexec.exe Token: SeSystemEnvironmentPrivilege 2368 msiexec.exe Token: SeChangeNotifyPrivilege 2368 msiexec.exe Token: SeRemoteShutdownPrivilege 2368 msiexec.exe Token: SeUndockPrivilege 2368 msiexec.exe Token: SeSyncAgentPrivilege 2368 msiexec.exe Token: SeEnableDelegationPrivilege 2368 msiexec.exe Token: SeManageVolumePrivilege 2368 msiexec.exe Token: SeImpersonatePrivilege 2368 msiexec.exe Token: SeCreateGlobalPrivilege 2368 msiexec.exe Token: SeCreateTokenPrivilege 2368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2368 msiexec.exe Token: SeLockMemoryPrivilege 2368 msiexec.exe Token: SeIncreaseQuotaPrivilege 2368 msiexec.exe Token: SeMachineAccountPrivilege 2368 msiexec.exe Token: SeTcbPrivilege 2368 msiexec.exe Token: SeSecurityPrivilege 2368 msiexec.exe Token: SeTakeOwnershipPrivilege 2368 msiexec.exe Token: SeLoadDriverPrivilege 2368 msiexec.exe Token: SeSystemProfilePrivilege 2368 msiexec.exe Token: SeSystemtimePrivilege 2368 msiexec.exe Token: SeProfSingleProcessPrivilege 2368 msiexec.exe Token: SeIncBasePriorityPrivilege 2368 msiexec.exe Token: SeCreatePagefilePrivilege 2368 msiexec.exe Token: SeCreatePermanentPrivilege 2368 msiexec.exe Token: SeBackupPrivilege 2368 msiexec.exe Token: SeRestorePrivilege 2368 msiexec.exe Token: SeShutdownPrivilege 2368 msiexec.exe Token: SeDebugPrivilege 2368 msiexec.exe Token: SeAuditPrivilege 2368 msiexec.exe Token: SeSystemEnvironmentPrivilege 2368 msiexec.exe Token: SeChangeNotifyPrivilege 2368 msiexec.exe Token: SeRemoteShutdownPrivilege 2368 msiexec.exe Token: SeUndockPrivilege 2368 msiexec.exe Token: SeSyncAgentPrivilege 2368 msiexec.exe Token: SeEnableDelegationPrivilege 2368 msiexec.exe Token: SeManageVolumePrivilege 2368 msiexec.exe Token: SeImpersonatePrivilege 2368 msiexec.exe Token: SeCreateGlobalPrivilege 2368 msiexec.exe Token: SeCreateTokenPrivilege 2368 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2368 msiexec.exe 2368 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2656 backdata.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2328 2072 msiexec.exe 31 PID 2072 wrote to memory of 2328 2072 msiexec.exe 31 PID 2072 wrote to memory of 2328 2072 msiexec.exe 31 PID 2072 wrote to memory of 2328 2072 msiexec.exe 31 PID 2072 wrote to memory of 2328 2072 msiexec.exe 31 PID 2072 wrote to memory of 2328 2072 msiexec.exe 31 PID 2072 wrote to memory of 2328 2072 msiexec.exe 31 PID 2072 wrote to memory of 1320 2072 msiexec.exe 36 PID 2072 wrote to memory of 1320 2072 msiexec.exe 36 PID 2072 wrote to memory of 1320 2072 msiexec.exe 36 PID 2072 wrote to memory of 1320 2072 msiexec.exe 36 PID 2072 wrote to memory of 1320 2072 msiexec.exe 36 PID 2072 wrote to memory of 1320 2072 msiexec.exe 36 PID 2072 wrote to memory of 1320 2072 msiexec.exe 36 PID 2072 wrote to memory of 2656 2072 msiexec.exe 37 PID 2072 wrote to memory of 2656 2072 msiexec.exe 37 PID 2072 wrote to memory of 2656 2072 msiexec.exe 37 PID 2072 wrote to memory of 2656 2072 msiexec.exe 37 PID 2072 wrote to memory of 2656 2072 msiexec.exe 37 PID 2072 wrote to memory of 2656 2072 msiexec.exe 37 PID 2072 wrote to memory of 2656 2072 msiexec.exe 37 PID 2656 wrote to memory of 1532 2656 backdata.exe 38 PID 2656 wrote to memory of 1532 2656 backdata.exe 38 PID 2656 wrote to memory of 1532 2656 backdata.exe 38 PID 2656 wrote to memory of 1532 2656 backdata.exe 38 PID 1532 wrote to memory of 1368 1532 cmd.exe 40 PID 1532 wrote to memory of 1368 1532 cmd.exe 40 PID 1532 wrote to memory of 1368 1532 cmd.exe 40 PID 1532 wrote to memory of 1368 1532 cmd.exe 40 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AdvBackup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2368
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 15D75EF5E9FACFC181244786749F5212 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A7AD20D45176D076C9596E7253E685812⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1320
-
-
C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe"C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\jyXbRNRTm & timeout 4 & del /f /q "C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\timeout.exetimeout 44⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1368
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2568
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E0" "00000000000005DC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f772bd3.rbs
- Size 12KB
- SHA256 69bc6ec4ca347c2c63495d861a00621c7af7a42709df95dd2aeedb9e16bb53a5
- MD5 1bb78af4e4723c2085def6ffdbe48600
- SHA1 aae314f40ee77eb4aa3bc190164bf88fd94167a5
- SHA512 78f623a90351fc1f49c439a44dd4767c160e9fec1118bdec54a16ed8a4e8daab2603ab15a9790b6458b4a395f9913166fc9dd5e10abc7e2bb704298eeed0a193
- SSDEEP 192:z8cbrk1TuvF19EdexpxqpxaX2FxMyipqSi:zj6gFXLpgp5xP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSIB6E1.tmp
- Size 393KB
- SHA256 8d23754e6b8bb933d79861540b50deca42e33ac4c3a6669c99fb368913b66d88
- MD5 3d24a2af1fb93f9960a17d6394484802
- SHA1 ee74a6ceea0853c47e12802961a7a8869f7f0d69
- SHA512 f6a19d00896a63debb9ee7cdd71a92c0a3089b6f4c44976b9c30d97fcbaacd74a8d56150be518314fac74dd3ebea2001dc3859b0f3e4e467a01721b29f6227ba
- SSDEEP 6144:hsEQsy5dfBkvAUnBU76LNaiDWbqw0EAOqcmCIVKVPgvf:4sw6vAUnBU7qax0EzIVYgvf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\backdata.exe
- Size 10.2MB
- SHA256 843daace027b06df1ceb220a8dca85099e6249d3cd588f192c19105dfebd9008
- MD5 b4f358fb5e2687505a7793a1c3fd30b8
- SHA1 665fdf0bfece66a4e65684e4a8022ba18ea90b29
- SHA512 73c875846ec43aa2db3d0d45cedd330e8ae2bc1fe58298a08e6ad9824a5caedb00d670a7d1816ff7c778e4ac0bd6b166107a1b64cc0ff5d5ed50893ded8d9aeb
- SSDEEP 98304:nVliT7PXJ6o1gCRPkMGPdJ4DpOId/renr6qKvnjP+92Aw9Dc/wLV0CvR8+pQj/JO:PiRgMPAj+YId/CuqtZ/80CvRJpQj/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\libmetis30.dll
- Size 3.8MB
- SHA256 21b706d416bbdaf6037e8efbfa86cf1eb10fc1834dfa8fdf2386a7f0492246db
- MD5 5a9963267a59111458cc97cffe054699
- SHA1 233cd89ab6cef194b2aaa9cc17bfb7f3f24e7411
- SHA512 03c7b50185b084e6ccf4c09be1eeff7fc6c254e22e36eb4b8a11e3d6b239f378df1659274fe2341a5a54b8b0043fc44678a2405716c54109391b67925fe5edd8
- SSDEEP 49152:mxIkTeaHHnWNbAyYgi3nOSJHXCDUEeoJNKwBIMcRc/s+kobXnz/q/xnd/c/fnr/U:mxIEhn+AqUnOSNXCDPqXqGbI3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Chris Long\Advanced Backup\mlg
- Size 559KB
- SHA256 025545351f15a7e62b271453eb5f2e12e13d53bf8b08d466d3e6e62a5c530e81
- MD5 d3cefa732bbfb96d5e9ac98650a85733
- SHA1 b6a914c0e61d1640b83849ae77d2aa3e0b28604b
- SHA512 fc582f7e19d843b854e75f5f7b39713152c3b1c3d5f599eae46c78d9cfa358a2b81de47dda6c0769f346fed98d7e00cc0a4a46c126a5d2b4b78268ec163fdf4b
- SSDEEP 12288:Ip1U7+RBnKXz0O/+aUylHuETXymu585423SUVkz+2:Ei+vKL/5lCmu5yYmkD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\f772bd1.msi
- Size 7.7MB
- SHA256 a45f49a2506f2353a72a287630f6ce1ab002554c75fc65a19321366bdd29ed0f
- MD5 25ad5262c29d2ea7404bda26ef0188bd
- SHA1 83f9194b6224defe5827c94c67c2d32808d71919
- SHA512 7c990871346fe2e9d18cb4a46cd8f7cec07f1d4d5430362f2c6c60d2cbd34ac3cc61da121e50cba5f3a3a964876e6f4dd34c5a93344daae959e0fe030d532088
- SSDEEP 196608:Ou6xR3okM5G6HO1XvOJeQDlG73LDl8cgdtNb4Ccgyftd:Ou6n3O5G6H8/YND873nyZrIt
- MD5 SHA1 SHA512 SSDEEP