af89bdcd0cfded591f9ac57ce7e6e5641144ad2c2d853f793aa0752e831bf4a7

Resubmissions

04/08/2026, 19:20

260804-x14yxaff777

23/07/2026, 14:06

260723-ree5rsdr217

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
Size 25.0MB
Sample260723-ree5rsdr21
SHA256 af89bdcd0cfded591f9ac57ce7e6e5641144ad2c2d853f793aa0752e831bf4a7
MD5 85e2c3ad0004658fe445c24efb8683aa
SHA1 18ddb40a4643e18e04a966fe0d2e3b797230b614
SHA512 29ad0075b133781052b33688d44ddcaa6a71b634554e776dc6fdb219957422c180361ce41ba048e0c65a8bbef11b6796e24156663ec7cda723e3a81fd46c3c1f
SSDEEP 786432:irjDdeSUFlmpzKNkbofZP2eq6vVLkGkPYM6znBF0pa:ir/dxUFlmp83QeoZYvznBFt
TLSH
T183472373D85A00FAE47D17F624DC9FB2088C9C1F6CC209C546EC6291C287ABA67D3679
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5040	icacls.exe
1616	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Online Backup\hu-HU\Cloud.Base.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\SecureBlackbox.SFTPCommon.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\fr-FR\Cloud.Backup.Engine.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\pt-PT\Cloud.Wizard.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\nl-NL\Cloud.Backup.Engine.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\cs-CZ\Cloud.Backup.UI.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Cloud.Backup.config	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Cloud.Backup.Scheduler.InstallState	installutil.exe
File created	C:\Program Files\Online Backup\Cloud.Backup.UI.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\System.Data.HashFunction.xxHash.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\SQLite.Interop.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\es-ES\cbb.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\pt-PT\Cloud.Backup.Engine.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\tr-TR\Cloud.Base.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\CBBackupPlan.exe.config	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\System.Memory.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\es-ES\Cloud.Backup.ConsoleWPF.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\nl-BE\Cloud.Backup.Exchange.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\ZstdNet.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\ja-JP\CBBackupPlan.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\it-IT\Cloud.Wizard.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\cs-CZ\cbb.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File opened for modification	C:\Program Files\Online Backup\Cloud.Backup.Scheduler.InstallLog	installutil.exe
File created	C:\Program Files\Online Backup\Cloud.DiskImage.RestoreVerificationService.exe	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\zh-CHS\Cloud.Backup.Scheduler.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\it-IT\cbb.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\pt-PT\cbb.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\pt-PT\Cloud.Backup.VM.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Cloud.Wizard.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\pl-PL\Cloud.Base.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\es-ES\CBBackupPlan.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File opened for modification	C:\Program Files\Online Backup\Cloud.Backup.RM.Service.InstallLog	installutil.exe
File created	C:\Program Files\Online Backup\pl-PL\Cloud.Backup.Scheduler.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Http2.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Cloud.Backup.Engine.XmlSerializers.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\AlphaVSS.Common.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Cloud.Backup.RM.Client.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\tr-TR\Cloud.Backup.Scheduler.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\tr-TR\Cloud.Backup.ConsoleWPF.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\cs-CZ\Cloud.Backup.Engine.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\SecureBlackbox.SSLClient.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\pl-PL\Cloud.Backup.UI.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\ru-RU\Cloud.Backup.UI.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\cs-CZ\CBBackupPlan.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Hpack.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\es-ES\Cloud.Backup.Engine.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\es-ES\Cloud.Backup.VM.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\nb-NO\Cloud.Backup.Engine.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\pt-PT\Cloud.Backup.Exchange.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\nl-NL\cbb.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\tr-TR\Cloud.Backup.VM.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\tr-TR\Cloud.Wizard.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Cloud.DiskImage.Flash.Launcher.exe	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Microsoft.Extensions.Logging.Abstractions.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\SecureBlackbox.SSHCommon.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\ICSharpCode.SharpZipLib.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\Drivers\cbfs.cab	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\es-ES\Cloud.Backup.UI.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\hu-HU\cbb.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\sv-SE\cbb.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\DiskAccessLibrary.FileSystems.Abstractions.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\CBFS6Net.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\sv-SE\Cloud.Backup.ConsoleWPF.resources.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
File created	C:\Program Files\Online Backup\System.Data.SQLite.dll	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe

Executes dropped EXE 6 IoCs

pid	Process
256	cbb.exe
1808	cbb.exe
2708	cbb.exe
3444	Cloud.Backup.Scheduler.exe
2616	Cloud.Backup.RM.Service.exe
2168	Online Backup.exe

Loads dropped DLL 45 IoCs

pid	Process
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
3444	Cloud.Backup.Scheduler.exe
3444	Cloud.Backup.Scheduler.exe
3444	Cloud.Backup.Scheduler.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
2616	Cloud.Backup.RM.Service.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1680	CMD.EXE
3376	CMD.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Cloud.Backup.RM.Service.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA3D137D-C8B4-4e54-BAD8-35BC178821D9}	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BA3D137D-C8B4-4e54-BAD8-35BC178821D9}\id = "{EF468777-3AD2-4936-9457-4C02C0EAA317}"	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C	cbb.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c190000000100000010000000a344f71a7a52a76ee49b74b1d8816b156b000000010000002000000046011ede1c147eb2bc731a539b7c047b7ee93e48b9d3c3ba710ce132bbdfac6b0f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e641400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e425c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e	cbb.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe
2616	Cloud.Backup.RM.Service.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	256	cbb.exe
Token: SeDebugPrivilege	1808	cbb.exe
Token: SeDebugPrivilege	2708	cbb.exe
Token: SeDebugPrivilege	3444	Cloud.Backup.Scheduler.exe
Token: SeDebugPrivilege	3840	installutil.exe
Token: SeDebugPrivilege	3272	installutil.exe
Token: SeDebugPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeDebugPrivilege	2168	Online Backup.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeSecurityPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe
Token: SeBackupPrivilege	2616	Cloud.Backup.RM.Service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1680	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	90
PID 4716 wrote to memory of 2984	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	92
PID 4716 wrote to memory of 4720	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	94
PID 4716 wrote to memory of 5040	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	97
PID 4716 wrote to memory of 1616	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	99
PID 4716 wrote to memory of 256	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	101
PID 4716 wrote to memory of 1808	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	103
PID 4716 wrote to memory of 2708	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	105
PID 4716 wrote to memory of 3264	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	107
PID 4716 wrote to memory of 2164	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	109
PID 4716 wrote to memory of 3840	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	112
PID 4716 wrote to memory of 3272	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	115
PID 4716 wrote to memory of 2168	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	118
PID 4716 wrote to memory of 3376	4716	nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe	121

C:\Users\Admin\AppData\Local\Temp\nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe
"C:\Users\Admin\AppData\Local\Temp\nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\CMD.EXE
  "C:\Windows\system32\CMD.EXE" /C move /y "C:\Users\Admin\AppData\Local\Temp\install.log" "C:\Program Files\Online Backup\"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Online Backup\Cloud.Backup.RM.Service.exe"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Online Backup\Cloud.Backup.Scheduler.exe"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Program Files\Online Backup\Cloud.Backup.config" /grant *S-1-5-32-544:(F)
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Program Files\Online Backup\Cloud.Backup.config" /grant *S-1-5-32-545:(RX)
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1616
- C:\Program Files\Online Backup\cbb.exe
  "C:\Program Files\Online Backup\cbb.exe" saveappdatafolder
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:256
- C:\Program Files\Online Backup\cbb.exe
  "C:\Program Files\Online Backup\cbb.exe" verifyFileSignature -f "C:\Users\Admin\AppData\Local\Temp\nouveauxconcepts-OnlineBackup_o_backup_v8.7.0.224_oid20bff54a-6808-465b-a3d6-c9f1e6532237_bidnhR8OaZBA0yWdfWi1gv!qg.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Program Files\Online Backup\cbb.exe
  "C:\Program Files\Online Backup\cbb.exe" oci -csid "" -dn ""
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Online Backup\Cloud.Backup.Scheduler.exe"
  2⤵
  PID:3264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /i "C:\Program Files\Online Backup\Cloud.Backup.Scheduler.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /u "C:\Program Files\Online Backup\Cloud.Backup.RM.Service.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /i "C:\Program Files\Online Backup\Cloud.Backup.RM.Service.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Program Files\Online Backup\Online Backup.exe
  "C:\Program Files\Online Backup\Online Backup.exe" /createeventsource
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SysWOW64\CMD.EXE
  "C:\Windows\system32\CMD.EXE" /C ren "C:\Program Files\Online Backup\install.log" "install_8.7.0.224_20260723150805.log"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3376

C:\Program Files\Online Backup\Cloud.Backup.Scheduler.exe
"C:\Program Files\Online Backup\Cloud.Backup.Scheduler.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Program Files\Online Backup\Cloud.Backup.RM.Service.exe
"C:\Program Files\Online Backup\Cloud.Backup.RM.Service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cloud.AzureClient.dll

Path C:\Program Files\Online Backup\Cloud.AzureClient.dll
Size 352KB
SHA256 270423bbd4749f70b5dc7cb34d9b0844954b4fa429dada7c20e53741c090364c
MD5 e3b53b7dce433ce512ec6db0ce28a337
SHA1 6a162429db6a101ea6b743e24a31a747ca9090fa
SHA512 75505b10e61c0be5810fc5daa6d8d0f41bf2cf5b10ee32b583872398b579c80ed3b61cd59d21b316263fca961a09c7f4df6efec48bec1f328edbfef03cbf8cba
SSDEEP 6144:/KnRLGA76xxoDJ5zsJr2tOMLSVrv0OKTn/c8FbrEN13Wr2xarFZX:/cQToD/0a+Bv0OMHb6pxM
TLSH
T170745A015F70861ED7AFCAF89122055C62F04D0B676AF79A6AC17CE6DC8B7C6AC051E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Backup.DiskImage.dll

Path C:\Program Files\Online Backup\Cloud.Backup.DiskImage.dll
Size 1.7MB
SHA256 dd5dbf34a6fd6b19245c23a33e2b352f6cf145dc6f39ac094e10b441c18a5930
MD5 9dd9043b1d4e65c0ee84bf28fc62f152
SHA1 a12ec83caa890f5e3ba42dcf21a5e97eb7a0097f
SHA512 4e664cb8ba27efbde457cca0a2abbffdae723affacccb4f79163f6386baf36ecb495682fbb00b341ef403941f48dce16c9649444a88b76c4ec0b5cc1bd4b2d9e
SSDEEP 24576:IdUGtJxK/NQD8gjW0DeMNcEH55laFiUDS5z+LAhw2qvn081:1F4xWVzprW5CAhu
TLSH
T17F855B0163F4862BD56E5A78A432021623F1F46BAB73FB8BB65E69B91F53301CC11793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Backup.Engine.XmlSerializers.dll

Path C:\Program Files\Online Backup\Cloud.Backup.Engine.XmlSerializers.dll
Size 4.9MB
SHA256 7a5130ffc0727c6eb62e490020c3bd1a07e9e76d7867ebd90e22d6ee324d186d
MD5 b7c9fc943e6db802ce7688e49f9d812e
SHA1 96338ac89bde4a8545e7d5b89ca9222f31902da2
SHA512 776eac42ba393759746a817e279ac519134beab8b40db287ded9214803d798ae02b3d794ae86f4c6b077a53873f6e4823bd28f723bde918ee46aec02158a48e2
SSDEEP 49152:NCJqPcW9ZORJWCAMpt31SIU2VCP6G+yGSrobK+vXqk:MW9ZcJWCAu1SIdVCP6G+y
TLSH
T17C36411673E44F09EAFF6265ADB445F5C736BCA305C8F2AD1498802B25E430CA9786F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Backup.Engine.dll

Path C:\Program Files\Online Backup\Cloud.Backup.Engine.dll
Size 5.5MB
SHA256 2f1fcca6f878f06130c505c18c45eefcbb6846147451c4151d10201e054881ef
MD5 4dba56ec275e32bdc2e078fa3591649c
SHA1 7f39dda0e3003f949d8a8d957d38b3f27dda7da6
SHA512 513704c4e55a4d658ea1d0e9422dd0a92caee41cc3e9d0982bb814f722f6f24d71b51aa754501a870dfdc08105304f91fb936df59125228d5e1692cd09f1ee91
SSDEEP 49152:gUaFa+suCQNH9G94JIHPmJnY/iZLEjWJiG0M3ePIFyMWnFxMuWA2PdQC8AbUpRTv:gUaILzPnMe2bvudd
TLSH
T133464A00D7F4C6AAD2BE49749472051406F1E80A1B73FB1F72EE5C692643B096EE5BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Backup.RM.Service.InstallLog

Path C:\Program Files\Online Backup\Cloud.Backup.RM.Service.InstallLog
Size 292B
SHA256 6595bf96d72d48af03738a09ff657854746bd11bdd417c35b15c911a1a8fe04d
MD5 cbebea5294261fde3e53221e0ba36e28
SHA1 a5857b5daaf9b50fbfed26871fe4bf83d3725fcd
SHA512 d21baa1b696490fa814988078f5d3b6fc4fab54b064d484e4794518051cfb2bfd61aa6e76bd2217427961385ee9c8a99e0036948b47975374fdef541605e7845
TLSH
T1F9E0860AC986C2F136243BD55B871510D18B180515381117A7BF134672E372CA07C3E1
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.RM.Service.InstallLog

Path C:\Program Files\Online Backup\Cloud.Backup.RM.Service.InstallLog
Size 1KB
SHA256 fb48b1d6a63e95bde2a7138c771b1ccfb9fb2aa19f3094e11a57f037b6163e7c
MD5 b7e7305e4fd382be80e8fff35f8614cc
SHA1 0ee9ee3ac6cb7ffa04d1c32a1852583169b007bf
SHA512 20043f95cbb945a2ada00d5c53ab81e1da27b79d73c77d3a9d5b722c6e509f95a9527c1acb999dfb4906133058c387f7874b53fba37b8b5eefcdb7807b7d3762
TLSH
T1F4218E0AC68582F13E552AD75B4B6150A28B040512392613E7FF538933E3A3DD2792D1
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.RM.Service.InstallLog

Path C:\Program Files\Online Backup\Cloud.Backup.RM.Service.InstallLog
Size 1KB
SHA256 3360b0f9933cd58e7a256de4e1e79d735b04e2af7b1cdd9a9b844baa787ec564
MD5 29e46908c40df8b4eaf0532ef808e406
SHA1 6313761401c1424f9bc293485c4dd7eadd9e9efd
SHA512 ff78ede25815571e511bea92425c8758f40499bfdb665e7518f969c078e8a9c2b5c07042813cc16ea9c8b65dff4eb6a32bb5ba0c4d7d4741dc6656b0f7c018d2
TLSH
T1F5319E0EC68582F13A653ED71B8B6160A28B040512392513E7FF539937E3B2DE2782D1
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.RM.Service.exe

Path C:\Program Files\Online Backup\Cloud.Backup.RM.Service.exe
Size 110KB
SHA256 860752b7dfae905065b986daf00ae716ad7e001f781f46db4a2786e45eb63456
MD5 f3e40faebf8cc5628156ba28a0dcfa4a
SHA1 bc4db83b6e6ca67b5651580d71ad046d3cdac10d
SHA512 d1800d1e8562dbd3131b3fa54a774fe530689858916ec97b374a634ea31697f0a5943522bf25d15ad0038d7a56f04177c65a6f0976f29fb61516496d40ee5387
SSDEEP 1536:9csrQNNJ0kcLfQPzcWpV1N9pr0k3JgZICMuKC5Al+z8sju70B:9JQ/U4QWr1N9nZMRMRC6udjuYB
TLSH
T115B3DB3A6326F450CF2DCD388513928AA5F20D6B6931E2B77A560FC40B217CE79ED1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Backup.Scheduler.InstallLog

Path C:\Program Files\Online Backup\Cloud.Backup.Scheduler.InstallLog
Size 289B
SHA256 c852c7f809d25a328f43635a5806495f02cda12e04b41d6391a7063c6b685e26
MD5 2aa622e9279bceee1bca00e63b8f0472
SHA1 4f9f38dd6ce21ff4c99c0e91144dcc14480387fb
SHA512 9e2ab907ec76871812b4d99d26bbbd38ba2d2d242e6f1f0bb504e54976995b12565be055062167c8caac270a0e329b9108a578fe6ff85e2d6bf62d6dc110087c
TLSH
T117D0CD5E894BC2717F643EA5D7465590E54F080115340217BBBF6346756332CE1783E0
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.Scheduler.InstallLog

Path C:\Program Files\Online Backup\Cloud.Backup.Scheduler.InstallLog
Size 1KB
SHA256 1b0dcc52a29bde1b69c205be065f5aeea6cd816daef47905ed1153ab667df0dc
MD5 361b0ce4dcb82e7e7311d4e3c94d43e0
SHA1 bb675b04d1df2b267aeba3bfc943933aab3bf109
SHA512 71c02d78136d33eea939eef547745e56d8f67c5f0ff49a6f2f0e53f990f5cc296ae95ab91cf97ee154c50fa31145b2aa336534238770889f782aef695a79d2d2
TLSH
T1A021AB5E8A8683B17F912E9A974BA190B28A040115351717EBFFA38932E373CE3753D1
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.Scheduler.InstallLog

Path C:\Program Files\Online Backup\Cloud.Backup.Scheduler.InstallLog
Size 1KB
SHA256 38a83f0a5fa6c2f058ecf2132d47e8408745b4bdc2e9e1d20908a04bac6d98c8
MD5 253f294deee64425261943807bf20b4e
SHA1 f5eb49e3e8aabe42dc1d3514d9c0628f92dbcfab
SHA512 4334fb72a7444d870744cdf51c3e702a30edf6557b8a845df99378298c1505c5c84790d39764ed5b1d0425eef49a453d5a1c1b640d19f3332a0ba484ce2bc29e
TLSH
T1C331AE5F8A8682F17FA12E96DB4BA090B24B040115351617EBFFA38936E373CE2743D1
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.Scheduler.exe

Path C:\Program Files\Online Backup\Cloud.Backup.Scheduler.exe
Size 149KB
SHA256 1e08d6cb508f634e61f2318b145959c7b06fa4aa24876fce28b416791de45050
MD5 45dc8717f4223b7f4a6487b67f7d5ee9
SHA1 71051e029a069baba3fabd95a39bcedebc629f4d
SHA512 ece8630ded8ed9b44bf593395441c34c053da97d2855f25db32874ae7add0cba2567f696beaeff4224af6bbf287f17e10e57980fb2f85483934755768abad520
SSDEEP 3072:qbyXv0TUKjxFMiuKB4Tf66U/l7OJSk/cs80KfFJOGJ9pOJK:5XvKJaiU66U9qJSk/U0K
TLSH
T1E4E34B5113E5C53DE7AF48B8EA7200016BB16D07D570F75A3AE964F91803386BB2A3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Backup.Scheduler.exe.config

Path C:\Program Files\Online Backup\Cloud.Backup.Scheduler.exe.config
Size 3KB
SHA256 e5f016e12857eb8b77e7ca764308e582c0814a5be8b034ebfe627beb8a85f87f
MD5 1007a7d2c6c5fd604b36d28c3cd83df8
SHA1 bfcca6435afceb9aeb929d74e04a4afde5e0188a
SHA512 44ee0eb42b75a227779a2c5e28afcd2ce39f5a9b651678a1e726154f154a17c3d0b6fd154547d32d36fede0048d16f9451ec17a1ccdc640ae63738d7f37bc546
TLSH
T16E511A1165C8BBE50B7209A23E6F6818CB7D03B72D4C064EB1DE6B878F3A95A4707177
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.VM.dll

Path C:\Program Files\Online Backup\Cloud.Backup.VM.dll
Size 430KB
SHA256 b90ffc88054fd8fd0e72c4b85c826d5958b64df82018d6b8f8f6514cb52711ba
MD5 2124ac82366ad57eea2ecb3d8b33e4e2
SHA1 79f09de9c669b7fc82a86122d0b1a9a36049f72c
SHA512 0e7ff2c8fc7f43a7608b9296b1871035f61141a5d3f083499ec04bfac2df0cf6ccaade9516f5fc2a03a7d96bf9164f261eba11b12c508c84d31c6ec7dd6600dc
SSDEEP 6144:zF5AKZUA1gQjekjRN/tqeiWaU5AHr/S3kfXS+Tno31orPXveIe:zF9ZEqekRN1qLG5AHV/S+031f
TLSH
T13B945D6267B88621CBAD87B850130C1493F51C6B836EF7CB99875DEC6F4634E66870E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Backup.config

Path C:\Program Files\Online Backup\Cloud.Backup.config
Size 114B
SHA256 129fded0d769e661f3d87c77dbbd625316373b1af335a08a6eec1f33844d9149
MD5 0ef17dd2f7ae701d56cd2f25f1e639d6
SHA1 24c368feb9268f97da62cf6df6b61dc0bc620a16
SHA512 9df00be6512c7dffba0abc171b4f1d57b04aa8f7e30b487771809e51f869912da8aaf08abdea16e1b998bd883d363fadbb016af0c1cca7f9f01a16e07e1303e7
TLSH
T1D1B0928F224CA93A3BA83BE89724228949064218C4B08D4F3F273462384928614AA8CA
MD5 SHA1 SHA512 TLSH

Submit Download

Cloud.Backup.dll

Path C:\Program Files\Online Backup\Cloud.Backup.dll
Size 311KB
SHA256 923169932e79848bac79be60e8a1866d95441904991d9b5b68328663f430644a
MD5 da61147e0146a6c18a6377ab8190a243
SHA1 fc3c3b48960cdcd23d333fcc86f96f5606280467
SHA512 baaa33daa5470889263908f06b9483a3f5901c6703e62f64082b2cc4a55dba16f9937cbe13d87e8b5fca70a9955c5d0ca79b7dc138b5b952752031f66a81ccca
SSDEEP 6144:b+dNx5wFIEVSSd/+nOkm9HcVizW5t+XUe7h1pB+KPxjAKEjt:b+fxiFjbJ+nRszW5wUe7h1pB+X
TLSH
T1E0640241B7E0911CF52F0FB66D3215B08B3B7B525B21EAAF31C5328D29B6295CB24727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Base.dll

Path C:\Program Files\Online Backup\Cloud.Base.dll
Size 1.4MB
SHA256 24884998757bcffb10e54e5d65877c7c53ad9ba935fb670fdacdc60b4ba8afd8
MD5 0cdecba224a54ef5a9c8c8200505a24d
SHA1 ef6b41e28511111cf7a1921b719ff10c4155d78d
SHA512 14c667322c077421b5dc460392945a1a6d682cf7eefa6927d6dd54ddf213f3326a8dccea72caf53865cca0066ec710061867857084ff7db84bd71a75bee33802
SSDEEP 24576:AGZmJ7+/GrkjZAWRm96sXIuxWiwPPlRVACDhkSfXNCi/:2+V05ERatSfX
TLSH
T1A2654915B7E2D716C26DD5B8B632412403F8E9095376F35F6B69A038388273A7C896F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.CbfsInterface.dll

Path C:\Program Files\Online Backup\Cloud.CbfsInterface.dll
Size 63KB
SHA256 2dfc0f6b8cd2f9c7d2b985e9bf67655aa8943433c1c91e857946cdbb8908b09a
MD5 52715081aa71b1ca7d21a3dc3e2fb748
SHA1 47d9f5abdb79b36f9fa947487a1e472def0552a8
SHA512 c146aec51c5fbf2f8f41688260e812e8c2cf43c1c5386a67768ee94db835a6c291c60d8d9f8df44af9c381fb252046af475845afda9d499d1be93a7fc586c89f
SSDEEP 768:kh7b6ToCTZAqXQBg9/flIgiP4uhC/uHSICvdGN6nWByyyohxQpbzDEpYcsRreRVg:s+TNlAqmg9/9jiP4cCT7WByac+BRV07
TLSH
T1AB534B7817EC8A92C2FE2775B977071243B1F29D1613E72E6C95A65FAE027004A137F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.Client.dll

Path C:\Program Files\Online Backup\Cloud.Client.dll
Size 1.1MB
SHA256 db268d019e1a2e5e06ecd8a7187037cd509683ef9c67a6abd98d3069264b6487
MD5 105fd4bc38d5748ee03bcf83e772da5e
SHA1 f76d17221d8581f458ab4951658ecff711dfbb42
SHA512 7967487e74b2a0740fe5bbb00dc4b87dd14d54343f38066344167221e3214158603f2bafb4db06cf25ae742488c195dbcdb44c4849f333e0e06aa22ea82bdd66
SSDEEP 24576:Cm4hRbUKb/JVMqAI5OD5QZjFOnqOgqYYoW:CVhvJVDkN
TLSH
T1B3353946A7E4D72BC95E8478B131062803F5C45973E7F3AB6B506560BC8730EBCDA2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cloud.S3Client.dll

Path C:\Program Files\Online Backup\Cloud.S3Client.dll
Size 1.1MB
SHA256 a436bee912ddec33da776a1fb959e27548d07bd555947e3fea38ba705212f6fd
MD5 f643f207017111ba5a7904373bff8426
SHA1 6731b1ba9abb992e0cdbb709ecac951f7db227b3
SHA512 6b9b8aef13c931cbdee2e21d9095d963c632acb8b8d3c77bbb1da632f95f6f5d3d99bcb0ee03000e9a09ff7e47082f49c402af8085c67e5db1408dec5a9d60d4
SSDEEP 12288:exwG2mF0Rk4981hs/EklRxjn11fku/sk6zsZzWuY4J08Dcvzyn/MwzV:RG2o0nrpRVn1muEk6z1uYOPYynEwzV
TLSH
T1A3353A2367A4D337D2FE557CA032512C43F19C08A2EDF3566B61AB785C8B7064E9B1E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapper.StrongName.dll

Path C:\Program Files\Online Backup\Dapper.StrongName.dll
Size 171KB
SHA256 8d72a8d7c13d5cd37fc4daf52c78f09d8199d72e3f3b4298c72c121b65ee6583
MD5 e1a11d2eb998eeef9d91055ffbea0132
SHA1 a8fa26d510b75436079e7ffbdfe705367c01c1c0
SHA512 a8bc95228c51f5835185ece4037b4807595641caa84bfb70d26007c2993f2c59f3d811f0c71b490309550e2a4e735cb12b6e1a2c2bdb3c7d58faf2a3952e364d
SSDEEP 3072:v6ZWd9g9mMzpGapZeEvizRYe2vDzZMCsdvqL+YS0YmIyb+g:yZWdHap1izRYe4sL4Pb+
TLSH
T1F9046C15639D8BA2CBEF0BBA7475800043B2A6A7F5D7F78E69DC91E568537801B003E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiskAccessLibrary.dll

Path C:\Program Files\Online Backup\DiskAccessLibrary.dll
Size 273KB
SHA256 13a3ba8d52fb800f1a0f4f371ad994b9070966596355272fe1f5164cc55a0063
MD5 6636dbc983bd69d7ad1c23f4a6fdd6f5
SHA1 23551ced0c07e4d75c770719c3c31969d029df4c
SHA512 647e1bf899f67ffbf78ed78352d7b6b199cd5f22e36c9002a37d24887815806d768ba04707e8f6d5cac5bb8a330c593d69b61d51b586ab3df56f8f9bf891f747
SSDEEP 6144:NWicmkog6d8D+odR6HcFxMVaFTXB8IiH7LE85MmnF:NxFkoOfB8h
TLSH
T19E543A2857E98921F8EF57BEE4B6044587B4F016DA2BE75E1BD424FB2D63364C8007A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallUtil.InstallLog

Path C:\Program Files\Online Backup\InstallUtil.InstallLog
Size 580B
SHA256 3537f8221dc07cd1977e4d9504bd912028d5e31ac3df4a50692d692144d457c4
MD5 7f09f58ab7c96e9673f87077749c3b58
SHA1 648d9b058736f462429012ef20a6d3488fa09207
SHA512 93d9c3da013c5f247ce172bdf505852e1b547b8744ba1f9b5bf7bb5ccf042ca172855f76806961a26ee5b94ee4bb284f45da9877a03df40dcd327f428568e0f3
TLSH
T1F7F0F9AD4D868372BA443EA9C70FA0D0A60E8508113B53175FAF638D625273C71F53D5
MD5 SHA1 SHA512 TLSH

Submit Download

InstallUtil.InstallLog

Path C:\Program Files\Online Backup\InstallUtil.InstallLog
Size 1KB
SHA256 f67cdc7e001ec562c406ffb0be241f0c2fcefb587d3ece10244a0ee418c97c29
MD5 03d7c527b0b7625d3218b8d24e8f2eaf
SHA1 8c5771fad62894bb5b95e372d75a0c74ed147138
SHA512 5a4e223a5fa870be351e852c4742bcf87137c143fffffa4f023873f39c1966a851c14e80026fce9a9270ac337b63e82335c4766fc9551510c32aa38d8866115f
TLSH
T1BC2149594E8683B376443EE8C74FE080624E8408013B53276FAF638D635673C74E93D5
MD5 SHA1 SHA512 TLSH

Submit Download

InstallUtil.InstallLog

Path C:\Program Files\Online Backup\InstallUtil.InstallLog
Size 1KB
SHA256 90c32ce4f38fec3364af031cdfd777ade310bbc2494b7c5f0b09ce399d834932
MD5 b603ff3058475d7aeba6e103efe131dc
SHA1 a5f2e80cfff398071b037490ee05ef75c7bb586a
SHA512 e9433d924c64b254925071d94364eae8f3f52868e3198bf8b4b6865a039b0f82b9df2c0e8ba67ef5d151b9043e836075a1422644ae5b09340a59c247e5849553
TLSH
T11D4129598E8683B336043EE8CB4FA180524F8409013B63276FAF238D6396B7C74F92D5
MD5 SHA1 SHA512 TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files\Online Backup\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Online Backup.exe

Path C:\Program Files\Online Backup\Online Backup.exe
Size 2.6MB
SHA256 8a59f5b20108c400bc0016b4f06c961d97d5cf84d9a190e0cfdf74fa72ed7a7e
MD5 98545603be42e1e31bef5f85b394cee6
SHA1 aacb2066322581a4efc48db1c3bc8ac1af4fb147
SHA512 2e66c937023bc46898d8db12fddb095a9b70ce96659a25357f985e6852191fd368a95e5b9f85346231f703d106daf3d8cff55ed98b22afa26ea734e3383fd0bc
SSDEEP 49152:byq5jMan3urQLgwxjwwH+wiQYp+hPqlpZwTiqSOM0:WWjMa+2gWKt9CPyZfROM0
TLSH
T18CC5BE973F41D13DF4B7E5712A88619027933C6A9767641826E2FC8E85F1BC20ECF626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbb.exe

Path C:\Program Files\Online Backup\cbb.exe
Size 657KB
SHA256 7dd046890d9b95648f3028138b3c424cf2510e8c9dae14ebb41d440dc234acb0
MD5 4ad487a9ea018b6537e41ecc8e68f6ef
SHA1 bb5d4c88b25102d91148521ee39934d1982dc388
SHA512 af24c108461ec5646c120d9ad1bea6478ffc910d7901d9efa3dcc1611f6bb4a7acaac620a6f38b11f85e88c06b4ffab54babcd55e2ed2bd134fdf70d2f6a19c2
SSDEEP 12288:0jSREO3EwrVulUfpH1W/N8hfwvfjcJUBDHa:aQfV1Sfjha
TLSH
T1DCE4F9633BF5E999D66F4A3810364E3456F85C1F13B4E24EEF8229E6C441B4EA9492C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbb.exe.config

Path C:\Program Files\Online Backup\cbb.exe.config
Size 2KB
SHA256 da61d5cbb0f0e79551aedb65b340966e6ccd23e5b6aca25dbf9b14cbe91e70f1
MD5 cdfb959fbeb757092c0900ca60720367
SHA1 6f7afebe4e00dca5d6d267aa20f75e66ef310f58
SHA512 9d215f1cbee635dda3ac44d882cfb5887201ef059d0bb51008cf2a19b0222826bcde9851d3292417bc69d352d852adb840cfa33db274bf2d1b6cf67cbbebbbec
TLSH
T1A051091165C8AFA40B7209A23E6F6818CB6D03B72D4C064EB1DEAB878F35A5A4607077
MD5 SHA1 SHA512 TLSH

Submit Download

Task Scheduler.log

Path C:\ProgramData\Online Backup\Logs\Task Scheduler.log
Size 746B
SHA256 2bc67ba001296aa23962e7aedd38b17e2996901283b68e2cbae007ff4a6a12d2
MD5 7d7b2427cfed74a1f7e2e0bd01158b4d
SHA1 bef5e5f168ee6f1cca5f424537efaa4088c0b430
SHA512 bf967b94dd5fcb3054fd40216988b9f362ed7e1d89015a079fa0f7ce1887eba131696c68eaa2ccd70a62528b99f065b5d9c6f1979fdeaf8528209ae3a76e3c84
TLSH
T12301262B06A16D631067B821E4260FDBE213A40F549BB61862F83340528D4CBEEBCD9C
MD5 SHA1 SHA512 TLSH

Submit Download

cbb.log

Path C:\ProgramData\Online Backup\Logs\cbb.log
Size 540B
SHA256 0addb46d42d844a4d92e1e16af0fc87cd6736f7d1b7ba789807186ce38d44064
MD5 3b9fe16a4d548a0ed85a755d7161cb69
SHA1 a7fb7840a10aa21cfacfb06cd8c4a49e15195194
SHA512 a30c089d79c7903f8f8254393344e08cf5260047ddadeb695dea336f2e83c860c80e0623240c70ff51006eeb68f58459cc8319dfa568757060c0630f62b0ad89
TLSH
T14BF05C2703A12C9190B53F50B0270FDDC153B06D60ADB11D66693350528D4C3EFBD654
MD5 SHA1 SHA512 TLSH

Submit Download

cbb.log

Path C:\ProgramData\Online Backup\Logs\cbb.log
Size 1KB
SHA256 0a9172e33649c07eb8e3c5b05169e76e5f4468b698dd1cea0a0ffe6c8893d83c
MD5 e3beff239c0b5884f19c93e0b9471a21
SHA1 0ddc2a1f721fa64877e3cc6fc385276436cd34c2
SHA512 b6622f403732d610c6c1f08f7780d8e7b99ce4260817a3ce669ed878cdf3514f3a4813b415809fb825eddc0508c46a165f28b7802d8ea7616f4804b6c975831f
TLSH
T1E7219A2703A52C91A4B93F61B0170BDDC253A06D60FE721DA7683244524D587EFB9B64
MD5 SHA1 SHA512 TLSH

Submit Download

console.log

Path C:\ProgramData\Online Backup\Logs\console.log
Size 462B
SHA256 844be4393366d3ec4673e52cac4e9e99e648dd29bdf25a814abfc8f9447f9342
MD5 644f78d4579f7641355e7822712680e8
SHA1 1acee1ad2ce45cf485e3abb9474f823741d185e6
SHA512 385eea008445a9c3b2418374300c7ec0453319b236f88810b24252329972372e4852ecb4d88c5d8784b2a8487c0d4fa7f08f6773a91134e6b8e8b0a6ac285b9b
TLSH
T1E7F061290B611C519174BD02A0060BD99103E04558A5731C55F93384428D18AFFF6E55
MD5 SHA1 SHA512 TLSH

Submit Download

rmservice.log

Path C:\ProgramData\Online Backup\Logs\rmservice.log
Size 684B
SHA256 f2b2a9ccb3c6bd35a0a61f2b9d89fc337fd1190cc14c53e9180c529ed6c43d33
MD5 40ac9af1730a63258ec4a6f3bafa889e
SHA1 2ee7a0aea631a4ed79bec3d66d6aa1825854f9ce
SHA512 86986562648e0d40a3c5bfe085432c8f8b2a0d422b91af57ff40a7afc449ea47e395f771ea66cff86f476428097f66778ca31132db860461bb64a89c9139f44c
TLSH
T19001A21756E11E71519A3491A4490FDFC757F099A05CB66421D83BC0924C586DDBCF68
MD5 SHA1 SHA512 TLSH

Submit Download

rmservice.log

Path C:\ProgramData\Online Backup\Logs\rmservice.log
Size 614B
SHA256 71cd0893677916427520fa078c6060d5303644b156f61c66d94a7fce0328f244
MD5 0e557dd6e438bfe8aeaa0740b29df75c
SHA1 cd339635b114caa4e9bb86d02fb2ef2c840c3c78
SHA512 72850a4ae47c5894dfe76813498f8b5fbe4cb9453f83a98e51b524543371e2736ebde2ac1d6f44c00752c136fd4ff74ad9e08b3c34072159ab5612915d4b5182
TLSH
T134F0C02796E15E70909A34A1A8490FDF8757F098B09CFA2825D83BC0D14C985DDBCF68
MD5 SHA1 SHA512 TLSH

Submit Download

rmservice.log

Path C:\ProgramData\Online Backup\Logs\rmservice.log
Size 4KB
SHA256 6524b1f6d60b2db10de8b33982979a0d59b94ba6bfc51905df136372eee91b00
MD5 f00c6fe9b59e710b6df0fe9494aba77c
SHA1 f2e92f14d14847bc499aecff41eac5b5adc39d76
SHA512 91d3f21611ae24736b5be4f84ce06e1a1a453ce3cfbcc68287ead18fcae99d9824e1c3f60d3576d688031529e3c6459c9fc89c4a80f4553e412a5e58343732c5
SSDEEP 96:o8ZlAjRRZwJCWPUU5BAmpYQbbztxEQ9k9xjvjr:nlqZczPU2BAmpYQbbztbUN
TLSH
T1B6A11D2A4BA11C32A6A57191A8076FCDFB67B05A70A8770471DC37C0830D68BCDFDE99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbbackup.db

Path C:\ProgramData\Online Backup\data\cbbackup.db
Size 520KB
SHA256 ff4390ad221d1d2d6310a3710119defd75e2ff706fb874312e60a1e0f5cc4306
MD5 c406f6ab6bae4645d3ee959c7a83001a
SHA1 c60dd4853a6695d2b55a9ac9e1e308f16e2888fb
SHA512 ef6f1d28ab989c2c5f3d239e9d53e6ca0373d8e181990771ccf657937cd11ee60cc5928baeebdd23a90acc7fe2a3060dcb19e24609327d8d302efc97bf888357
SSDEEP 768:49Ed9kOa59Ed4kOIinq+EbAfbiHjvL9kJz20jQma8Gl54lQ0:a8eOo8DOXVmAf4jvLEjQmR
TLSH
T163B487466D789B72E0459673BA620A319B3C515F066312C03EFC90674FD2D8BE26F8BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Local\Temp\install.log
Size 15KB
SHA256 15ae4c3e3cd314edb0c9c9eaac04f502fdc59e5bd3551f3b354fe57a0847e91f
MD5 a4bb8f9c31b90d0f9c5988b3f8e67079
SHA1 6e47625c00573fb50ca15006fc0dbb406644b770
SHA512 47af3198be157784f21d1ec33388e2c7ea7351ba4a64d476fc2ecb4d89847730953773ac1a81d89763770035373ebb6661a3344b99a4b5db510b28100a597d8e
SSDEEP 384:SmshBhBLOLBhBhBLchBhlLBhBhBLgWIhBhkWgyCygyC1nohC0etRAOtVUfn50uE4:SIOtRftVU/50uaM
TLSH
T1DD728D2741878FA814E132E74CB3BF9C99AE4E1C5BD76E305264BC0B2E71E39A9F1511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\INetC.dll
Size 21KB
SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
TLSH
T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\InstallOptions.dll
Size 14KB
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\System.dll
Size 10KB
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\UAC.dll
Size 17KB
SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
MD5 88ad3fd90fc52ac3ee0441a38400a384
SHA1 08bc9e1f5951b54126b5c3c769e3eaed42f3d10b
SHA512 359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
SSDEEP 384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk
TLSH
T16F724B25ABA083FFC5500571A6E1672217FA98301979586F8E73EEC62FB59436C3E703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\ioSpecial.ini
Size 660B
SHA256 b257bc5b8878983fd6671e0f283a7c8f369a3a0189eff7da91cba03dd7debd5e
MD5 e2a77cde89362ec7d994f98e94fda538
SHA1 ec2fa02af22bff27ae754f6ffcc164ae6a3f80fb
SHA512 4e57be859ed5092b62ec9518a141915efd5b949b0e1682b4f3e29424dfb062ae318ea69ff69d5292d0ca7ce82990dbdbe560f29852a74ea8fe7bf12cf3e499f2
TLSH
T18501499C850E427A18245553A5FE3AE123D02C20875639B6F5628C82A78DDD5C9ED6C2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\ioSpecial.ini
Size 674B
SHA256 34b97ff9f1e6b386a36ce6191ffb26a3255b3c0d944c6a47098b27fb03d5b4c6
MD5 9be300f9146a91b0a78926a7d2452f61
SHA1 7cc03e695efc53d9944c80ea5b232d4ee0e89518
SHA512 80d855d903c97940d2ca4cead21a41a0ea1cc3e7afd0fce420463bd5b9cf110069a0c607394fe6a3cc2129b1db5cd293dfbdf511c1325c69f6dea3b51781c255
TLSH
T1E8019E5C810E027A1824449395FF7AE123D02C30871639B5F5228C83934DDD5C8ED6C2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\ioSpecial.ini
Size 683B
SHA256 e45d5d768690da35c3e370651aa0ec2843c85a2fd26b9f4eba05e420e7a25844
MD5 9da1e9bdb9fc4e56c8e70fcb3ef91298
SHA1 14e63f50602b743d4756cadfaad38ed586f6ed98
SHA512 512585de46488f2e5e293ba4e79ebefea205b0155ac69c1e632b8a0ee3788d15ce30fdc38af0c9cb61bfd532a649ab7953210cf45c474edc760ea168a3d73638
TLSH
T1D2019E5C810E027A1824459395FF7AE127D02D34871639B5F5628C83974EDD5D8ED6C2
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\modern-wizard.bmp
Size 150KB
SHA256 fbec5dfc6532218c49374ee1607058acd72c0c9d4418fe5e60f0b7935d0d6eab
MD5 98aca846c2f9d4569cf3746159cf881e
SHA1 d088cf3e48c53d61aa792e90387c9bc50a85ee11
SHA512 780e277ca2eb71aaf9b9928df7662510f60714291507335664cdfcb642ab096d479f7a5175256d91a3635011bceea11962a6a047aacfebade1281b1e578a9035
SSDEEP 3072:2uwfYJ0ZclxW7Tk6lIwllZsllllLtq95ucp/jkfWfW:2uwQJkccifWfW
TLSH
T122E3E51942511DC4D852A5EBBB2E2E8F3C88BF9C5139F6F98C26B72BD1390FB8579101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\nsArray.dll
Size 12KB
SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
MD5 0917ee492308b691326e6581e8c793c9
SHA1 ff689c8051ffca7657461ac828bc46e303ab8e59
SHA512 2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5
SSDEEP 192:L+QMtjhIz23Tv7QpAXXcxwtXexpnGOO81h2xXP:SQ6nDv70AXXcWtXexpnGIhW
TLSH
T1C642090A1F6082F5F8F201BA557A2B355A1D7E19971E1EEB07A314142E209C73F39BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\nsExec.dll
Size 6KB
SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
MD5 428c3a07fba184367a5085e46e4a790b
SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
TLSH
T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

processwork.dll

Path C:\Users\Admin\AppData\Local\Temp\nseDB87.tmp\processwork.dll
Size 231KB
SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
MD5 0a4fa7a9ba969a805eb0603c7cfe3378
SHA1 0f018a8d5b42c6ce8bf34b4a6422861c327af88c
SHA512 e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178
SSDEEP 3072:n/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzS:/94yj9c55CDorNqot43ndqQpzjIKW
TLSH
T1F2343B36E1C0CC76D5672B7CDC49E3D8556EBA302E2898866BE91E8C9B3D391351C287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-445-0x000000001B000000-0x000000001B164000-memory.dmp

Download

memory/256-451-0x000000001BC70000-0x000000001BE28000-memory.dmp

Download

memory/256-443-0x0000000000090000-0x0000000000138000-memory.dmp

Download

memory/256-447-0x000000001B6F0000-0x000000001BC70000-memory.dmp

Download

memory/256-449-0x000000001B2A0000-0x000000001B3C2000-memory.dmp

Download

memory/256-453-0x000000001B3D0000-0x000000001B4EE000-memory.dmp

Download

memory/256-455-0x00000000022E0000-0x0000000002334000-memory.dmp

Download

memory/256-457-0x000000001C320000-0x000000001C802000-memory.dmp

Download

memory/256-460-0x000000001BE30000-0x000000001BEE2000-memory.dmp

Download

memory/256-462-0x000000001B1D0000-0x000000001B22E000-memory.dmp

Download

memory/256-464-0x000000001BFF0000-0x000000001C062000-memory.dmp

Download

memory/2164-578-0x0000029570780000-0x00000295707BC000-memory.dmp

Download

memory/2164-577-0x0000029557DF0000-0x0000029557E02000-memory.dmp

Download

memory/2168-732-0x0000000000960000-0x0000000000BF2000-memory.dmp

Download

memory/2168-754-0x000000001BD50000-0x000000001BD66000-memory.dmp

Download

memory/2168-741-0x000000001D280000-0x000000001E168000-memory.dmp

Download

memory/2616-871-0x000000001D150000-0x000000001D1B6000-memory.dmp

Download

memory/2616-874-0x000000001CC80000-0x000000001CCA7000-memory.dmp

Download

memory/2616-655-0x0000000000B90000-0x0000000000BB0000-memory.dmp

Download

memory/2616-656-0x0000000001A90000-0x0000000001AFA000-memory.dmp

Download

memory/2616-873-0x000000001CCC0000-0x000000001CCFA000-memory.dmp

Download

memory/2616-869-0x000000001B720000-0x000000001B72C000-memory.dmp

Download

memory/2616-736-0x000000001AD10000-0x000000001AD52000-memory.dmp

Download

memory/2616-733-0x0000000001B10000-0x0000000001B1C000-memory.dmp

Download

memory/2616-872-0x000000001D5A0000-0x000000001D97A000-memory.dmp

Download

memory/2708-527-0x000000001B830000-0x000000001B87A000-memory.dmp

Download

memory/2708-529-0x000000001B8B0000-0x000000001B8E2000-memory.dmp

Download

memory/2708-530-0x000000001B7A0000-0x000000001B7C2000-memory.dmp

Download

memory/2708-525-0x000000001B460000-0x000000001B476000-memory.dmp

Download

memory/2984-164-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/2984-459-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/2984-156-0x00007FFB193CF000-0x00007FFB193D0000-memory.dmp

Download

memory/2984-157-0x0000023949530000-0x000002394953A000-memory.dmp

Download

memory/3264-540-0x00000226D0940000-0x00000226D0968000-memory.dmp

Download

memory/3444-592-0x00000000007E0000-0x0000000000808000-memory.dmp

Download

memory/3444-703-0x000000001AF90000-0x000000001AFEB000-memory.dmp

Download

memory/3444-668-0x000000001C7F0000-0x000000001C8FA000-memory.dmp

Download

memory/3840-620-0x000002683D010000-0x000002683D030000-memory.dmp

Download

memory/4716-47-0x0000000003450000-0x0000000003491000-memory.dmp

Download

memory/4720-165-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4720-166-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4720-485-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download