adbf44492073f7a77af23ec8422841a0ddfb640c7954f4622884cdbb3379efa2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
handybackup-764-x64.msi
Size 29.1MB
Sample260814-w25fdsbc66
SHA256 adbf44492073f7a77af23ec8422841a0ddfb640c7954f4622884cdbb3379efa2
MD5 38debe1529f4febf6890f8fc6bde2bb7
SHA1 3738910b3c56ebf9312c3b423e0c34d26ea899bc
SHA512 5cdb0ad47b9dd6488ea6f4d717605bb00bcf6b4d0d4fd78dd28af60862daadf5879d88db80988385ec4c815c2687f8efef5596a85aaf9278d459314bedf66f24
SSDEEP 786432:3wjdEyAHYw2/p/NqQ4tsn1ndERAllYp0:3wC4w+plqPsnfERAbYi
TLSH
T127673311B4508439D1711778964FD6604BBC5C388BF1940AEB6ABB4F2E7FB8692B3F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000024631-405.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	BackupClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	BackupServer.exe

Executes dropped EXE 6 IoCs

pid	Process
2712	BackupClient.exe
1788	BackupServer.exe
392	BackupNetworkCoordinator.exe
4320	BackupNotifyService.exe
4484	BackupWorkstation.exe
4940	BackupClient.exe

Loads dropped DLL 64 IoCs

pid	Process
3004	MsiExec.exe
3004	MsiExec.exe
3004	MsiExec.exe
3004	MsiExec.exe
3004	MsiExec.exe
4468	MsiExec.exe
4468	MsiExec.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
2712	BackupClient.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
1788	BackupServer.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe
392	BackupNetworkCoordinator.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Handy Backup 7 = "\"C:\\Program Files\\Novosoft\\Handy Backup 7\\BackupClient.exe\" -autorun"	msiexec.exe

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2380	msiexec.exe
13	2380	msiexec.exe
15	2380	msiexec.exe
17	2380	msiexec.exe
19	2380	msiexec.exe
21	2380	msiexec.exe
28	2380	msiexec.exe
36	2380	msiexec.exe
41	2380	msiexec.exe
42	2380	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msxml4r.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msxml4.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2712-434-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral1/files/0x0007000000024631-405.dat	upx
behavioral1/memory/2712-554-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral1/memory/4940-566-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral1/memory/4940-612-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral1/memory/2712-1137-0x0000000010000000-0x000000001025E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Yandex.Disk_eng.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\libpq.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\TAO_DynamicAny.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\LibrariesMS.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\Registry.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\MySQL_cze.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\TAO_PortableServer.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\msvcp100.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\Dutch.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Templates\Filters\blowfish.xsl	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\1C_cze.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\PostgreSQL_tur.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\svss_xp.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Amazon S3_cze.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Filters\cmd_cze.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\FTP_tur.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Multi-cloud_spa.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\res.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Filters\blowfish_cze.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\Italian.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Server\Spanish.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\TAO_CodecFactory.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Tips.txt	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\WebDAV_bra.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\UI\images\table-tasks-bg.png	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\UI\start-wizard.html	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\TAO_ETCL.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\ImagePlugin.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\MSSQL.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\backup.chm	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\French.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\FTP_eng.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\OnlineBackup.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\TAO_AnyTypeCode.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\WebDAV.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Filters\cmd_spa.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\DR\Brazilian.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\Korean.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\1C_eng.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Templates\Plugins\Online Backup.xsl	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\syslinux.exe	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Multi-cloud_fre.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\1C_tur.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Online Backup_arm.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\PostgreSQL_rus.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\DB2.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\Czech.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\libeay32.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\License.rtf	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\MySQL_bra.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\TAO_PI.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Filters\blowfish.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\xdelta3.0u.tar.gz	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\Filters\zip.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\DR\Turkish.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\UI\images\item.png	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\FTPS_bra.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\MySQL_tur.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\1C_bra.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Online Backup_spa.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\ws64\zlib1.dll	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\DEFAULT.CMZ	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Customizes\Russian.xml	msiexec.exe
File created	C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Yandex.Disk_fre.xml	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260814192814820.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ef8b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF9C.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814192814758.0\msxml4.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI127C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{83CBBF26-48C0-4FCF-B345-91CB1FA7EF2A}\Icon	msiexec.exe
File created	C:\Windows\Installer\e58ef8b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814192814758.0\msxml4.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814192814820.0\msxml4r.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814192814820.0\msxml4r.Manifest	msiexec.exe
File created	C:\Windows\Installer\{83CBBF26-48C0-4FCF-B345-91CB1FA7EF2A}\Icon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{83CBBF26-48C0-4FCF-B345-91CB1FA7EF2A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBF0.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814192814820.0\msxml4r.dll	msiexec.exe
File created	C:\Windows\Installer\e58ef8d.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260814192814758.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3120.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI385.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814192814758.0\msxml4.Manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE1.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2380	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupNetworkCoordinator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupNotifyService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1616	taskkill.exe
5032	taskkill.exe
3684	taskkill.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312057155069178"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\IndexFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00B7E0AB-817A-44AD-A04B-D1148D524136}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IndexFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\62FBBC380C84FCF43B5419BCF17AFEA2\WorkstationFeature = "\x06"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\SourceList\Media\2 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.DOMDocument.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.4.0\CLSID\ = "{88D969C1-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\Version\ = "4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.ServerXMLHTTP.4.0\CLSID\ = "{88D969C6-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.MXHTMLWriter.4.0\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XMLSchemaCache.4.0\CLSID\ = "{88D969C2-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\62FBBC380C84FCF43B5419BCF17AFEA2\SimpleFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\ProductName = "Handy Backup"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.DOMDocument.4.0\CLSID\ = "{88D969C0-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\Version\ = "4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\Version\ = "4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.MXNamespaceManager.4.0\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IndexFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\PackageCode = "945894C728211EC4C94DCDCF74FF4256"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.SAXXMLReader.4.0\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00B7E0AB-817A-44AD-A04B-D1148D524136}\ = "MX XML Reader 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hbi\ = "IndexFile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\Version\ = "4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.4.0\ = "Free Threaded XML DOM Document 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XMLHTTP.4.0\CLSID\ = "{88D969C5-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\ = "Server XML HTTP 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\ = "XML Schema Cache 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\ = "XSL Template 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IndexFile\DefaultIcon\ = "\"C:\\Program Files\\Novosoft\\Handy Backup 7\\BackupClient.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\62FBBC380C84FCF43B5419BCF17AFEA2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.DSOControl.4.0\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.ServerXMLHTTP.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\TypeLib\ = "{F5078F18-C551-11D3-89B9-0000F81FE221}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\ = "SAX XML Reader 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.XSLTemplate.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.SAXXMLReader.4.0\ = "SAX XML Reader 4.0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3004	MsiExec.exe
3004	MsiExec.exe
3004	MsiExec.exe
3004	MsiExec.exe
4572	msiexec.exe
4572	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2380	msiexec.exe
Token: SeSecurityPrivilege	4572	msiexec.exe
Token: SeCreateTokenPrivilege	2380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2380	msiexec.exe
Token: SeLockMemoryPrivilege	2380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2380	msiexec.exe
Token: SeMachineAccountPrivilege	2380	msiexec.exe
Token: SeTcbPrivilege	2380	msiexec.exe
Token: SeSecurityPrivilege	2380	msiexec.exe
Token: SeTakeOwnershipPrivilege	2380	msiexec.exe
Token: SeLoadDriverPrivilege	2380	msiexec.exe
Token: SeSystemProfilePrivilege	2380	msiexec.exe
Token: SeSystemtimePrivilege	2380	msiexec.exe
Token: SeProfSingleProcessPrivilege	2380	msiexec.exe
Token: SeIncBasePriorityPrivilege	2380	msiexec.exe
Token: SeCreatePagefilePrivilege	2380	msiexec.exe
Token: SeCreatePermanentPrivilege	2380	msiexec.exe
Token: SeBackupPrivilege	2380	msiexec.exe
Token: SeRestorePrivilege	2380	msiexec.exe
Token: SeShutdownPrivilege	2380	msiexec.exe
Token: SeDebugPrivilege	2380	msiexec.exe
Token: SeAuditPrivilege	2380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2380	msiexec.exe
Token: SeChangeNotifyPrivilege	2380	msiexec.exe
Token: SeRemoteShutdownPrivilege	2380	msiexec.exe
Token: SeUndockPrivilege	2380	msiexec.exe
Token: SeSyncAgentPrivilege	2380	msiexec.exe
Token: SeEnableDelegationPrivilege	2380	msiexec.exe
Token: SeManageVolumePrivilege	2380	msiexec.exe
Token: SeImpersonatePrivilege	2380	msiexec.exe
Token: SeCreateGlobalPrivilege	2380	msiexec.exe
Token: SeCreateTokenPrivilege	2380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2380	msiexec.exe
Token: SeLockMemoryPrivilege	2380	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2380	msiexec.exe
Token: SeMachineAccountPrivilege	2380	msiexec.exe
Token: SeTcbPrivilege	2380	msiexec.exe
Token: SeSecurityPrivilege	2380	msiexec.exe
Token: SeTakeOwnershipPrivilege	2380	msiexec.exe
Token: SeLoadDriverPrivilege	2380	msiexec.exe
Token: SeSystemProfilePrivilege	2380	msiexec.exe
Token: SeSystemtimePrivilege	2380	msiexec.exe
Token: SeProfSingleProcessPrivilege	2380	msiexec.exe
Token: SeIncBasePriorityPrivilege	2380	msiexec.exe
Token: SeCreatePagefilePrivilege	2380	msiexec.exe
Token: SeCreatePermanentPrivilege	2380	msiexec.exe
Token: SeBackupPrivilege	2380	msiexec.exe
Token: SeRestorePrivilege	2380	msiexec.exe
Token: SeShutdownPrivilege	2380	msiexec.exe
Token: SeDebugPrivilege	2380	msiexec.exe
Token: SeAuditPrivilege	2380	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2380	msiexec.exe
Token: SeChangeNotifyPrivilege	2380	msiexec.exe
Token: SeRemoteShutdownPrivilege	2380	msiexec.exe
Token: SeUndockPrivilege	2380	msiexec.exe
Token: SeSyncAgentPrivilege	2380	msiexec.exe
Token: SeEnableDelegationPrivilege	2380	msiexec.exe
Token: SeManageVolumePrivilege	2380	msiexec.exe
Token: SeImpersonatePrivilege	2380	msiexec.exe
Token: SeCreateGlobalPrivilege	2380	msiexec.exe
Token: SeCreateTokenPrivilege	2380	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2380	msiexec.exe
Token: SeLockMemoryPrivilege	2380	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2380	msiexec.exe
2380	msiexec.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2712	BackupClient.exe
4940	BackupClient.exe
4940	BackupClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1056	4572	msiexec.exe	90
PID 4572 wrote to memory of 3004	4572	msiexec.exe	98
PID 3004 wrote to memory of 1616	3004	MsiExec.exe	99
PID 3004 wrote to memory of 5032	3004	MsiExec.exe	101
PID 3004 wrote to memory of 3684	3004	MsiExec.exe	103
PID 4572 wrote to memory of 4468	4572	msiexec.exe	105
PID 2712 wrote to memory of 1788	2712	BackupClient.exe	109
PID 1788 wrote to memory of 392	1788	BackupServer.exe	112
PID 1788 wrote to memory of 4320	1788	BackupServer.exe	114
PID 1788 wrote to memory of 4484	1788	BackupServer.exe	116
PID 1056 wrote to memory of 4956	1056	MsiExec.exe	118
PID 1056 wrote to memory of 380	1056	MsiExec.exe	119
PID 4956 wrote to memory of 4788	4956	msedge.exe	120
PID 1056 wrote to memory of 4940	1056	MsiExec.exe	134
PID 4956 wrote to memory of 1876	4956	msedge.exe	123
PID 4956 wrote to memory of 2984	4956	msedge.exe	124
PID 4956 wrote to memory of 2984	4956	msedge.exe	124
PID 4956 wrote to memory of 2196	4956	msedge.exe	125
PID 4956 wrote to memory of 2196	4956	msedge.exe	125
PID 4956 wrote to memory of 2196	4956	msedge.exe	125
PID 4956 wrote to memory of 4024	4956	msedge.exe	126
PID 4956 wrote to memory of 4024	4956	msedge.exe	126
PID 4956 wrote to memory of 4024	4956	msedge.exe	126
PID 4956 wrote to memory of 2552	4956	msedge.exe	127
PID 4956 wrote to memory of 2552	4956	msedge.exe	127
PID 4956 wrote to memory of 2552	4956	msedge.exe	127
PID 4956 wrote to memory of 4344	4956	msedge.exe	128
PID 4956 wrote to memory of 4344	4956	msedge.exe	128
PID 4956 wrote to memory of 4344	4956	msedge.exe	128
PID 4956 wrote to memory of 2436	4956	msedge.exe	129
PID 4956 wrote to memory of 2436	4956	msedge.exe	129
PID 4956 wrote to memory of 2436	4956	msedge.exe	129
PID 4956 wrote to memory of 4468	4956	msedge.exe	132
PID 4956 wrote to memory of 4468	4956	msedge.exe	132
PID 4956 wrote to memory of 3360	4956	msedge.exe	133
PID 4956 wrote to memory of 3360	4956	msedge.exe	133
PID 4956 wrote to memory of 4940	4956	msedge.exe	134
PID 4956 wrote to memory of 4940	4956	msedge.exe	134
PID 4956 wrote to memory of 4940	4956	msedge.exe	134
PID 4956 wrote to memory of 3144	4956	msedge.exe	135
PID 4956 wrote to memory of 3144	4956	msedge.exe	135
PID 4956 wrote to memory of 3144	4956	msedge.exe	135
PID 4956 wrote to memory of 5324	4956	msedge.exe	136
PID 4956 wrote to memory of 5332	4956	msedge.exe	137
PID 4956 wrote to memory of 5324	4956	msedge.exe	136
PID 4956 wrote to memory of 5332	4956	msedge.exe	137
PID 4956 wrote to memory of 5592	4956	msedge.exe	138
PID 4956 wrote to memory of 5592	4956	msedge.exe	138
PID 4956 wrote to memory of 5592	4956	msedge.exe	138
PID 4956 wrote to memory of 5912	4956	msedge.exe	140
PID 4956 wrote to memory of 5176	4956	msedge.exe	141
PID 4956 wrote to memory of 5176	4956	msedge.exe	141
PID 4956 wrote to memory of 5520	4956	msedge.exe	142
PID 4956 wrote to memory of 5520	4956	msedge.exe	142
PID 4956 wrote to memory of 5744	4956	msedge.exe	144
PID 4956 wrote to memory of 5736	4956	msedge.exe	143
PID 4956 wrote to memory of 5744	4956	msedge.exe	144
PID 4956 wrote to memory of 5736	4956	msedge.exe	143
PID 4956 wrote to memory of 5588	4956	msedge.exe	145
PID 4956 wrote to memory of 5588	4956	msedge.exe	145
PID 4956 wrote to memory of 624	4956	msedge.exe	146
PID 4956 wrote to memory of 5488	4956	msedge.exe	147
PID 4956 wrote to memory of 5052	4956	msedge.exe	148
PID 4956 wrote to memory of 5564	4956	msedge.exe	149

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\handybackup-764-x64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2380

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9807676F787A03574EA90A58606C1DCA C
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.handybackup.net/install/index.7.6.novosoft.php?v=7.6.4&os=&dtr=0&lang=English&build=simple&setup=handybackup-764-x64.msi&platform=x64&upgrade=false
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffc2bbfc188,0x7ffc2bbfc194,0x7ffc2bbfc1a0
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,4395459329581038957,9310323853985148853,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
      4⤵
      System Time Discovery
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,5491506465516690883,5098548146740519095,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,7228598281429616025,14193634179885543450,262144 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,2094656762425407443,10892804176749091704,2097152 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,12983090434508721358,10088878884622568351,2097152 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4705099561145817455,8547050933389827155,2097152 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,1723505895018006858,11182031326457065005,2097152 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,6436482771775294742,8877747938640479349,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,13919230851572857547,9366041183797517722,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5396,i,7985649664830942410,4689635092854579226,2097152 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5548,i,16754877000203258804,11851907973218693384,2097152 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,6439496892304744241,14428106203724110047,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,6006820218840941140,6231478381764341570,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4964,i,14986398892675289004,15522133125406596925,2097152 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4319374478148435113,10441537050890549138,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4319374478148435113,10441537050890549138,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4085286108551397847,8746913952166245177,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,6685575382651843448,17134034269281930472,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,1249088667146173874,867744370793092375,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,3055813260470991227,11612492650387763696,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,17096850413100506591,2847089229712232596,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,1839508086479863926,18232086923529617040,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,7676423025750102044,11321731644950824225,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,5676087194954763123,9287494724901794584,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,4953656050338213387,9505315689683688710,524288 --field-trial-handle=2208,i,8880855914443831068,12105592202600078508,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:5564
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Novosoft\Handy Backup 7\readme.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:380
- - C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe
    "C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F676A656384AEB348B8FC138D1849F74
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupWorkstation.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupServer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupClient.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0BE252BFBE28663B05613487DE1068BD E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4468

C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe
"C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe" -autorun
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files\Novosoft\Handy Backup 7\BackupServer.exe
  "C:\Program Files\Novosoft\Handy Backup 7\BackupServer.exe" -n --ListenEndpointHost localhost --HostNameInIOR localhost --CoordinatorHost localhost --CoordinatorPort 1755 --StartWorkstation --ReadyEvent ee501aa4-980d-11f1-8000-000000000000
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe
    "C:\Program Files\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe" -n --ListenEndpointHost localhost --ListenEndpointPort 1755 --ReadyEvent eeb8a66e-980d-11f1-8000-000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:392
- - C:\Program Files\Novosoft\Handy Backup 7\BackupNotifyService.exe
    "C:\Program Files\Novosoft\Handy Backup 7\BackupNotifyService.exe" -n --CoordinatorHost "localhost" --CoordinatorPort "1755" --ListenEndpointHost "localhost" --HostNameInIOR "localhost" --ReadyEvent eeb8a66e-980d-11f1-8000-000000000000
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4320
- - C:\Program Files\Novosoft\Handy Backup 7\ws64\BackupWorkstation.exe
    "C:\Program Files\Novosoft\Handy Backup 7\ws64\BackupWorkstation.exe" -n --CoordinatorHost "localhost" --CoordinatorPort "1755" --HostNameInIOR "localhost" --ReadyEvent eeb8a66e-980d-11f1-8000-000000000000 --ShutdownEvent eeb8a66e-980d-11f1-8001-000000000000
    3⤵
    - Executes dropped EXE
    PID:4484

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{4E14FBA2-2E22-11D1-9964-00C04FBBB345}
1⤵
- System Location Discovery: System Language Discovery
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ef8c.rbs

Path C:\Config.Msi\e58ef8c.rbs
Size 174KB
SHA256 344e34caa01d402f8b7b02098430e34f6812d549c8d03e3a8b8f646b7ef0e264
MD5 3a515e2852b773c3094e35b68d009e95
SHA1 f09b5ddf5c4b588e3d376eaf27919fccccfda10b
SHA512 5117910999a1ac8ed799c44da5bb34bbe7f7d0de7b7721c661b5afa825bbe6d0cbaa10384826cae6933189059c0f053a6a09e1e2c169ae3a1c7cc7903c95aeb4
SSDEEP 1536:00tV+SMhofxXglw9d+kdqWHlx/5dEKwYzWxXNiiMiMEfe5ZPPJn6YiZ21CJi+hEn:By0AvSXTNOtHKTZ658
TLSH
T1FB04C403DB00C6B6F2561E70EFA65658B73E85581364C21F5BAC43BACE963D81E7C70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACE.DLL

Path C:\Program Files\Novosoft\Handy Backup 7\ACE.DLL
Size 1.2MB
SHA256 aefc63068a77b119fbdbbc849afe83d5efb09fa681c092ad7c8dab1498ec894b
MD5 c4f0e0e9be35def8d64ff720042729e8
SHA1 b6f12289465975f2577557fe9d996ab9ea18ba63
SHA512 b21ed89a076efc52907c0cd652abf591848cda4744a72801669bf6f8f60f17d1d2e3147cc2c12cf1b634445fc2a78b9a178fca1b278d261bfab811b01943fcda
SSDEEP 24576:OcVKI80IeS4BOK+ZA8RYI/iHRGp4pm94ey4bRgUAl:7VxtS4BNRXU4evbRgU6
TLSH
T17A455B14B9AE8267E68AA2F14DBD772B4C7D8541073C8BC3610DDB1C18902E76FB7A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupClient.exe

Path C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe
Size 3.0MB
SHA256 9bddff99ad4b8e9e1ae2b9728c88cc6cb6b42dfb12acacfb8545056d00d20573
MD5 cdcfec51506179bfc2a696f2d0098edc
SHA1 4b537ff9021f579179af22653bd8425a52e69f6d
SHA512 81b4e2dadedb04b28ca4afa92285ebba192a73b655d21845c3cf6e005ca1640281b1aa098127b9e5a53a84f83bb024e82d15c6a4b633654094a8190c4703f23c
SSDEEP 49152:/9MwhYqSGVI8QgvbUvQ7APPBPZ8OUojY5wo5VxWbamt5wNoSKoRBBJD5kUqQPvfT:/9YqUvQ7A3BPZ+ojY5wo5VxWbaQ5wNbO
TLSH
T162E58D267A81C4B6E2731379886CB35892EDBDF15B3454C7D588361D1BB0CE3A934B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupNetworkCoordinator.exe

Path C:\Program Files\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe
Size 53KB
SHA256 b4be5476eda023c1a66d56a171c5560d8727b17b0060f49156705c8bec893ce2
MD5 24695ceeda628bf15b584a3a1a26963f
SHA1 9e22c365d16e32ba280b2b381f453ea406100eb5
SHA512 ba1b344277a80297e30a98f79ec3031326a55fe395c3a6273f282e7da82efc1af4f73469e799af8cfdb8e1416ce7204e0bea2c40f990a24af14682f111a101f1
SSDEEP 1536:Go71iU8XSKJFPNVQUGQjqiJMQUOE8s4Gh:NwE+VVQUGQjT2QUOE8s
TLSH
T154331A233A9BC573E1A219B04D39934E917BB9730BB162CBB2C98A7D08B03D11D3525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupNotifyService.exe

Path C:\Program Files\Novosoft\Handy Backup 7\BackupNotifyService.exe
Size 62KB
SHA256 01fb0468f3b82f176ae8da9bc2942b33ee3002276a5900ae88d11964c5d186a4
MD5 d13a61770c0cd5bdca91faae41804635
SHA1 9636f0f1fcf6ec9b3065d7c74269c33789e010d9
SHA512 4a56f9fc4ec95192cd3dfd46da150c7103bbf1d6c68f8a7ef1647774676bc28c107be79c0716d2961d1bef106e1ae1225ce3d755550807700e216907674cfb9b
SSDEEP 1536:zkciia9An2XMq+PmxFY5OAVvm6IpdS/KTzNQCN6iAsDGhG:/a9ASMruxFCOAVvm6IpdS/KTzNQCNDAs
TLSH
T14C53F70373EA8161E0FA2AB4583643598A7BBC72577593CF6240F96E1C70BD08D75B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupServer.exe

Path C:\Program Files\Novosoft\Handy Backup 7\BackupServer.exe
Size 2.5MB
SHA256 e92e140f08ef9134e40ffd459378bf9bd2423e73b5a71a532e077f5be0142033
MD5 1a08377a1bdc1b666d35457931488e21
SHA1 983e673ecc608befc77de3971753cc4a8a8b212c
SHA512 ea389216c62c6a6cf32d1c6600026bb5b6d229816929497ebaa2280a8aed576a6bf37d19a1685f98254e13cf3b6b57fa84e516563ada0b57b0e2a336dc1fc34d
SSDEEP 49152:DYEwciNgDC8GAjpGocsHdAEUDsPuw5afZUrUaSVTqnMLJsk5sqAjZuMv0rn2rCR1:PHNBPuw52ZUrlznMLKkdgZJ
TLSH
T12EC55B39BF55C23AEAC211B28A7CAB5F503DD891076D45C3D28C0E9E1DA46D32E3791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HBLib.dll

Path C:\Program Files\Novosoft\Handy Backup 7\HBLib.dll
Size 333KB
SHA256 719962fca09707fb49ead8b26747a9136a1f4a45057cadefc66f7544ffbac0f7
MD5 6f510d7e24f7c40b60194bf30aacccbd
SHA1 ea36f8d785e16f3fbcf74ebe6ce60b9bb8837388
SHA512 f98e1237571261b54d1ed3557c48c9a108e39e50d272f8a076e88858d9e44fa857f1c06b1732514c9b2ccbc22b8c1551b12f2c9f9975ae7791a82eb85c2a8959
SSDEEP 6144:+YNVnSwmfrWdJzhU+cVvP5LGY7P+n25mqcMqE8674PCxOtni6F+Y7kLyyVOBuomI:+YNVwW3z2GC+vuqZ64CxOM6F+Y7w+BIr
TLSH
T1A8748D51FB46C237ECCD22F16DBE9BAF04BDA99047B442C3E3C8964D5E611D22A32257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HTMLayout.dll

Path C:\Program Files\Novosoft\Handy Backup 7\HTMLayout.dll
Size 923KB
SHA256 d5bfe462e7a8dad17c2c75cc792560542b30669027bad14c5445cf5b3162e7ff
MD5 4de473ddae8d71ab9e3ffdb0b50c9c69
SHA1 872ee2acdbdb2292c8fa90126b69cf8d10fdcaa7
SHA512 f2c07da7c7767220ea51842478cb351c187800a3d1fba68ca066df77c872a11cc2570c058416d950dc38c928542653b967636d28cbf015241e28d6a43ff79cc8
SSDEEP 24576:r7uEnBTjt8yeGY0WDEHeYioYQDFWKzvXUZ0/JCC:jt8ye4O6eaJEa/J
TLSH
T11D15337CFC02365AE8AB213175B86C863C73DC317B991B942D57521F1870B6DBB40ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO.dll
Size 1.0MB
SHA256 e720e1b812de0068b75874f881bee8244be826d69054ef1d7a2091bf35ef3a8f
MD5 837c0205ba36398b429d383e34bc20db
SHA1 3d6a372800b0067eb9b817053b53e8e2fe3a089c
SHA512 ba8ac2b9d4a64dce5404097a9351cc5aace33506ec3b569619348d50cb6e4bc6018871cfb92de2c12751475c9b59c616f2e06ff60c77415a218fd8ba27a9ab80
SSDEEP 12288:bppB7u4aM6/WlTPNxiQ+rkOghf8iQLYaMcGJpFxZ/M6efk:bHB7u21Lp0TLYjFxZ/M6es
TLSH
T121354D62F7BA4329F5CAE2705C7D1766507EAC461738EAC7B11CCA5919B02CA0F3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_AnyTypeCode.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_AnyTypeCode.dll
Size 418KB
SHA256 07edec485860b78006096067bb4b1340f6dbff0ca637c72ea32e3f1573e78a76
MD5 8846d72c2c76bee4d24698bfa6f66f0c
SHA1 9e1c6842db3df487b45356f852990001df74b64a
SHA512 9de6e32f2d937a2346d8ae41b54c2429ef5dcbd5c73b84d7922dc2f2b3cc218c9c78404c3f09c300e91c60d51071cfba03345a35e8772c6f8cb8314213c5719d
SSDEEP 6144:RJjKcVRfwlzIXpWpnERWspz1uezx2XP8QOZ+k7qWWK30tdAZtfhc3r5KPE8:DjfyzAWpnERD11ueF2X1LdCd
TLSH
T14A940973BABD87AADFCC50386DB84B2A109EAC9517D5E6C7E64C516B08D34C31D3432A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_BiDirGIOP.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_BiDirGIOP.dll
Size 32KB
SHA256 d7ff36f148c83381d6e67db22a63a50539eee464e69168ca576f18013fb5781f
MD5 6a64f032a89acec2780258463fd54011
SHA1 bac163382af37cb3a1dcd4ef8c375e3d4cfe35a1
SHA512 e0a7abf46875edfd5f53a426329cc371fe64418c4ef14a09457c27a6e307448bdbdadfa443c7f364f30307bedb4c07710e911b832e6478dc7e1eb40334b31808
SSDEEP 384:F+M4ruR4Wt1vYxzG/T2QFZzNZq+py4b3PyjSv7IBqz4NPx7su7tx1HYRBHTvACOt:F+GvL4+A4jPyjc7g7zbNCOZhdDDDWIB
TLSH
T1A0E2F812BA6ED7B3D1CA50751913935280ADBD3227E591D78FC6876D1CB83CA8E36343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CodecFactory.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CodecFactory.dll
Size 51KB
SHA256 cdaeba670ff57d8132a128168ec5f13fd7ffee6255a2f9f08300eb21c6fd4a45
MD5 acb9a04ae6fe435220e38914cdb766e8
SHA1 4cf322a861b5f6ad8bf82a4637a82ea3e8d18050
SHA512 f4c9eed074f805988b34a1e2886a8a1ba86e424384f463179430982e1c0d9de65f77cc672efda5207431df57ca0e5c203be18ab602c85184a3657c371a5427a6
SSDEEP 1536:U5DoAXgLAyf/UoAJSMtwyxRexyOZh6OK:KocgUyHUoAJSMtwyxRexyOZh6OK
TLSH
T1D4330922AA7B81B1E34A50753C659F3E409DDC7507E4B2CFDD19C2A61CA03CA887D76B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosEvent.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosEvent.dll
Size 203KB
SHA256 00bf275529bdce3b496c8921ef1629afc0284b0d13271a9eaf69d8534dde9cf4
MD5 2d244f1e45b4ace963d385f78953b35d
SHA1 129e4286dfc28e88cfbb469b1cb4c1ce63811683
SHA512 0514ea148b3f850d7e5d088b3e1cd57c6b48fd242d0d12a4eb54c6602b8bec952997e13106b8d79d3bd99a0354385b8f79ddfee43590dd957b25aab63c06b25a
SSDEEP 6144:wmqNWqGPqUfqUqEq4qcgXxgdkgmnalqQqjqgqReHKFgvUGTzmqj6q/qenqssqZqp:wmqNWqGPqUfqUqEq4qBgdkgmnalqQqjo
TLSH
T1821497A2F6258378D0CE303C1AFA879A411B69F2DB9E99CFED089D4460A15C30D7E747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosEvent_Skel.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosEvent_Skel.dll
Size 204KB
SHA256 b5f978c622c94e13404d2b70d95c4acd8d3de937d6f0e56acdd944562b2eaf62
MD5 541fa46d150c2b76cef718c28041333d
SHA1 eb04f085c7d910db304d257bd89eda3f51b43c88
SHA512 71daf5a62ef11321c2e378d499be9bec5c3eb7b983188910eef5e08cedc2b85b097be8d9dc5484e2ba161540ed9d374354021e40cb937a0155b241a83e5eed2b
SSDEEP 1536:A9Ew/R9bEGn9PoSu9qFjvCe9itrdrT9aVzQNMW9FU+QIG9q9jf9GWAB9ty0sZ9hi:QNAtLwZhUr83ToQXLsPROZzGLQA5VDO
TLSH
T131246322AE5A42B4C0CE303C06FED7DA832F16E1E79A65DBFD049D66A0615C34C7A647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosNaming.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosNaming.dll
Size 119KB
SHA256 ba684b79641ae765b8d57f741c2b28c65f90b9abcc199f883da04bc192486c2f
MD5 fa308f636f17c7c8a03da42816602fee
SHA1 9a0e004b3af86284a078f25c9c9b5997046aecb2
SHA512 6ef9b40444bb04cf08fad4fbb8ece3d5faa004a8cc34732a752e6c9ecda4206890d808a872ef45758318f930125e94e344c5ae65ebc088cd67780f3314a0bcce
SSDEEP 3072:m61vWmWldAWPpWB6kZSIvc7PavLyHOZXB0Sozr:1WmWrAWBCwZOZx/W
TLSH
T17CC3C323763983FDF68A40706864871A124E54308FE9C6EF9F0E1E6E19E12E35D79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosNotification.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosNotification.dll
Size 684KB
SHA256 eab316533a163fd8fb790faebfb65f9ac9ccace9a7fd4d0d71b21758ceb5ec96
MD5 9fc08052225274d97f67d744691ec2a1
SHA1 353ee32942d72cd7f6bb7a89198d11651f223ea4
SHA512 95190375e1773779954c4c8e268821338491732ea476f57d71e2cb3d807f9f8030a2f1913be0e404b3714b368ea7e766e9f0f7ac2719b30ea83006f5b4fd0c60
SSDEEP 12288:Tm9mCXXD5GLmRGkm0vaXmFm1Vm4mkpFmo2zmo9mDompymcFm2mdm1m+m+/mAmOZl:cXTTgNyT
TLSH
T176E41666FA2AC37AF5CDB034A970D74E415EA4F0572A90C3F74D866588622C38B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosNotification_Skel.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosNotification_Skel.dll
Size 486KB
SHA256 0d3d562c7ae15835c82728c7fb0b27e7fce64171f2e52db8f48c9180dde846b2
MD5 ca11ab17611f68d96cae058a5faf6fc3
SHA1 487b5646cdf1973763cde2bee6028f0e7caa4f0b
SHA512 6ebba7daf27011548ca29db831e1442b429823a57ce784726126c10bc156c66b3441aaad9f025934df077c9135bc2197d5bec653a52401d830ef8b6c720498fd
SSDEEP 6144:TZj8n8dc2B8wkk6Fc/VLX0o/zPOZ/5WX:TZj8n8dc2B8wkuVYo/
TLSH
T117B49565EA5AC7A9C6CE7038D5B9C78A832E66D563D5C1C3A705CC36E0A31C3DD3A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_PI.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_PI.dll
Size 136KB
SHA256 99afb35eed2d4cb1c0fb976a1c9395979dd90705e86099cc474fae66bfe5e815
MD5 32e8a369673739db0c01429be6346d2e
SHA1 33973583cef5b5448498ea25e750a0c57a308ab5
SHA512 ec512465908bfc0764a811d72165ede7f69ec0e67287b231193e6660bf47d277bd6eacae6992134bcebb5d9b2b84386659ff823f733cd087bae34c8e9bdc01d1
SSDEEP 3072:MK+jen+2vLgo4W4AXHPDE+1iGfrpxKMOid5KxaVOfCLqezJ:p+jen+2vLgo4W4AXHreoLdtOfCLqez
TLSH
T1A3D3E7933E2F867ED1CED1700834836648C6A9D15B94E4D3CF8B875958FA2D38EB5386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_PortableServer.dll

Path C:\Program Files\Novosoft\Handy Backup 7\TAO_PortableServer.dll
Size 497KB
SHA256 0e31c1f2c3b3db5c636b135cda1b3526f73e4144919447aaffdd72b8cece7979
MD5 c9710361031df3d8fa2182fd9c5c1cae
SHA1 b2d19c8f9d573dfa47427a231fc8fa2e29a2c505
SHA512 f4cebd11ba5eacb8721bcb7e3bb73c59b590b363b10adb980d997900a17fc5396ab9a29337cd24708c5fece0a14583189519791f31691b863fa475367dfe9f62
SSDEEP 6144:8X97P60ICKP4TOqXYOBYf4xTi8PzKOZO0j5M4RhHkPpFFUTPB:8X97C0ICO51bIKFyTp
TLSH
T19FB41B31EF2FD669C6CE82346C38C79D814D6A811798E5D3CB4DCA2E24971C74B3A663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbcc.exe

Path C:\Program Files\Novosoft\Handy Backup 7\hbcc.exe
Size 434KB
SHA256 dc5cf8fa4d099422c5b74d3327f21f89885b85b0e010893ea283bfe0920551ef
MD5 95310966c2d92e884a4fa4d7d5913d62
SHA1 f36c6785a85681c43c79b374aa389c52426d97b6
SHA512 bafb0259e3aa36286ea48646ac7787723f8fc2a02868662c796d2fc9f32ff871a99d9efc50e63ec8d023501252b79ad0a5a1b4323699f2378d9c9b9623c088ce
SSDEEP 12288:lUJLU0UHWUbUKUeUZU0U8U3U+UoUmUPUbUrU3U/U+Hym5fQCvOCTkyqe:uHym5fQC1R
TLSH
T153943971AB14C135E5E311798F39AB7F142EAC512B7466C3E2DC2A9D0CB52C25D3AB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

res.dll

Path C:\Program Files\Novosoft\Handy Backup 7\res.dll
Size 912KB
SHA256 dba88c5d014ee921b0b09b8153ebbaaf29a98bb788f3360177cc2f7a3381ce72
MD5 71cefa04fba341946a68097a7b4e0c43
SHA1 e97b3ca5e3c668b4325daa031f5b7d6b7ce5ef6f
SHA512 cbf734da13b8933a5742eeced47618c4e695b80c3d081daf9b10838f1249861f7d3ef00f35fa4180cc82b2b0305a76b0e871445ce185beb20b9242f703c2892d
SSDEEP 12288:Reu+4OtYezm8/8YNVY+wtmdkd19RXa7TWzc:RD+p7J8wi+wtmdkd1S7
TLSH
T1A8154B95CC0C8F5DD2A8F2F4921ECD2951297C10B354E23E5A74B908E6B33996EE1BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workstation.hbl

Path C:\ProgramData\Novosoft\Handy Backup 7\Settings\Services\workstation.hbl
Size 555B
SHA256 7997de407771cca5f6fb5fdb79f7b1de89be9a32a0552913202a95300023f722
MD5 0a264f4d36d493da24dbba21ff5a5511
SHA1 a5f29fd9f7507a5bd469f918e8a9f1e80f36f769
SHA512 f013091935c8ed37091767c69644609cb9e077df17749c3169a53075909dd26431af96cd06968ef5c204d071404320fefa6915a2b8afcfc8105453a86e386b2f
TLSH
T147F06230B962DF11D707533B8EB3B884B11648693119781054DFAC7BA25D2F95F4CD28
MD5 SHA1 SHA512 TLSH

Submit Download

1F356F4D07FE8C483E769E4586569404

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404
Size 32KB
SHA256 a9999618d5bb6015af31bf6d38f5f8f176cc56580ed226e2025466c26b132022
MD5 b7cd6cf33b5da7a1579869b0bb609714
SHA1 6b72312290b25cab793e78f9492ca68a582c0831
SHA512 57f86b868723b9ef0b625559cc6c512a9b7ad3ce75427e56ba4c340cd1760c24ddd93d91111fa93b19c8bbcaf75b4c78c068c44551926d0050085624706d76f6
SSDEEP 384:HvKVMEtkFQQqDf1HRECIHSlaI5Ck/totkklHtzJKYFKSFNbtnPd3pdRkOfuat4X6:ienl2Yy1ENhP8zsiWhIyMCfMOjK0m9AH
TLSH
T195E283A86D7A6C6051CEC1720198375E1E3AF6C622D31909CB397A045642ACF6F7FF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B6E683A7A45CC59BF035C9BA8C7AB9D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D
Size 546B
SHA256 55682ef87ddbdeeaf7239154df77d6ffc104a1cec5bde9cc9ffbfa2922d7b24a
MD5 6f72d835a42c4f68db06e0b719d3e63f
SHA1 5316cb35d4469a2395eb920162e9730dcd4f2486
SHA512 5bfb6bf6c8e9266fd6a833386c5225452594c3f475397fa10910d6d578407262ba870c132c5d6f127f4433388f7863b5742d5896a11742b578f251fe10ecf9e0
TLSH
T183F0C0B0858C01007B85BD988394E7BE5E7CF3E0522279E6E474911945B9BC5AE2A0AB
MD5 SHA1 SHA512 TLSH

Submit Download

5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
Size 1KB
SHA256 bfd1056d403efc495436a85ebcac7345eb9ed0fa0b6dbd040151327a3cefb580
MD5 21681b79f6f1d55231f2669d3fc5cb99
SHA1 dc5f7a3afb32818879f91a5fe3e7e07d0660e835
SHA512 15dfaf5519f63a66c1a53f6fc73559a5cea863fb2fb66dec5153d99b0acdae774be32b9da1571e8bc4cfa8a6287be3e2ca723a60ac5136f6f3538d692ff1b202
TLSH
T1E241FAE7DAB462C14930C341A2BDE79BAF74D6B1A1819192741FD0712A873E4A93801F
MD5 SHA1 SHA512 TLSH

Submit Download

1F356F4D07FE8C483E769E4586569404

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404
Size 300B
SHA256 30161997c9c62817872fe14be316b5b3f20c929408033c743ba3c10ee47620c5
MD5 3a298d657938a1ad6c4df4ac577ab9aa
SHA1 177be1d8949ba769285ddcbeaa9347fd4163a654
SHA512 8ef381178bfa1fdc0c07bcd104ff72a9eb4a97d426a0b3e64e04126f9566bd350e01d2a13a0281cf347e215ae619fc4c07f6777cb3865f90aa47416fc997e85a
TLSH
T134E05B2C1EB85579F573C7BF9D551640BEB0BD26B647461D06F1164C8906EC23C5160A
MD5 SHA1 SHA512 TLSH

Submit Download

3B6E683A7A45CC59BF035C9BA8C7AB9D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D
Size 306B
SHA256 2d6169a529630796275abe9f46e4835283d278a0516a347630bcd1fe7ef09f04
MD5 2244af9a3d4509a43a4deee32d5024ab
SHA1 6eba7ec6695a6868f274632846313ad58f6be39c
SHA512 72aa67338daef71cc05dfa99cb42195b01e1c2e27e7bd4d39997f395698bd872e83fff577d1c7089f55eb326308e2fad04a89ab2759c53e37e2d169309266b23
TLSH
T1DFE05E382FD14333F276D67A9EA14801AE7AB557B901CB090BA7098C582CF58A82181E
MD5 SHA1 SHA512 TLSH

Submit Download

5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
Size 398B
SHA256 2eefc7de2a4a0d8542a50bad7f5d1ddfb7ac5516d4adcb8f524d2e46bf81d21f
MD5 b7ac0a1811eb276c14d32f3ee4491f91
SHA1 ed17cdd13890efb17698b0bcd18deb2205d39beb
SHA512 2392b5f79455c2fde41e420bdcdd91e5b4b1cd81c6e50cc0ecf776d47199bd79c846a546eb002007e36bb40920a33dd9a10a92f6497f7df2171459259de693ad
TLSH
T15BE07D143BF9013CF0B71CF585D942184C6DF172184996BD0A40130D7A26E00CC72931
MD5 SHA1 SHA512 TLSH

Submit Download

B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F
Size 500B
SHA256 0580d9c368a162140ee792fc03c3bcee59a7038c6bbb5c05b4dff8bce201bc5d
MD5 7bee3d876da3be007d34f7987fc5e173
SHA1 58eee1abf1573aad1296cd26cdb79bb879a9a78b
SHA512 4e364ff1dc3db8c8e5ca0690afbf6caab8ed0c1c0909dc0967f2f52e17d7985dd34684532dc5b55b3ce1df582acdf470d15b2a44fa1e85f3ba5b0e3ffb6d2713
TLSH
T142F0DC281AF12029F231E93587DE6262C016B1073C41847F0AC14E0E2A0AD656CE3428
MD5 SHA1 SHA512 TLSH

Submit Download

d159cde2-24c7-48ec-ab99-9b3a020ce2d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d159cde2-24c7-48ec-ab99-9b3a020ce2d8.tmp
Size 105KB
SHA256 0bc6098c2195ea120fd2411f8b8c4fa0be6092da7b9834a6a10e2505ee8edd65
MD5 e447ec9ad40bf31349a90a2aadcb3ecc
SHA1 3d51a6fa9976a1d212dceb0da59f78b797929ecf
SHA512 a2349b92a39953e6bd700ee27581e208e0b6bc741fc0ef93e485053eeebb1733e6e591a854f76c310b6452cce50aa67eb5aba01e43244dc41591b76e7370460c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T145B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7cb151426d6db8739f3c1a66a2be8874016a818066fc9d39c54678b2721f66f8
MD5 c6e3d06c414335289b5c452474209771
SHA1 2a3fec91edb595b52bf7961233f1bd094dc9a031
SHA512 ee0b2ddc71245a6dca7afe23882cfab7f7ec166bfeea5c0fd017354e894dd92b8638c2ee1454f0448bc737bab098612624beafb71be8b8959d089b71f11cfe5f
TLSH
T14981A3355686C8E1F3B100B2BCD9425EB733A5CAF9A36EE152D0BC372609F92960784C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b7bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b7bd.TMP
Size 3KB
SHA256 49de1793a47f2364519858ebc4ab5683ba3a30f333ebc3246724586061b8492d
MD5 044135af587d6414f948d3e8a5035d59
SHA1 ef29989619a7302f4f49801805c444cd31a61fe8
SHA512 b469b12f79f887ec00866cb126d3085faad0b5f1f640d5618c84c3b022ff407dac97548ca6b00a5837021c975d018a328c66a1041b1a2e0caa8f19daf3aeb3f7
TLSH
T1547180351286C8E1F3710032BCE9426EBB73A5C9F9A7AEE151D0BC372508FD2960714C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 17e27212f8b26e7b1ce0706e6e2e244818b39a2c8421add4e2481159f0adbcbe
MD5 a846fcb1ba794abeb7eb81e5589099a8
SHA1 2778ac311e631a00c3e2c255e754464880886318
SHA512 c32c447f36bdb7134cd5b1e2f12cbdbee89f05eab13406bbd10995218ac422f3218bfc2bfdf56e3de3a9100dc599b181aeff0de43d5ccd333540088779882f96
SSDEEP 768:Z9sqxtK7pLuLzJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBUr4Ll6AR9GroG:Z9sqxtiEzJlWvJD6Tu1jaEUr4LAs99ji
TLSH
T114F20B3B6D0CCB7E4F844E9CED2A7E9A6DE8018B96D8C95447FA840C03C66EB11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d628a4387ee1d9ae8e6f302b6d95194ae5bd4201c3c69586cb6d7dcd0a03e1af
MD5 4c2b8a2e6e68e07ad623d39084305e6a
SHA1 a80785c3f0c62bbd9bc36c4f07fd6c442fcf072f
SHA512 3e11c259d8a2f08bf3c2be8ed5f7b5fa9f97af3767808fe083b40196dfeecd3ebb11e6db1f34b4da31b198a2affc76e36b92f90a1bb40b889d824b0496424456
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2Ay:ExH3ZFDNv
TLSH
T15BE1361B3136066238BE2948B2A6CA3B4F4231637018E57F7F7950A55E6EE110DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 155B
SHA256 e423e027aba45a55a7a17e644b27b22f9dd63675fe95a69c0a4c70bc4be3257b
MD5 8679bb6c172453f02d86e9b060d3279a
SHA1 45044541e6ce28f8d7ce0fcce9253b846e94bd87
SHA512 2ad465654456c925ab9e81fd4f7036e04f3112d0cc69239bed134c1e36816b04c5dc3d32138b36503d481e4e5ea23564e7defa8a12bf562bd09be97fbd95c9f1
TLSH
T13EC08CE71901C9CA07B0FEEC61A8332DC10B830C8CF8C9F98408604220F8E520442928
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a56e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe59a56e.TMP
Size 162B
SHA256 0c8a974330ab301eb770d37d93627c7ef077892d508f72d02bb35ea4cdda2365
MD5 b6b149a7e1a620347631c077771bd439
SHA1 0807f11d1e267a193be5272acefb06bf3f0fa8c0
SHA512 ee69c4e877f2ac53ccabac771aa32fac619cec3e9d3e194abbdeb1040aa3a28ee94a442d2b5d4e2616dd3505d924a7434312161f8f1265da8edb21f53ec852de
TLSH
T148C08CA7091589C607B1FAECA1A8731DC11B8F0C8CE4C9F98805704220B8E524442928
MD5 SHA1 SHA512 TLSH

Submit Download

cc8db8ad-e1a0-4579-be70-3e7a5a5f8b42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc8db8ad-e1a0-4579-be70-3e7a5a5f8b42.tmp
Size 14KB
SHA256 11e5f751dbef65262c36847daca5a0d9a6d6f1b1268cff29401015decd1de842
MD5 245a1527d0c91e0b551efec054c5f1b1
SHA1 cff62e21e0b055a4d32595896a6ea653cd76a1a7
SHA512 591a875ba4af86fe46a6a17e2ba11aa1965b9424a25a16ac8922bb17d042b78ee314415668d1f2c3fdc1ceae2b8ad0eed072609bbcd507fca3f0abfef7721d57
SSDEEP 192:sxZkRHFyM/jK1Ml8Mil/flXsBaA0x8iIdp8UHW6+WNy0b/1wIEdn+UrIHwxIoGtW:sxZkV5ql/fdsBa/8LZHbp/277rSc
TLSH
T18B52F756AA34697B8CDFE21DF949BB63D2F51422D1900E549EFCCA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2f95648-8170-476a-a4d6-2399b35f3970.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b2f95648-8170-476a-a4d6-2399b35f3970.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bff682ca6f5526e665cc244a6d6e008af7f89059c010af26dfd314223502468f
MD5 f82d31d12eb4b4832ce51a470c3395a4
SHA1 c8fb00e0e4fc30ca27029e70f86f508cb5f29463
SHA512 e5dc929ecbf7f820dee83ca06e19e7b8674600a3cc5e6fb71073ff1da35e0020129ee7076e511cbbb6314c4279864440ee5c200f8b4e8678b266c5a65ecd9173
SSDEEP 384:nkZcIhsNIhqbaJQuVRN5Oj9z9d+2fu09TOOPrXLpe8C/i:ChHvH5Oj9z9dlm09TOi9PZ
TLSH
T10C928C706C789C6769FAB645F58B32478FF820B7F5C51B98E1E8CB0C05D6698130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 64883e60e7554dfdc30ed14fbc51799424c4655636c590da02b2d9cda4828e0d
MD5 f19bf809c6600abfbb43e8d95fca66d4
SHA1 2ee55cef6d0a362833a2d04bc5c4c8be99eb21fa
SHA512 3de222ac5fef5bbb987e577c799d33c44a683e2a196fae556b2dc3b51ad17ca0943f17f3df9369bf3a3f71820fec16b95d67d06e973d6a04cd69b31dde283aec
SSDEEP 384:nFZcIhsNIOqbaJQuVRN5Oj9z9d+2fu09TOOPrXLpe8C/i:9hmvH5Oj9z9dlm09TOi9PZ
TLSH
T1A0928C706C789C6769FAB645F58B32478FF860B7F5C51B98E1E8CB0C05D6698130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 95bc5a4151f9ed26ccd1ae0fe3b289128426e57f3f9f607653c223b30eb7be01
MD5 1b2a3587af7fcfd31678b308780a8f34
SHA1 5c9fba0a7dd7713e2d9a00b2b182358514127c24
SHA512 bafde8b14de18af3f511cf59521c4a1be537eda0da41ed85128a63c2bf93f731196c74a68386f77add6d66562e8feb3b4c1b90a97cfd59232247331be8dbfb04
SSDEEP 192:tONiD6JkRtQmiUyn9W+RN5Om5o92h3ERXU6:tONiD6UryW+RN5Oj9+kU6
TLSH
T1C602D9356D785C7B9EF26E09B58B37175FA4207BE9852F80DAE81B0C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bbe84132f2645392108fe0eb1c31246888e9cca1575987234375f1c2ee9ae18b
MD5 c263e3bb5ab3c69ba17e7f4715831cbe
SHA1 bb4dc2bb39784821af3d759ad9a8dddaa79942d1
SHA512 71aeb38a061805064dbc1c91419c173cc101b819c29261d149e824b72bd59518b36d74f0053e480cfb1c318e7b75a30adc92ad8d81cbb9e25cdea3a2b12434d2
SSDEEP 192:eONh6JkRSQmiUy69r+RN5Om5o9nz9d+2fu0HVc2q9vggU6:eONh6UONr+RN5Oj9z9d+2fu0WTU6
TLSH
T18C1219756C289C675EE66405F48B32974FA8207BED866F90E1E45F0C01DBB9C274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27f7a05d-4e82-4652-9b04-78c6ea2882f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\27f7a05d-4e82-4652-9b04-78c6ea2882f3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 59c00336802b5d968b7c6484fbf02d57f9fed6d97574e6f81e9985981fce837c
MD5 a0ab418aed7f8359b160280d28ac13eb
SHA1 8c10fa27a0f1477d8c7aa5990dd3b506ddbafb92
SHA512 3b77e6c613c2e7ac5f8d0684004db2e44f43f4bdc1b0d61dd8ed1b6a05c356777c81c81aca902d5a91abfb1c87abc5c50b24a5d98b5b330bec69531e070d84e8
TLSH
T102412B5DBAF90148B3B77E5A9BF6A82E447B79771E06D55D10110E4E0A23B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

229568fa-bce5-4ce7-bb8f-8309a0aef4f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\229568fa-bce5-4ce7-bb8f-8309a0aef4f5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c65176f-d017-4746-bd3d-8feff9b784d0.tmp

Path C:\Users\Admin\AppData\Local\Temp\6c65176f-d017-4746-bd3d-8feff9b784d0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

3a78dd00-b54f-4bf3-89be-225603add828.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4956_1348821996\3a78dd00-b54f-4bf3-89be-225603add828.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4956_756444980\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.hbl

Path C:\Users\Admin\AppData\Roaming\Novosoft\Handy Backup 7\Settings\Services\server.hbl
Size 2KB
SHA256 065fc78fbf42c9fb1c409e0bef82a1a6726b1b9a698e5904db2845dc16364190
MD5 98a8b51d55c936a6054f6514077537c2
SHA1 b9110a6c19fb9a082ed22e2c6f40878d3169a570
SHA512 686e0a83dd12c20f522441ef4236ab264ca7a90eec8f31b84f8b8d195c6946e0c63c4ca1db1c678a606c9b81c3d852da883878b3c2c040cd748ce20412a56aa0
TLSH
T10D510BF46802D9E50E177C503EC527E16B0FCDA24328123BA2ED39291CBFE784778994
MD5 SHA1 SHA512 TLSH

Submit Download

server.hbl

Path C:\Users\Admin\AppData\Roaming\Novosoft\Handy Backup 7\Settings\Services\server.hbl
Size 2KB
SHA256 03669ec781921d7c29c2badaebe1c6b5ca36cbe66847141f05258e5393fee05e
MD5 f53f7b60323d451e2aa0012ee2821c6a
SHA1 e4672b8031af3babae9546d6e9f50426294fbd65
SHA512 ce18e23bd59cd631eee38f5df5db9b01e3f5d6fb408b307e3de4d3926da743dd25c8d4e9153c978996ecddbf2ce4148ad75b33d6aa3aae3117de719d547ab903
TLSH
T10551C9C4FD474A516B166AC5EFD40D8BE31AC5B91270643920FF7E4519AF0E858263BC
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF7F7.tmp

Path C:\Windows\Installer\MSIF7F7.tmp
Size 148KB
SHA256 fa9b83479f1b955790325dc557624185a8c72df3e31870dae075437146858185
MD5 14c01c848d8452005734858a64b6784b
SHA1 d3d81fcd1267095880218ef09b92220248905ea8
SHA512 8334c467c470c13b0245425d3bc1ba9676a04e1e015bec56122504d622e7e3858d5ad7950d09c155f3666a90b7d3c7b40f324d0786553d6e81711b7f38cf1d57
SSDEEP 1536:LJBXpE+chXzGFcvDKeQlWe+LTwhT06Ua/782ix4UjAr628r4TbmMOI5IJhb6+I1v:1FpEPXElP22c4GusR6ZKX1PJEQ7+kQ+
TLSH
T1CDE38F327085D175F2A218B7E96AC2719D3DF1280B2085CD5B828D9FAD28496BFF7703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFE33.tmp

Path C:\Windows\Installer\MSIFE33.tmp
Size 75KB
SHA256 2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
MD5 6f8e3e4f72620bddc633f0175f47161e
SHA1 53ed75a208cc84f1a065e9e4ece356371cac0341
SHA512 80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
SSDEEP 1536:xsPAv1yiUHmByZXTN5GCOPRj15+3rT0q6Mnu:x0AvSXTNOtHKTZ6
TLSH
T182737C2172A1C176D1A66436F629C2721E3EB5302BA488CBBB5607BE4E302D1F677307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFF9C.tmp

Path C:\Windows\Installer\MSIFF9C.tmp
Size 214KB
SHA256 ad05944fa5131b64195bc7559430e432043667b9543e8ee12d33149eb0a89ea2
MD5 ac4d31769f20a0b733364025dc59863d
SHA1 fe6eed010561c46d8bc7ac9d51a73262c1b5d2a7
SHA512 e11d221fb76fdf03b97141740dc0c75b0b2c27514164df800c0e92c5cf689663b51ff650aad959e762461c63f39d8e7cbc0842260d7266a2e0fd99ec6fca8574
SSDEEP 3072:XnEW8d3zdIgMYSBbL5a4jWt44dD7phQC1+avKQ6Z:j8d3ZYL/WtndD7PnY
TLSH
T1CB2439307660543DD5B149F2F719C5B0AE3DF1185BA088AE97B58E4E2C2C896BBF7306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ef8b.msi

Path C:\Windows\Installer\e58ef8b.msi
Size 29.1MB
SHA256 adbf44492073f7a77af23ec8422841a0ddfb640c7954f4622884cdbb3379efa2
MD5 38debe1529f4febf6890f8fc6bde2bb7
SHA1 3738910b3c56ebf9312c3b423e0c34d26ea899bc
SHA512 5cdb0ad47b9dd6488ea6f4d717605bb00bcf6b4d0d4fd78dd28af60862daadf5879d88db80988385ec4c815c2687f8efef5596a85aaf9278d459314bedf66f24
SSDEEP 786432:3wjdEyAHYw2/p/NqQ4tsn1ndERAllYp0:3wC4w+plqPsnfERAbYi
TLSH
T127673311B4508439D1711778964FD6604BBC5C388BF1940AEB6ABB4F2E7FB8692B3F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc100enu.dll

Path C:\Windows\SysWOW64\mfc100enu.dll
Size 53KB
SHA256 d71db839de0bc1fcc01a125d57ced2aaea3f444a992426c316ce18c267c33a8c
MD5 2a2c442f00b45e01d4c882eea69a01bc
SHA1 85145f0f784d3a4efa569deb77b54308a1a21b92
SHA512 f18d9019eee843d707aa307714a15207be2ded2eceab518599fbed8a3826a1a56f815fe75fb37f36c93be13f3d90e025f790db6b3ba413bfd5cd040b2cc7dbf7
SSDEEP 768:TgIdijcuEhCgysM6B1CLPLNq5f/nWHBNheOU2fd51b6FjpvU:kI0ifysM6B8PLNYf/nWHNTdr6F5U
TLSH
T19E33626263FD8605F6F77B752EB546605E36BCA2AD38CA0E1640614E0932F50DEA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc100u.dll

Path C:\Windows\SysWOW64\mfc100u.dll
Size 4.2MB
SHA256 bc50848aeef466dff4a3d8c386bf0d0ec35b8e5b438031ae885aa5371f2e1a42
MD5 f3de10aabd5c7a1a186c9966f037d0c0
SHA1 6aaae8331a5377f4025d2d860e5872b842a41df8
SHA512 07d93b8abbf8acfab1d8f0711a37086764000310450ba361e7d5e1369012b3a45fd394460841b0f3cca79acead2080bbe1f029bc36191c133d7ccea182ca84e1
SSDEEP 98304:veeKejRb6KYYRzl1rYBrAWpTmms3Ctm8oVXK0na6g3QAt1zwoN1R4FLOAkGkzdnr:v8NpL84jN1eFLOyomFHKnPAu
TLSH
T138268D217EC951B5CDD722B0069D7679922EECE4273006D352943BEFE8783C16E385AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Windows\SysWOW64\msvcp100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Windows\SysWOW64\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2712-554-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/2712-1137-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/2712-434-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/4940-566-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/4940-612-0x0000000010000000-0x000000001025E000-memory.dmp

Download