Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 18:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
handybackup-764-x64.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
handybackup-764-x64.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target handybackup-764-x64.msi
- Size 29.1MB
- Sample260814-w25fdsbc66
- SHA256 adbf44492073f7a77af23ec8422841a0ddfb640c7954f4622884cdbb3379efa2
- MD5 38debe1529f4febf6890f8fc6bde2bb7
- SHA1 3738910b3c56ebf9312c3b423e0c34d26ea899bc
- SHA512 5cdb0ad47b9dd6488ea6f4d717605bb00bcf6b4d0d4fd78dd28af60862daadf5879d88db80988385ec4c815c2687f8efef5596a85aaf9278d459314bedf66f24
- SSDEEP 786432:3wjdEyAHYw2/p/NqQ4tsn1ndERAllYp0:3wC4w+plqPsnfERAbYi
- TLSH T127673311B4508439D1711778964FD6604BBC5C388BF1940AEB6ABB4F2E7FB8692B3F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c00000001c640-376.dat acprotect - Executes dropped EXE 5 IoCs
pid Process 5036 BackupClient.exe 2796 BackupServer.exe 4560 BackupNetworkCoordinator.exe 1060 BackupNotifyService.exe 4704 BackupWorkstation.exe - Loads dropped DLL 64 IoCs
pid Process 2612 MsiExec.exe 2612 MsiExec.exe 2612 MsiExec.exe 2612 MsiExec.exe 2612 MsiExec.exe 3748 MsiExec.exe 3748 MsiExec.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 5036 BackupClient.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 2796 BackupServer.exe 4560 BackupNetworkCoordinator.exe 4560 BackupNetworkCoordinator.exe 4560 BackupNetworkCoordinator.exe 4560 BackupNetworkCoordinator.exe 4560 BackupNetworkCoordinator.exe 4560 BackupNetworkCoordinator.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Handy Backup 7 = "\"C:\\Program Files\\Novosoft\\Handy Backup 7\\BackupClient.exe\" -autorun" msiexec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 5796 msiexec.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Drops file in System32 directory 34 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mfcm100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100chs.dll msiexec.exe File created C:\Windows\SysWOW64\msxml4r.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100deu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm100u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100chs.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100fra.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100jpn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm100u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100jpn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100rus.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100cht.dll msiexec.exe File created C:\Windows\SysWOW64\msxml4.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100kor.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100fra.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100kor.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100deu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcr100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcr100.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100cht.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100rus.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc100.dll msiexec.exe -
resource yara_rule behavioral2/files/0x000c00000001c640-376.dat upx behavioral2/memory/5036-386-0x0000000010000000-0x000000001025E000-memory.dmp upx behavioral2/memory/5036-453-0x0000000010000000-0x000000001025E000-memory.dmp upx behavioral2/memory/5036-456-0x0000000010000000-0x000000001025E000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Amazon S3_bra.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\close_1c_server_connections.vbs msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\BackupNotifyService.exe msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Customizes\Danish.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\WebDAV_tur.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\UI\images\progress.gif msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\FTPS_fre.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Server\Czech.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\DBPlugin.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\svss_xp.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\TAO_CosEvent.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\TAO_ETCL.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Yandex.Disk_rus.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\MSSQL.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\TAO_DynamicAny.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\1C_cze.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Filters\zip.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\UI\images\pic02.png msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Customizes\Spanish.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\7z.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\NotesPlugin.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Filters\szip.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Amazon S3_tur.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\FTP_eng.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\HBLib.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\PostgreSQL.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Filters\blowfish_eng.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Customizes\DR\Czech.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Server\Armenian.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\1C_tur.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\readme_ru.txt msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Templates\view2link.xsl msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\SFTP.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\1C_bra.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\ws_svc.conf msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Filters\blowfish_arm.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\MySQL_bra.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Templates\Plugins\1C.xsl msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\TAO_CosNotification.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\UI\images\icon-backup.png msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\MySQL_spa.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Templates\Plugins\PostgreSQL.xsl msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Server\Spanish.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\FTP.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\TAO_AnyTypeCode.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Filters\blowfish_spa.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\UI\images\icon-another_destination.png msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Online Backup_cze.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\UI\images\banners\default_ru.png msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\MySQL_fre.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\UI\start-wizard.html msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Customizes\Turkish.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Yandex.Disk_fre.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\Registry.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Templates\Filters\blowfish.xsl msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Customizes\Brazilian.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Customizes\German.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\hbcc.exe msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ssleay32.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\LibrariesMS.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\Plugins\OraclePlugin.dll msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\ws64\xdelta3.0u.tar.gz msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\Multi-cloud_arm.xml msiexec.exe File created C:\Program Files\Novosoft\Handy Backup 7\Lang\Plugins\PostgreSQL_eng.xml msiexec.exe - Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIE77E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID603.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID7C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDC23.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIED3C.tmp msiexec.exe File created C:\Windows\Installer\{83CBBF26-48C0-4FCF-B345-91CB1FA7EF2A}\Icon msiexec.exe File created C:\Windows\Installer\e59cdb8.msi msiexec.exe File created C:\Windows\SystemTemp\~DF87365F8ECC789B7D.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{83CBBF26-48C0-4FCF-B345-91CB1FA7EF2A} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260814192805364.0\msxml4.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260814192805364.0\msxml4.Manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260814192805423.0\msxml4r.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260814192805423.0\msxml4r.dll msiexec.exe File opened for modification C:\Windows\Installer\{83CBBF26-48C0-4FCF-B345-91CB1FA7EF2A}\Icon msiexec.exe File created C:\Windows\Installer\e59cdb6.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID886.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260814192805364.0\msxml4.cat msiexec.exe File opened for modification C:\Windows\Installer\e59cdb6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF9DF9FB382517A18E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID933.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDBB4.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260814192805423.0\msxml4r.Manifest msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5796 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BackupClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BackupServer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BackupNetworkCoordinator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BackupNotifyService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Kills process with taskkill 3 IoCs
pid Process 5532 taskkill.exe 1400 taskkill.exe 244 taskkill.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\ = "Server XML HTTP 4.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.ServerXMLHTTP.4.0\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.MXHTMLWriter.4.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.hbi msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.4.0\CLSID\ = "{88D969C1-F192-11D4-A65F-0040963251E5}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{00B7E0AB-817A-44AD-A04B-D1148D524136} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.MXXMLWriter.4.0\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0\HELPDIR\ msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IndexFile\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\62FBBC380C84FCF43B5419BCF17AFEA2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\ = "Free Threaded XML DOM Document 4.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\ = "XML HTTP 4.0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\TypeLib\ = "{F5078F18-C551-11D3-89B9-0000F81FE221}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\Version msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XSLTemplate.4.0\CLSID\ = "{88D969C3-F192-11D4-A65F-0040963251E5}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Both" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InProcServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\Version msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\ = "XML Schema Cache 4.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.XSLTemplate.4.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.4.0\ = "Free Threaded XML DOM Document 4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\ = "XML Data Source Object 4.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.XMLHTTP.4.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.ServerXMLHTTP.4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.XMLSchemaCache.4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XSLTemplate.4.0\ = "XSL Template 4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\Version\ = "4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.MXXMLWriter.4.0\CLSID\ = "{88D969C8-F192-11D4-A65F-0040963251E5}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\InProcServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.SAXXMLReader.4.0\CLSID\ = "{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}\Version msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\Version\ = "4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.SAXAttributes.4.0\CLSID\ = "{88D969CA-F192-11D4-A65F-0040963251E5}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\62FBBC380C84FCF43B5419BCF17AFEA2\Version = "117833732" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.FreeThreadedDOMDocument.4.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\InProcServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\62FBBC380C84FCF43B5419BCF17AFEA2\ServerFeature = "\x06" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.DOMDocument.4.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.DOMDocument.4.0\CLSID\ = "{88D969C0-F192-11D4-A65F-0040963251E5}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00B7E0AB-817A-44AD-A04B-D1148D524136}\ = "MX XML Reader 4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\Version\ = "4.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hbi\ = "IndexFile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\717976ECBA431704CABDA561B091E3B8\62FBBC380C84FCF43B5419BCF17AFEA2 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.SAXXMLReader.4.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Both" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.FreeThreadedDOMDocument.4.0\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InProcServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\InProcServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.XMLSchemaCache.4.0\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\ProgID\ = "Msxml2.SAXXMLReader.4.0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msxml2.FreeThreadedDOMDocument.4.0 msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2612 MsiExec.exe 2612 MsiExec.exe 2612 MsiExec.exe 2612 MsiExec.exe 2772 msiexec.exe 2772 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5796 msiexec.exe Token: SeIncreaseQuotaPrivilege 5796 msiexec.exe Token: SeSecurityPrivilege 2772 msiexec.exe Token: SeCreateTokenPrivilege 5796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5796 msiexec.exe Token: SeLockMemoryPrivilege 5796 msiexec.exe Token: SeIncreaseQuotaPrivilege 5796 msiexec.exe Token: SeMachineAccountPrivilege 5796 msiexec.exe Token: SeTcbPrivilege 5796 msiexec.exe Token: SeSecurityPrivilege 5796 msiexec.exe Token: SeTakeOwnershipPrivilege 5796 msiexec.exe Token: SeLoadDriverPrivilege 5796 msiexec.exe Token: SeSystemProfilePrivilege 5796 msiexec.exe Token: SeSystemtimePrivilege 5796 msiexec.exe Token: SeProfSingleProcessPrivilege 5796 msiexec.exe Token: SeIncBasePriorityPrivilege 5796 msiexec.exe Token: SeCreatePagefilePrivilege 5796 msiexec.exe Token: SeCreatePermanentPrivilege 5796 msiexec.exe Token: SeBackupPrivilege 5796 msiexec.exe Token: SeRestorePrivilege 5796 msiexec.exe Token: SeShutdownPrivilege 5796 msiexec.exe Token: SeDebugPrivilege 5796 msiexec.exe Token: SeAuditPrivilege 5796 msiexec.exe Token: SeSystemEnvironmentPrivilege 5796 msiexec.exe Token: SeChangeNotifyPrivilege 5796 msiexec.exe Token: SeRemoteShutdownPrivilege 5796 msiexec.exe Token: SeUndockPrivilege 5796 msiexec.exe Token: SeSyncAgentPrivilege 5796 msiexec.exe Token: SeEnableDelegationPrivilege 5796 msiexec.exe Token: SeManageVolumePrivilege 5796 msiexec.exe Token: SeImpersonatePrivilege 5796 msiexec.exe Token: SeCreateGlobalPrivilege 5796 msiexec.exe Token: SeCreateTokenPrivilege 5796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5796 msiexec.exe Token: SeLockMemoryPrivilege 5796 msiexec.exe Token: SeIncreaseQuotaPrivilege 5796 msiexec.exe Token: SeMachineAccountPrivilege 5796 msiexec.exe Token: SeTcbPrivilege 5796 msiexec.exe Token: SeSecurityPrivilege 5796 msiexec.exe Token: SeTakeOwnershipPrivilege 5796 msiexec.exe Token: SeLoadDriverPrivilege 5796 msiexec.exe Token: SeSystemProfilePrivilege 5796 msiexec.exe Token: SeSystemtimePrivilege 5796 msiexec.exe Token: SeProfSingleProcessPrivilege 5796 msiexec.exe Token: SeIncBasePriorityPrivilege 5796 msiexec.exe Token: SeCreatePagefilePrivilege 5796 msiexec.exe Token: SeCreatePermanentPrivilege 5796 msiexec.exe Token: SeBackupPrivilege 5796 msiexec.exe Token: SeRestorePrivilege 5796 msiexec.exe Token: SeShutdownPrivilege 5796 msiexec.exe Token: SeDebugPrivilege 5796 msiexec.exe Token: SeAuditPrivilege 5796 msiexec.exe Token: SeSystemEnvironmentPrivilege 5796 msiexec.exe Token: SeChangeNotifyPrivilege 5796 msiexec.exe Token: SeRemoteShutdownPrivilege 5796 msiexec.exe Token: SeUndockPrivilege 5796 msiexec.exe Token: SeSyncAgentPrivilege 5796 msiexec.exe Token: SeEnableDelegationPrivilege 5796 msiexec.exe Token: SeManageVolumePrivilege 5796 msiexec.exe Token: SeImpersonatePrivilege 5796 msiexec.exe Token: SeCreateGlobalPrivilege 5796 msiexec.exe Token: SeCreateTokenPrivilege 5796 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5796 msiexec.exe Token: SeLockMemoryPrivilege 5796 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5796 msiexec.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5796 msiexec.exe 2772 msiexec.exe 5260 MsiExec.exe 2612 MsiExec.exe 3748 MsiExec.exe 5036 BackupClient.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2772 wrote to memory of 5260 2772 msiexec.exe 90 PID 2772 wrote to memory of 2612 2772 msiexec.exe 92 PID 2612 wrote to memory of 244 2612 MsiExec.exe 93 PID 2612 wrote to memory of 5532 2612 MsiExec.exe 96 PID 2612 wrote to memory of 1400 2612 MsiExec.exe 98 PID 2772 wrote to memory of 3748 2772 msiexec.exe 100 PID 5036 wrote to memory of 2796 5036 BackupClient.exe 105 PID 2796 wrote to memory of 4560 2796 BackupServer.exe 108 PID 2796 wrote to memory of 1060 2796 BackupServer.exe 110 PID 2796 wrote to memory of 4704 2796 BackupServer.exe 112
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\handybackup-764-x64.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5796
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E1EE7B8D80A977E9825D0A20DB6144E C2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5260
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CB6B10E0FDC5A32DF40ECFD49638B6302⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupWorkstation.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:244
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupServer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5532
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupClient.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1400
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7BD5DB4F2EBAF4CA4341C6715F1BFB11 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3748
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4980
-
C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe"C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe" -autorun1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Program Files\Novosoft\Handy Backup 7\BackupServer.exe"C:\Program Files\Novosoft\Handy Backup 7\BackupServer.exe" -n --ListenEndpointHost localhost --HostNameInIOR localhost --CoordinatorHost localhost --CoordinatorPort 1755 --StartWorkstation --ReadyEvent e8d0cd3a-980d-11f1-8000-0000000000002⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe"C:\Program Files\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe" -n --ListenEndpointHost localhost --ListenEndpointPort 1755 --ReadyEvent e9559b8c-980d-11f1-8000-0000000000003⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4560
-
-
C:\Program Files\Novosoft\Handy Backup 7\BackupNotifyService.exe"C:\Program Files\Novosoft\Handy Backup 7\BackupNotifyService.exe" -n --CoordinatorHost "localhost" --CoordinatorPort "1755" --ListenEndpointHost "localhost" --HostNameInIOR "localhost" --ReadyEvent e9559b8c-980d-11f1-8000-0000000000003⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060
-
-
C:\Program Files\Novosoft\Handy Backup 7\ws64\BackupWorkstation.exe"C:\Program Files\Novosoft\Handy Backup 7\ws64\BackupWorkstation.exe" -n --CoordinatorHost "localhost" --CoordinatorPort "1755" --HostNameInIOR "localhost" --ReadyEvent e9559b8c-980d-11f1-8000-000000000000 --ShutdownEvent e9559b8c-980d-11f1-8001-0000000000003⤵
- Executes dropped EXE
PID:4704
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{4E14FBA2-2E22-11D1-9964-00C04FBBB345}1⤵
- System Location Discovery: System Language Discovery
PID:3312
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Novosoft\Handy Backup 7\ACE.dll
- Size 1.2MB
- SHA256 aefc63068a77b119fbdbbc849afe83d5efb09fa681c092ad7c8dab1498ec894b
- MD5 c4f0e0e9be35def8d64ff720042729e8
- SHA1 b6f12289465975f2577557fe9d996ab9ea18ba63
- SHA512 b21ed89a076efc52907c0cd652abf591848cda4744a72801669bf6f8f60f17d1d2e3147cc2c12cf1b634445fc2a78b9a178fca1b278d261bfab811b01943fcda
- SSDEEP 24576:OcVKI80IeS4BOK+ZA8RYI/iHRGp4pm94ey4bRgUAl:7VxtS4BNRXU4evbRgU6
- TLSH T17A455B14B9AE8267E68AA2F14DBD772B4C7D8541073C8BC3610DDB1C18902E76FB7A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\BackupClient.exe
- Size 3.0MB
- SHA256 9bddff99ad4b8e9e1ae2b9728c88cc6cb6b42dfb12acacfb8545056d00d20573
- MD5 cdcfec51506179bfc2a696f2d0098edc
- SHA1 4b537ff9021f579179af22653bd8425a52e69f6d
- SHA512 81b4e2dadedb04b28ca4afa92285ebba192a73b655d21845c3cf6e005ca1640281b1aa098127b9e5a53a84f83bb024e82d15c6a4b633654094a8190c4703f23c
- SSDEEP 49152:/9MwhYqSGVI8QgvbUvQ7APPBPZ8OUojY5wo5VxWbamt5wNoSKoRBBJD5kUqQPvfT:/9YqUvQ7A3BPZ+ojY5wo5VxWbaQ5wNbO
- TLSH T162E58D267A81C4B6E2731379886CB35892EDBDF15B3454C7D588361D1BB0CE3A934B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe
- Size 53KB
- SHA256 b4be5476eda023c1a66d56a171c5560d8727b17b0060f49156705c8bec893ce2
- MD5 24695ceeda628bf15b584a3a1a26963f
- SHA1 9e22c365d16e32ba280b2b381f453ea406100eb5
- SHA512 ba1b344277a80297e30a98f79ec3031326a55fe395c3a6273f282e7da82efc1af4f73469e799af8cfdb8e1416ce7204e0bea2c40f990a24af14682f111a101f1
- SSDEEP 1536:Go71iU8XSKJFPNVQUGQjqiJMQUOE8s4Gh:NwE+VVQUGQjT2QUOE8s
- TLSH T154331A233A9BC573E1A219B04D39934E917BB9730BB162CBB2C98A7D08B03D11D3525F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\BackupNotifyService.exe
- Size 62KB
- SHA256 01fb0468f3b82f176ae8da9bc2942b33ee3002276a5900ae88d11964c5d186a4
- MD5 d13a61770c0cd5bdca91faae41804635
- SHA1 9636f0f1fcf6ec9b3065d7c74269c33789e010d9
- SHA512 4a56f9fc4ec95192cd3dfd46da150c7103bbf1d6c68f8a7ef1647774676bc28c107be79c0716d2961d1bef106e1ae1225ce3d755550807700e216907674cfb9b
- SSDEEP 1536:zkciia9An2XMq+PmxFY5OAVvm6IpdS/KTzNQCN6iAsDGhG:/a9ASMruxFCOAVvm6IpdS/KTzNQCNDAs
- TLSH T14C53F70373EA8161E0FA2AB4583643598A7BBC72577593CF6240F96E1C70BD08D75B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\BackupServer.exe
- Size 2.5MB
- SHA256 e92e140f08ef9134e40ffd459378bf9bd2423e73b5a71a532e077f5be0142033
- MD5 1a08377a1bdc1b666d35457931488e21
- SHA1 983e673ecc608befc77de3971753cc4a8a8b212c
- SHA512 ea389216c62c6a6cf32d1c6600026bb5b6d229816929497ebaa2280a8aed576a6bf37d19a1685f98254e13cf3b6b57fa84e516563ada0b57b0e2a336dc1fc34d
- SSDEEP 49152:DYEwciNgDC8GAjpGocsHdAEUDsPuw5afZUrUaSVTqnMLJsk5sqAjZuMv0rn2rCR1:PHNBPuw52ZUrlznMLKkdgZJ
- TLSH T12EC55B39BF55C23AEAC211B28A7CAB5F503DD891076D45C3D28C0E9E1DA46D32E3791B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\Customizes\English.xml
- Size 124KB
- SHA256 abccb0fb795b7ef245d0c69592fa1242ea43f211249c78d20558e77e7e49a306
- MD5 07339329d2679a36fc0759a7abaa69a3
- SHA1 aae9e839771babf34dc739dc9402b648a4bb6ec6
- SHA512 72f49cc67e703bc5c0abcdc21dbcc6e2be99676a37e74cd0064b3568b84c5978a456498d58e057c3e7a82173b35d4f272766fa9d808a61a0366195fb16d0a656
- SSDEEP 3072:jbjls8riuXpOrFHJBKykZbkqw8JBspDdzYV1:28rq/ktksI3zY1
- TLSH T141C3BA0912BCA61A8D722016F5F801A8A92DA1DF437702F1F9DF711AAB6CC364377977
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\Customizes\default.cmz
- Size 128KB
- SHA256 0b0b7e7924448c4a33b969d55b064dfb26396e041fc47d15357ed0933484ccdc
- MD5 cb355df34df1acd0034ef57b10cace92
- SHA1 53f482fa42066076c8eb07a4c91fe9c031aecbe2
- SHA512 b5f017ba59458dfa7b78dfdf3aafe9c8e20554f7cd55eb13f0e00c90d2af0d55aa185c433945cb84064d9518c23253e43926ad2d72692f57f12a3bc95b19a6a6
- SSDEEP 3072:piuliWB7Pzx4zQlq6XceYUYzOuFqAA0P00:r8WBjzxd06Xce6Od0
- TLSH T100D33B5DB3A97675B30144AD2A46CD330F433A25087BBBA5F5628FBD5E708C9182C86F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\HBLib.dll
- Size 333KB
- SHA256 719962fca09707fb49ead8b26747a9136a1f4a45057cadefc66f7544ffbac0f7
- MD5 6f510d7e24f7c40b60194bf30aacccbd
- SHA1 ea36f8d785e16f3fbcf74ebe6ce60b9bb8837388
- SHA512 f98e1237571261b54d1ed3557c48c9a108e39e50d272f8a076e88858d9e44fa857f1c06b1732514c9b2ccbc22b8c1551b12f2c9f9975ae7791a82eb85c2a8959
- SSDEEP 6144:+YNVnSwmfrWdJzhU+cVvP5LGY7P+n25mqcMqE8674PCxOtni6F+Y7kLyyVOBuomI:+YNVwW3z2GC+vuqZ64CxOM6F+Y7w+BIr
- TLSH T1A8748D51FB46C237ECCD22F16DBE9BAF04BDA99047B442C3E3C8964D5E611D22A32257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\HTMLayout.dll
- Size 923KB
- SHA256 d5bfe462e7a8dad17c2c75cc792560542b30669027bad14c5445cf5b3162e7ff
- MD5 4de473ddae8d71ab9e3ffdb0b50c9c69
- SHA1 872ee2acdbdb2292c8fa90126b69cf8d10fdcaa7
- SHA512 f2c07da7c7767220ea51842478cb351c187800a3d1fba68ca066df77c872a11cc2570c058416d950dc38c928542653b967636d28cbf015241e28d6a43ff79cc8
- SSDEEP 24576:r7uEnBTjt8yeGY0WDEHeYioYQDFWKzvXUZ0/JCC:jt8ye4O6eaJEa/J
- TLSH T11D15337CFC02365AE8AB213175B86C863C73DC317B991B942D57521F1870B6DBB40ABA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO.dll
- Size 1.0MB
- SHA256 e720e1b812de0068b75874f881bee8244be826d69054ef1d7a2091bf35ef3a8f
- MD5 837c0205ba36398b429d383e34bc20db
- SHA1 3d6a372800b0067eb9b817053b53e8e2fe3a089c
- SHA512 ba8ac2b9d4a64dce5404097a9351cc5aace33506ec3b569619348d50cb6e4bc6018871cfb92de2c12751475c9b59c616f2e06ff60c77415a218fd8ba27a9ab80
- SSDEEP 12288:bppB7u4aM6/WlTPNxiQ+rkOghf8iQLYaMcGJpFxZ/M6efk:bHB7u21Lp0TLYjFxZ/M6es
- TLSH T121354D62F7BA4329F5CAE2705C7D1766507EAC461738EAC7B11CCA5919B02CA0F3A317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_AnyTypeCode.dll
- Size 418KB
- SHA256 07edec485860b78006096067bb4b1340f6dbff0ca637c72ea32e3f1573e78a76
- MD5 8846d72c2c76bee4d24698bfa6f66f0c
- SHA1 9e1c6842db3df487b45356f852990001df74b64a
- SHA512 9de6e32f2d937a2346d8ae41b54c2429ef5dcbd5c73b84d7922dc2f2b3cc218c9c78404c3f09c300e91c60d51071cfba03345a35e8772c6f8cb8314213c5719d
- SSDEEP 6144:RJjKcVRfwlzIXpWpnERWspz1uezx2XP8QOZ+k7qWWK30tdAZtfhc3r5KPE8:DjfyzAWpnERD11ueF2X1LdCd
- TLSH T14A940973BABD87AADFCC50386DB84B2A109EAC9517D5E6C7E64C516B08D34C31D3432A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_BiDirGIOP.dll
- Size 32KB
- SHA256 d7ff36f148c83381d6e67db22a63a50539eee464e69168ca576f18013fb5781f
- MD5 6a64f032a89acec2780258463fd54011
- SHA1 bac163382af37cb3a1dcd4ef8c375e3d4cfe35a1
- SHA512 e0a7abf46875edfd5f53a426329cc371fe64418c4ef14a09457c27a6e307448bdbdadfa443c7f364f30307bedb4c07710e911b832e6478dc7e1eb40334b31808
- SSDEEP 384:F+M4ruR4Wt1vYxzG/T2QFZzNZq+py4b3PyjSv7IBqz4NPx7su7tx1HYRBHTvACOt:F+GvL4+A4jPyjc7g7zbNCOZhdDDDWIB
- TLSH T1A0E2F812BA6ED7B3D1CA50751913935280ADBD3227E591D78FC6876D1CB83CA8E36343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CodecFactory.dll
- Size 51KB
- SHA256 cdaeba670ff57d8132a128168ec5f13fd7ffee6255a2f9f08300eb21c6fd4a45
- MD5 acb9a04ae6fe435220e38914cdb766e8
- SHA1 4cf322a861b5f6ad8bf82a4637a82ea3e8d18050
- SHA512 f4c9eed074f805988b34a1e2886a8a1ba86e424384f463179430982e1c0d9de65f77cc672efda5207431df57ca0e5c203be18ab602c85184a3657c371a5427a6
- SSDEEP 1536:U5DoAXgLAyf/UoAJSMtwyxRexyOZh6OK:KocgUyHUoAJSMtwyxRexyOZh6OK
- TLSH T1D4330922AA7B81B1E34A50753C659F3E409DDC7507E4B2CFDD19C2A61CA03CA887D76B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosEvent.dll
- Size 203KB
- SHA256 00bf275529bdce3b496c8921ef1629afc0284b0d13271a9eaf69d8534dde9cf4
- MD5 2d244f1e45b4ace963d385f78953b35d
- SHA1 129e4286dfc28e88cfbb469b1cb4c1ce63811683
- SHA512 0514ea148b3f850d7e5d088b3e1cd57c6b48fd242d0d12a4eb54c6602b8bec952997e13106b8d79d3bd99a0354385b8f79ddfee43590dd957b25aab63c06b25a
- SSDEEP 6144:wmqNWqGPqUfqUqEq4qcgXxgdkgmnalqQqjqgqReHKFgvUGTzmqj6q/qenqssqZqp:wmqNWqGPqUfqUqEq4qBgdkgmnalqQqjo
- TLSH T1821497A2F6258378D0CE303C1AFA879A411B69F2DB9E99CFED089D4460A15C30D7E747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosEvent_Skel.dll
- Size 204KB
- SHA256 b5f978c622c94e13404d2b70d95c4acd8d3de937d6f0e56acdd944562b2eaf62
- MD5 541fa46d150c2b76cef718c28041333d
- SHA1 eb04f085c7d910db304d257bd89eda3f51b43c88
- SHA512 71daf5a62ef11321c2e378d499be9bec5c3eb7b983188910eef5e08cedc2b85b097be8d9dc5484e2ba161540ed9d374354021e40cb937a0155b241a83e5eed2b
- SSDEEP 1536:A9Ew/R9bEGn9PoSu9qFjvCe9itrdrT9aVzQNMW9FU+QIG9q9jf9GWAB9ty0sZ9hi:QNAtLwZhUr83ToQXLsPROZzGLQA5VDO
- TLSH T131246322AE5A42B4C0CE303C06FED7DA832F16E1E79A65DBFD049D66A0615C34C7A647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosNaming.dll
- Size 119KB
- SHA256 ba684b79641ae765b8d57f741c2b28c65f90b9abcc199f883da04bc192486c2f
- MD5 fa308f636f17c7c8a03da42816602fee
- SHA1 9a0e004b3af86284a078f25c9c9b5997046aecb2
- SHA512 6ef9b40444bb04cf08fad4fbb8ece3d5faa004a8cc34732a752e6c9ecda4206890d808a872ef45758318f930125e94e344c5ae65ebc088cd67780f3314a0bcce
- SSDEEP 3072:m61vWmWldAWPpWB6kZSIvc7PavLyHOZXB0Sozr:1WmWrAWBCwZOZx/W
- TLSH T17CC3C323763983FDF68A40706864871A124E54308FE9C6EF9F0E1E6E19E12E35D79357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosNotification.dll
- Size 684KB
- SHA256 eab316533a163fd8fb790faebfb65f9ac9ccace9a7fd4d0d71b21758ceb5ec96
- MD5 9fc08052225274d97f67d744691ec2a1
- SHA1 353ee32942d72cd7f6bb7a89198d11651f223ea4
- SHA512 95190375e1773779954c4c8e268821338491732ea476f57d71e2cb3d807f9f8030a2f1913be0e404b3714b368ea7e766e9f0f7ac2719b30ea83006f5b4fd0c60
- SSDEEP 12288:Tm9mCXXD5GLmRGkm0vaXmFm1Vm4mkpFmo2zmo9mDompymcFm2mdm1m+m+/mAmOZl:cXTTgNyT
- TLSH T176E41666FA2AC37AF5CDB034A970D74E415EA4F0572A90C3F74D866588622C38B3D71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_CosNotification_Skel.dll
- Size 486KB
- SHA256 0d3d562c7ae15835c82728c7fb0b27e7fce64171f2e52db8f48c9180dde846b2
- MD5 ca11ab17611f68d96cae058a5faf6fc3
- SHA1 487b5646cdf1973763cde2bee6028f0e7caa4f0b
- SHA512 6ebba7daf27011548ca29db831e1442b429823a57ce784726126c10bc156c66b3441aaad9f025934df077c9135bc2197d5bec653a52401d830ef8b6c720498fd
- SSDEEP 6144:TZj8n8dc2B8wkk6Fc/VLX0o/zPOZ/5WX:TZj8n8dc2B8wkuVYo/
- TLSH T117B49565EA5AC7A9C6CE7038D5B9C78A832E66D563D5C1C3A705CC36E0A31C3DD3A10B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_PI.dll
- Size 136KB
- SHA256 99afb35eed2d4cb1c0fb976a1c9395979dd90705e86099cc474fae66bfe5e815
- MD5 32e8a369673739db0c01429be6346d2e
- SHA1 33973583cef5b5448498ea25e750a0c57a308ab5
- SHA512 ec512465908bfc0764a811d72165ede7f69ec0e67287b231193e6660bf47d277bd6eacae6992134bcebb5d9b2b84386659ff823f733cd087bae34c8e9bdc01d1
- SSDEEP 3072:MK+jen+2vLgo4W4AXHPDE+1iGfrpxKMOid5KxaVOfCLqezJ:p+jen+2vLgo4W4AXHreoLdtOfCLqez
- TLSH T1A3D3E7933E2F867ED1CED1700834836648C6A9D15B94E4D3CF8B875958FA2D38EB5386
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\TAO_PortableServer.dll
- Size 497KB
- SHA256 0e31c1f2c3b3db5c636b135cda1b3526f73e4144919447aaffdd72b8cece7979
- MD5 c9710361031df3d8fa2182fd9c5c1cae
- SHA1 b2d19c8f9d573dfa47427a231fc8fa2e29a2c505
- SHA512 f4cebd11ba5eacb8721bcb7e3bb73c59b590b363b10adb980d997900a17fc5396ab9a29337cd24708c5fece0a14583189519791f31691b863fa475367dfe9f62
- SSDEEP 6144:8X97P60ICKP4TOqXYOBYf4xTi8PzKOZO0j5M4RhHkPpFFUTPB:8X97C0ICO51bIKFyTp
- TLSH T19FB41B31EF2FD669C6CE82346C38C79D814D6A811798E5D3CB4DCA2E24971C74B3A663
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\hbcc.exe
- Size 434KB
- SHA256 dc5cf8fa4d099422c5b74d3327f21f89885b85b0e010893ea283bfe0920551ef
- MD5 95310966c2d92e884a4fa4d7d5913d62
- SHA1 f36c6785a85681c43c79b374aa389c52426d97b6
- SHA512 bafb0259e3aa36286ea48646ac7787723f8fc2a02868662c796d2fc9f32ff871a99d9efc50e63ec8d023501252b79ad0a5a1b4323699f2378d9c9b9623c088ce
- SSDEEP 12288:lUJLU0UHWUbUKUeUZU0U8U3U+UoUmUPUbUrU3U/U+Hym5fQCvOCTkyqe:uHym5fQC1R
- TLSH T153943971AB14C135E5E311798F39AB7F142EAC512B7466C3E2DC2A9D0CB52C25D3AB0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Novosoft\Handy Backup 7\res.dll
- Size 912KB
- SHA256 dba88c5d014ee921b0b09b8153ebbaaf29a98bb788f3360177cc2f7a3381ce72
- MD5 71cefa04fba341946a68097a7b4e0c43
- SHA1 e97b3ca5e3c668b4325daa031f5b7d6b7ce5ef6f
- SHA512 cbf734da13b8933a5742eeced47618c4e695b80c3d081daf9b10838f1249861f7d3ef00f35fa4180cc82b2b0305a76b0e871445ce185beb20b9242f703c2892d
- SSDEEP 12288:Reu+4OtYezm8/8YNVY+wtmdkd19RXa7TWzc:RD+p7J8wi+wtmdkd1S7
- TLSH T1A8154B95CC0C8F5DD2A8F2F4921ECD2951297C10B354E23E5A74B908E6B33996EE1BDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Novosoft\Handy Backup 7\Settings\Services\workstation.hbl
- Size 555B
- SHA256 7997de407771cca5f6fb5fdb79f7b1de89be9a32a0552913202a95300023f722
- MD5 0a264f4d36d493da24dbba21ff5a5511
- SHA1 a5f29fd9f7507a5bd469f918e8a9f1e80f36f769
- SHA512 f013091935c8ed37091767c69644609cb9e077df17749c3169a53075909dd26431af96cd06968ef5c204d071404320fefa6915a2b8afcfc8105453a86e386b2f
- TLSH T147F06230B962DF11D707533B8EB3B884B11648693119781054DFAC7BA25D2F95F4CD28
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Novosoft\Handy Backup 7\Settings\Services\server.hbl
- Size 2KB
- SHA256 1dd5bc0e76d8d8d36c0625cfb2e5ad877bb330dfa69f462b00cf366d217c7ec4
- MD5 74780633806b9acf26afd3f2aafc7d72
- SHA1 ca6491296c5fddc1fca52500a38a90e5758badc2
- SHA512 2111f83c2a651192d7534c5556401f454d4ee6e8dea3a419ee293acbe906d7b6502fa6088355ecbcae16f4f80a502a4588d87b76d7666889bbedc312cad1123d
- TLSH T1F351E8C4FD474A626A16AAC5EFD40D8BE319C5B91270643930FFBE45196F0E8682A37C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSID603.tmp
- Size 148KB
- SHA256 fa9b83479f1b955790325dc557624185a8c72df3e31870dae075437146858185
- MD5 14c01c848d8452005734858a64b6784b
- SHA1 d3d81fcd1267095880218ef09b92220248905ea8
- SHA512 8334c467c470c13b0245425d3bc1ba9676a04e1e015bec56122504d622e7e3858d5ad7950d09c155f3666a90b7d3c7b40f324d0786553d6e81711b7f38cf1d57
- SSDEEP 1536:LJBXpE+chXzGFcvDKeQlWe+LTwhT06Ua/782ix4UjAr628r4TbmMOI5IJhb6+I1v:1FpEPXElP22c4GusR6ZKX1PJEQ7+kQ+
- TLSH T1CDE38F327085D175F2A218B7E96AC2719D3DF1280B2085CD5B828D9FAD28496BFF7703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID886.tmp
- Size 75KB
- SHA256 2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
- MD5 6f8e3e4f72620bddc633f0175f47161e
- SHA1 53ed75a208cc84f1a065e9e4ece356371cac0341
- SHA512 80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
- SSDEEP 1536:xsPAv1yiUHmByZXTN5GCOPRj15+3rT0q6Mnu:x0AvSXTNOtHKTZ6
- TLSH T182737C2172A1C176D1A66436F629C2721E3EB5302BA488CBBB5607BE4E302D1F677307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID933.tmp
- Size 214KB
- SHA256 ad05944fa5131b64195bc7559430e432043667b9543e8ee12d33149eb0a89ea2
- MD5 ac4d31769f20a0b733364025dc59863d
- SHA1 fe6eed010561c46d8bc7ac9d51a73262c1b5d2a7
- SHA512 e11d221fb76fdf03b97141740dc0c75b0b2c27514164df800c0e92c5cf689663b51ff650aad959e762461c63f39d8e7cbc0842260d7266a2e0fd99ec6fca8574
- SSDEEP 3072:XnEW8d3zdIgMYSBbL5a4jWt44dD7phQC1+avKQ6Z:j8d3ZYL/WtndD7PnY
- TLSH T1CB2439307660543DD5B149F2F719C5B0AE3DF1185BA088AE97B58E4E2C2C896BBF7306
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mfc100enu.dll
- Size 53KB
- SHA256 d71db839de0bc1fcc01a125d57ced2aaea3f444a992426c316ce18c267c33a8c
- MD5 2a2c442f00b45e01d4c882eea69a01bc
- SHA1 85145f0f784d3a4efa569deb77b54308a1a21b92
- SHA512 f18d9019eee843d707aa307714a15207be2ded2eceab518599fbed8a3826a1a56f815fe75fb37f36c93be13f3d90e025f790db6b3ba413bfd5cd040b2cc7dbf7
- SSDEEP 768:TgIdijcuEhCgysM6B1CLPLNq5f/nWHBNheOU2fd51b6FjpvU:kI0ifysM6B8PLNYf/nWHNTdr6F5U
- TLSH T19E33626263FD8605F6F77B752EB546605E36BCA2AD38CA0E1640614E0932F50DEA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mfc100u.dll
- Size 4.2MB
- SHA256 bc50848aeef466dff4a3d8c386bf0d0ec35b8e5b438031ae885aa5371f2e1a42
- MD5 f3de10aabd5c7a1a186c9966f037d0c0
- SHA1 6aaae8331a5377f4025d2d860e5872b842a41df8
- SHA512 07d93b8abbf8acfab1d8f0711a37086764000310450ba361e7d5e1369012b3a45fd394460841b0f3cca79acead2080bbe1f029bc36191c133d7ccea182ca84e1
- SSDEEP 98304:veeKejRb6KYYRzl1rYBrAWpTmms3Ctm8oVXK0na6g3QAt1zwoN1R4FLOAkGkzdnr:v8NpL84jN1eFLOyomFHKnPAu
- TLSH T138268D217EC951B5CDD722B0069D7679922EECE4273006D352943BEFE8783C16E385AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\msvcp100.dll
- Size 411KB
- SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
- MD5 bc83108b18756547013ed443b8cdb31b
- SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
- SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
- SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
- TLSH T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH