Analysis
-
max time kernel
152s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
01-10-2022 19:29
General
-
Target
3f4ffeb44a1db73b183f339ac6c405ff9800df2c5398e4f244c90e68c01041ce.exe
-
Size
72KB
-
MD5
60d0357391a611b13a230cbb3a3533dc
-
SHA1
94e02260ec1fd20c05c92c10a12516d0df92e2bd
-
SHA256
3f4ffeb44a1db73b183f339ac6c405ff9800df2c5398e4f244c90e68c01041ce
-
SHA512
92c2039405be82327b0d8a05216cc43155da537c9a38c314c6773d292dcbcfe562b88b394e6d8f439a0c5ab083e3c56f65d4f42bbd83f6ed0df2722f39c5be7a
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2s:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrQ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Disables RegEdit via registry modification 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f4ffeb44a1db73b183f339ac6c405ff9800df2c5398e4f244c90e68c01041ce.exe"C:\Users\Admin\AppData\Local\Temp\3f4ffeb44a1db73b183f339ac6c405ff9800df2c5398e4f244c90e68c01041ce.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1588059977\backup.exeC:\Users\Admin\AppData\Local\Temp\1588059977\backup.exe C:\Users\Admin\AppData\Local\Temp\1588059977\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\update.exe"C:\Program Files\Common Files\update.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\update.exe"C:\Program Files\Common Files\Microsoft Shared\update.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\System\ado\de-DE\update.exe"C:\Program Files\Common Files\System\ado\de-DE\update.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
-
-
C:\Program Files\Common Files\System\ado\it-IT\data.exe"C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
-
C:\Program Files\Common Files\System\es-ES\data.exe"C:\Program Files\Common Files\System\es-ES\data.exe" C:\Program Files\Common Files\System\es-ES\7⤵
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\ja-JP\data.exe"C:\Program Files\DVD Maker\ja-JP\data.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- System policy modification
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
-
-
C:\Program Files\Reference Assemblies\update.exe"C:\Program Files\Reference Assemblies\update.exe" C:\Program Files\Reference Assemblies\5⤵
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
-
-
-
-
C:\Program Files (x86)\Common Files\data.exe"C:\Program Files (x86)\Common Files\data.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\data.exe"C:\Program Files (x86)\Common Files\SpeechEngines\data.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Disables RegEdit via registry modification
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5ab6264ff4946fcca3632f006a8a3d961
SHA165b30e4a692cd7c299b6a859cfed71da82a11935
SHA25619b16010de3979d94000784047f2dbdc6a4f6ad1e638a90fcfa38ee2b7a6747e
SHA51298ca2ded8111e5669ddc704a058c0532dee82b13af9de828dd32c78d6c7856643953e9dffde94b48d82f385c546ec8bb57a3f13f489dca91f95a42d47c6109d2
-
Filesize
72KB
MD51338f84b38774f8a5ff7b804bfbb63f0
SHA1a5376755d4f3a4a57b4d7ba7730a20744ca128d2
SHA25608307327a055011fbb67c54a025909476b454002a0ac09e3e98ca5d00de9321e
SHA5120719a170ad87a5ff0ab18a1cc0ce3ac487b976abc300d6c0059a01ac928cb990f39f4b9862d8b129f734aa91a30c1cb1682734daed00beee8da99a9aead6edbe
-
Filesize
72KB
MD51338f84b38774f8a5ff7b804bfbb63f0
SHA1a5376755d4f3a4a57b4d7ba7730a20744ca128d2
SHA25608307327a055011fbb67c54a025909476b454002a0ac09e3e98ca5d00de9321e
SHA5120719a170ad87a5ff0ab18a1cc0ce3ac487b976abc300d6c0059a01ac928cb990f39f4b9862d8b129f734aa91a30c1cb1682734daed00beee8da99a9aead6edbe
-
Filesize
72KB
MD5f553d81cb496fa2ad3d925d0769c00f6
SHA1c9594cd26912773791c0128bc815d3bd00309832
SHA2569b1de6d7f6136b31902f5e5a0b8329acc91f11df973f84dfff11235c20f61f3d
SHA51220d5b3791bb6f5f41d9e7c7607f68e0f77bd59f9bc6b10920d547e9d11b51cbaa2b1f615b71cb9b2c2af4796fdb51b5f0fd664e914b977230649f552dfb7af1d
-
Filesize
72KB
MD56128469007960d98b1604afd9f564cb6
SHA1b662cb2130d21be8a60b52a5d21cc3bca9b1fe0b
SHA256e91d65301c88a0c88098477b9d0abd82f4e556897f816fb414f4d03d85423295
SHA51230c4f8d79156004f3143fea00f5f82aa148f41d708ca71f3fd5a8cfaafd5d6a83e966cc4fd1fdf819db309b49c848a4303880b02be489240edf54a546910ff9c
-
Filesize
72KB
MD56128469007960d98b1604afd9f564cb6
SHA1b662cb2130d21be8a60b52a5d21cc3bca9b1fe0b
SHA256e91d65301c88a0c88098477b9d0abd82f4e556897f816fb414f4d03d85423295
SHA51230c4f8d79156004f3143fea00f5f82aa148f41d708ca71f3fd5a8cfaafd5d6a83e966cc4fd1fdf819db309b49c848a4303880b02be489240edf54a546910ff9c
-
Filesize
72KB
MD54476e2f6edcecf4af7300bdba5e40327
SHA10fedd17f92b056d5d71e1c46d432467719780a79
SHA2565c76e3431311d4326907438f2bdb453e518308bfa603de7ca49c92a667ea0ad6
SHA512cddaf41f54f53469533c1cd0be709c16515eae18d7915fb20c2bfc6a93d4496878f691c88fd1a4ca88d5155caf49fc983d84746b94d8e23fea6be7ea53f3fd0a
-
Filesize
72KB
MD54476e2f6edcecf4af7300bdba5e40327
SHA10fedd17f92b056d5d71e1c46d432467719780a79
SHA2565c76e3431311d4326907438f2bdb453e518308bfa603de7ca49c92a667ea0ad6
SHA512cddaf41f54f53469533c1cd0be709c16515eae18d7915fb20c2bfc6a93d4496878f691c88fd1a4ca88d5155caf49fc983d84746b94d8e23fea6be7ea53f3fd0a
-
Filesize
72KB
MD5fb53bc50e945d5e434d3ec54dfc011f9
SHA14ac5ed6746d5a80ffb05a488d750144f75dc33dc
SHA256e6f4255ce2bc25c760f77e89c27a5b011e5d1b2456fcb2697c0ae1b53c78680d
SHA512b8c5d41e6aa1587fcde24dee130ef9c6ecad3c9c0d8e0aa4b654c3f027e49c290f54a98cc2ce83c91431d7b513d713b2d2b0fbfb29814ef47e3904a7537f07c7
-
Filesize
72KB
MD5e02fc77d31691dade1f69e0301830868
SHA171a1ebf3b9b5a6289616f29fa13532c1ee9b7647
SHA256cbdba192764c01c7920fa4de1020583797e43358ff1ef6ce9fd3ed02aee04e4f
SHA512ed94d4b3042fb56139d4046bdbbaf7732cf06b4daf133d59c9f76ff059cff138069fc10edf00b815929c137f479fcc98ee330e7e1df72ff8a272b0370139124d
-
Filesize
72KB
MD5e02fc77d31691dade1f69e0301830868
SHA171a1ebf3b9b5a6289616f29fa13532c1ee9b7647
SHA256cbdba192764c01c7920fa4de1020583797e43358ff1ef6ce9fd3ed02aee04e4f
SHA512ed94d4b3042fb56139d4046bdbbaf7732cf06b4daf133d59c9f76ff059cff138069fc10edf00b815929c137f479fcc98ee330e7e1df72ff8a272b0370139124d
-
Filesize
72KB
MD50627acda546feb19c588c39c0d5e5805
SHA10daae6d61c3bc39f8776f0bdf4de223c3b42495f
SHA25630b2a4847e2f4006fadd7ffffa34388641a92c9014ef63bcedc20697bdebe2c7
SHA512462f786280a0354a3f7942beeb35bc4d3d702de03175f2e26a15cfdeeced4a5ac71214cca92e33df96d0fd73edd726e8fb2eb09eca5e68bd64db1f2f8a549e52
-
Filesize
72KB
MD50627acda546feb19c588c39c0d5e5805
SHA10daae6d61c3bc39f8776f0bdf4de223c3b42495f
SHA25630b2a4847e2f4006fadd7ffffa34388641a92c9014ef63bcedc20697bdebe2c7
SHA512462f786280a0354a3f7942beeb35bc4d3d702de03175f2e26a15cfdeeced4a5ac71214cca92e33df96d0fd73edd726e8fb2eb09eca5e68bd64db1f2f8a549e52
-
Filesize
72KB
MD52ad4c796657bbc85dcbc86da770fa4ff
SHA1c10ce2112dec3d9fee79e8b2409f9a706f0316d0
SHA25667d36343f42998fae637bcdef0dc9b2334799087306f2d52b60d9b1e3450dbda
SHA51267e097582a00b36387bd3fc969a763c3b5871642363522cf07d09a2765112dc289626c08c91d4d27186c751933ac8beac9532c484272188f092037973b606939
-
Filesize
72KB
MD52ad4c796657bbc85dcbc86da770fa4ff
SHA1c10ce2112dec3d9fee79e8b2409f9a706f0316d0
SHA25667d36343f42998fae637bcdef0dc9b2334799087306f2d52b60d9b1e3450dbda
SHA51267e097582a00b36387bd3fc969a763c3b5871642363522cf07d09a2765112dc289626c08c91d4d27186c751933ac8beac9532c484272188f092037973b606939
-
Filesize
72KB
MD518e4e7736c62709bca3669d3b48b9355
SHA1ecec9a687c27f6296c088f6abc0c265124072839
SHA25611be00893b51130fb4c70db5d000fca6368e414a801afa4266749d3e47cd2b82
SHA5128f6c207452afb78c32124d30971a0278affe092e7861291eefe8f02a40c789994872a370d9eaaabf0e16ae3562a71021b8c3ff33b9d84350decf871f917b84fd
-
Filesize
72KB
MD518e4e7736c62709bca3669d3b48b9355
SHA1ecec9a687c27f6296c088f6abc0c265124072839
SHA25611be00893b51130fb4c70db5d000fca6368e414a801afa4266749d3e47cd2b82
SHA5128f6c207452afb78c32124d30971a0278affe092e7861291eefe8f02a40c789994872a370d9eaaabf0e16ae3562a71021b8c3ff33b9d84350decf871f917b84fd
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD57174f28892370d698c35ae5734d2c6be
SHA1ea9b4d96c32f2e9480c2e39bff34f6693e2813be
SHA256a35bfdaf5972d979b591f6b5375fe0396f3e1b08f1d08927e587e1356d4954e5
SHA5120692a94cbc07144b910d48238e1ab811e89cfce370cc9d694179d151b8abc231569a9af0ed8d8c037af3ba929065f74b3c6fbe60a0a7f1f192346b38a87e38c9
-
Filesize
72KB
MD57174f28892370d698c35ae5734d2c6be
SHA1ea9b4d96c32f2e9480c2e39bff34f6693e2813be
SHA256a35bfdaf5972d979b591f6b5375fe0396f3e1b08f1d08927e587e1356d4954e5
SHA5120692a94cbc07144b910d48238e1ab811e89cfce370cc9d694179d151b8abc231569a9af0ed8d8c037af3ba929065f74b3c6fbe60a0a7f1f192346b38a87e38c9
-
Filesize
72KB
MD5ab6264ff4946fcca3632f006a8a3d961
SHA165b30e4a692cd7c299b6a859cfed71da82a11935
SHA25619b16010de3979d94000784047f2dbdc6a4f6ad1e638a90fcfa38ee2b7a6747e
SHA51298ca2ded8111e5669ddc704a058c0532dee82b13af9de828dd32c78d6c7856643953e9dffde94b48d82f385c546ec8bb57a3f13f489dca91f95a42d47c6109d2
-
Filesize
72KB
MD5ab6264ff4946fcca3632f006a8a3d961
SHA165b30e4a692cd7c299b6a859cfed71da82a11935
SHA25619b16010de3979d94000784047f2dbdc6a4f6ad1e638a90fcfa38ee2b7a6747e
SHA51298ca2ded8111e5669ddc704a058c0532dee82b13af9de828dd32c78d6c7856643953e9dffde94b48d82f385c546ec8bb57a3f13f489dca91f95a42d47c6109d2
-
Filesize
72KB
MD51338f84b38774f8a5ff7b804bfbb63f0
SHA1a5376755d4f3a4a57b4d7ba7730a20744ca128d2
SHA25608307327a055011fbb67c54a025909476b454002a0ac09e3e98ca5d00de9321e
SHA5120719a170ad87a5ff0ab18a1cc0ce3ac487b976abc300d6c0059a01ac928cb990f39f4b9862d8b129f734aa91a30c1cb1682734daed00beee8da99a9aead6edbe
-
Filesize
72KB
MD51338f84b38774f8a5ff7b804bfbb63f0
SHA1a5376755d4f3a4a57b4d7ba7730a20744ca128d2
SHA25608307327a055011fbb67c54a025909476b454002a0ac09e3e98ca5d00de9321e
SHA5120719a170ad87a5ff0ab18a1cc0ce3ac487b976abc300d6c0059a01ac928cb990f39f4b9862d8b129f734aa91a30c1cb1682734daed00beee8da99a9aead6edbe
-
Filesize
72KB
MD5f553d81cb496fa2ad3d925d0769c00f6
SHA1c9594cd26912773791c0128bc815d3bd00309832
SHA2569b1de6d7f6136b31902f5e5a0b8329acc91f11df973f84dfff11235c20f61f3d
SHA51220d5b3791bb6f5f41d9e7c7607f68e0f77bd59f9bc6b10920d547e9d11b51cbaa2b1f615b71cb9b2c2af4796fdb51b5f0fd664e914b977230649f552dfb7af1d
-
Filesize
72KB
MD5f553d81cb496fa2ad3d925d0769c00f6
SHA1c9594cd26912773791c0128bc815d3bd00309832
SHA2569b1de6d7f6136b31902f5e5a0b8329acc91f11df973f84dfff11235c20f61f3d
SHA51220d5b3791bb6f5f41d9e7c7607f68e0f77bd59f9bc6b10920d547e9d11b51cbaa2b1f615b71cb9b2c2af4796fdb51b5f0fd664e914b977230649f552dfb7af1d
-
Filesize
72KB
MD56128469007960d98b1604afd9f564cb6
SHA1b662cb2130d21be8a60b52a5d21cc3bca9b1fe0b
SHA256e91d65301c88a0c88098477b9d0abd82f4e556897f816fb414f4d03d85423295
SHA51230c4f8d79156004f3143fea00f5f82aa148f41d708ca71f3fd5a8cfaafd5d6a83e966cc4fd1fdf819db309b49c848a4303880b02be489240edf54a546910ff9c
-
Filesize
72KB
MD56128469007960d98b1604afd9f564cb6
SHA1b662cb2130d21be8a60b52a5d21cc3bca9b1fe0b
SHA256e91d65301c88a0c88098477b9d0abd82f4e556897f816fb414f4d03d85423295
SHA51230c4f8d79156004f3143fea00f5f82aa148f41d708ca71f3fd5a8cfaafd5d6a83e966cc4fd1fdf819db309b49c848a4303880b02be489240edf54a546910ff9c
-
Filesize
72KB
MD54476e2f6edcecf4af7300bdba5e40327
SHA10fedd17f92b056d5d71e1c46d432467719780a79
SHA2565c76e3431311d4326907438f2bdb453e518308bfa603de7ca49c92a667ea0ad6
SHA512cddaf41f54f53469533c1cd0be709c16515eae18d7915fb20c2bfc6a93d4496878f691c88fd1a4ca88d5155caf49fc983d84746b94d8e23fea6be7ea53f3fd0a
-
Filesize
72KB
MD54476e2f6edcecf4af7300bdba5e40327
SHA10fedd17f92b056d5d71e1c46d432467719780a79
SHA2565c76e3431311d4326907438f2bdb453e518308bfa603de7ca49c92a667ea0ad6
SHA512cddaf41f54f53469533c1cd0be709c16515eae18d7915fb20c2bfc6a93d4496878f691c88fd1a4ca88d5155caf49fc983d84746b94d8e23fea6be7ea53f3fd0a
-
Filesize
72KB
MD54476e2f6edcecf4af7300bdba5e40327
SHA10fedd17f92b056d5d71e1c46d432467719780a79
SHA2565c76e3431311d4326907438f2bdb453e518308bfa603de7ca49c92a667ea0ad6
SHA512cddaf41f54f53469533c1cd0be709c16515eae18d7915fb20c2bfc6a93d4496878f691c88fd1a4ca88d5155caf49fc983d84746b94d8e23fea6be7ea53f3fd0a
-
Filesize
72KB
MD54476e2f6edcecf4af7300bdba5e40327
SHA10fedd17f92b056d5d71e1c46d432467719780a79
SHA2565c76e3431311d4326907438f2bdb453e518308bfa603de7ca49c92a667ea0ad6
SHA512cddaf41f54f53469533c1cd0be709c16515eae18d7915fb20c2bfc6a93d4496878f691c88fd1a4ca88d5155caf49fc983d84746b94d8e23fea6be7ea53f3fd0a
-
Filesize
72KB
MD54476e2f6edcecf4af7300bdba5e40327
SHA10fedd17f92b056d5d71e1c46d432467719780a79
SHA2565c76e3431311d4326907438f2bdb453e518308bfa603de7ca49c92a667ea0ad6
SHA512cddaf41f54f53469533c1cd0be709c16515eae18d7915fb20c2bfc6a93d4496878f691c88fd1a4ca88d5155caf49fc983d84746b94d8e23fea6be7ea53f3fd0a
-
Filesize
72KB
MD5fb53bc50e945d5e434d3ec54dfc011f9
SHA14ac5ed6746d5a80ffb05a488d750144f75dc33dc
SHA256e6f4255ce2bc25c760f77e89c27a5b011e5d1b2456fcb2697c0ae1b53c78680d
SHA512b8c5d41e6aa1587fcde24dee130ef9c6ecad3c9c0d8e0aa4b654c3f027e49c290f54a98cc2ce83c91431d7b513d713b2d2b0fbfb29814ef47e3904a7537f07c7
-
Filesize
72KB
MD5fb53bc50e945d5e434d3ec54dfc011f9
SHA14ac5ed6746d5a80ffb05a488d750144f75dc33dc
SHA256e6f4255ce2bc25c760f77e89c27a5b011e5d1b2456fcb2697c0ae1b53c78680d
SHA512b8c5d41e6aa1587fcde24dee130ef9c6ecad3c9c0d8e0aa4b654c3f027e49c290f54a98cc2ce83c91431d7b513d713b2d2b0fbfb29814ef47e3904a7537f07c7
-
Filesize
72KB
MD5e02fc77d31691dade1f69e0301830868
SHA171a1ebf3b9b5a6289616f29fa13532c1ee9b7647
SHA256cbdba192764c01c7920fa4de1020583797e43358ff1ef6ce9fd3ed02aee04e4f
SHA512ed94d4b3042fb56139d4046bdbbaf7732cf06b4daf133d59c9f76ff059cff138069fc10edf00b815929c137f479fcc98ee330e7e1df72ff8a272b0370139124d
-
Filesize
72KB
MD5e02fc77d31691dade1f69e0301830868
SHA171a1ebf3b9b5a6289616f29fa13532c1ee9b7647
SHA256cbdba192764c01c7920fa4de1020583797e43358ff1ef6ce9fd3ed02aee04e4f
SHA512ed94d4b3042fb56139d4046bdbbaf7732cf06b4daf133d59c9f76ff059cff138069fc10edf00b815929c137f479fcc98ee330e7e1df72ff8a272b0370139124d
-
Filesize
72KB
MD5e02fc77d31691dade1f69e0301830868
SHA171a1ebf3b9b5a6289616f29fa13532c1ee9b7647
SHA256cbdba192764c01c7920fa4de1020583797e43358ff1ef6ce9fd3ed02aee04e4f
SHA512ed94d4b3042fb56139d4046bdbbaf7732cf06b4daf133d59c9f76ff059cff138069fc10edf00b815929c137f479fcc98ee330e7e1df72ff8a272b0370139124d
-
Filesize
72KB
MD5e02fc77d31691dade1f69e0301830868
SHA171a1ebf3b9b5a6289616f29fa13532c1ee9b7647
SHA256cbdba192764c01c7920fa4de1020583797e43358ff1ef6ce9fd3ed02aee04e4f
SHA512ed94d4b3042fb56139d4046bdbbaf7732cf06b4daf133d59c9f76ff059cff138069fc10edf00b815929c137f479fcc98ee330e7e1df72ff8a272b0370139124d
-
Filesize
72KB
MD50627acda546feb19c588c39c0d5e5805
SHA10daae6d61c3bc39f8776f0bdf4de223c3b42495f
SHA25630b2a4847e2f4006fadd7ffffa34388641a92c9014ef63bcedc20697bdebe2c7
SHA512462f786280a0354a3f7942beeb35bc4d3d702de03175f2e26a15cfdeeced4a5ac71214cca92e33df96d0fd73edd726e8fb2eb09eca5e68bd64db1f2f8a549e52
-
Filesize
72KB
MD50627acda546feb19c588c39c0d5e5805
SHA10daae6d61c3bc39f8776f0bdf4de223c3b42495f
SHA25630b2a4847e2f4006fadd7ffffa34388641a92c9014ef63bcedc20697bdebe2c7
SHA512462f786280a0354a3f7942beeb35bc4d3d702de03175f2e26a15cfdeeced4a5ac71214cca92e33df96d0fd73edd726e8fb2eb09eca5e68bd64db1f2f8a549e52
-
Filesize
72KB
MD50627acda546feb19c588c39c0d5e5805
SHA10daae6d61c3bc39f8776f0bdf4de223c3b42495f
SHA25630b2a4847e2f4006fadd7ffffa34388641a92c9014ef63bcedc20697bdebe2c7
SHA512462f786280a0354a3f7942beeb35bc4d3d702de03175f2e26a15cfdeeced4a5ac71214cca92e33df96d0fd73edd726e8fb2eb09eca5e68bd64db1f2f8a549e52
-
Filesize
72KB
MD50627acda546feb19c588c39c0d5e5805
SHA10daae6d61c3bc39f8776f0bdf4de223c3b42495f
SHA25630b2a4847e2f4006fadd7ffffa34388641a92c9014ef63bcedc20697bdebe2c7
SHA512462f786280a0354a3f7942beeb35bc4d3d702de03175f2e26a15cfdeeced4a5ac71214cca92e33df96d0fd73edd726e8fb2eb09eca5e68bd64db1f2f8a549e52
-
Filesize
72KB
MD52ad4c796657bbc85dcbc86da770fa4ff
SHA1c10ce2112dec3d9fee79e8b2409f9a706f0316d0
SHA25667d36343f42998fae637bcdef0dc9b2334799087306f2d52b60d9b1e3450dbda
SHA51267e097582a00b36387bd3fc969a763c3b5871642363522cf07d09a2765112dc289626c08c91d4d27186c751933ac8beac9532c484272188f092037973b606939
-
Filesize
72KB
MD52ad4c796657bbc85dcbc86da770fa4ff
SHA1c10ce2112dec3d9fee79e8b2409f9a706f0316d0
SHA25667d36343f42998fae637bcdef0dc9b2334799087306f2d52b60d9b1e3450dbda
SHA51267e097582a00b36387bd3fc969a763c3b5871642363522cf07d09a2765112dc289626c08c91d4d27186c751933ac8beac9532c484272188f092037973b606939
-
Filesize
72KB
MD518e4e7736c62709bca3669d3b48b9355
SHA1ecec9a687c27f6296c088f6abc0c265124072839
SHA25611be00893b51130fb4c70db5d000fca6368e414a801afa4266749d3e47cd2b82
SHA5128f6c207452afb78c32124d30971a0278affe092e7861291eefe8f02a40c789994872a370d9eaaabf0e16ae3562a71021b8c3ff33b9d84350decf871f917b84fd
-
Filesize
72KB
MD518e4e7736c62709bca3669d3b48b9355
SHA1ecec9a687c27f6296c088f6abc0c265124072839
SHA25611be00893b51130fb4c70db5d000fca6368e414a801afa4266749d3e47cd2b82
SHA5128f6c207452afb78c32124d30971a0278affe092e7861291eefe8f02a40c789994872a370d9eaaabf0e16ae3562a71021b8c3ff33b9d84350decf871f917b84fd
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
72KB
MD5a70b4297606ca93cb78e03db53a8dfb6
SHA1d0149380dc05fbddf9595296d19727ee4a156361
SHA256f50662bef421759330ae14eef28c9164909807fcffb10ea5c9c20b51b598ed9e
SHA51299c02e0a55a64b226ef9c04e5997bdb0cc3d33fe344ec01282f9d30d25909b5549be8403cc7e11a8dfcc8a2be81dd05759690a363ee25f1813939962b15a1aad
-
Filesize
8KB
-
Filesize
8KB