Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
12/10/2022, 13:53
General
-
Target
ac9222ab7400d741ca1bb30e514ac0b54d2edbd21e134084ccf4d40c89224aa9.exe
-
Size
72KB
-
MD5
662c2f3613700ed3be7e787c4de27529
-
SHA1
dde054eaf80b882cb7c8432b7dc8af5d4f8dd222
-
SHA256
ac9222ab7400d741ca1bb30e514ac0b54d2edbd21e134084ccf4d40c89224aa9
-
SHA512
3da0a12ed57965f5f80a88813cfae277167044ac62ace5b2a074d50ce42ee220a033723a2d90d62598aa75d9a5612f632a97dd6b3c7e2f0b4bed5ca6f6d71ab9
-
SSDEEP
768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr9e4:teThavEjDWguK9R
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 60 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac9222ab7400d741ca1bb30e514ac0b54d2edbd21e134084ccf4d40c89224aa9.exe"C:\Users\Admin\AppData\Local\Temp\ac9222ab7400d741ca1bb30e514ac0b54d2edbd21e134084ccf4d40c89224aa9.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\15472481\backup.exeC:\Users\Admin\AppData\Local\Temp\15472481\backup.exe C:\Users\Admin\AppData\Local\Temp\15472481\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\data.exe"C:\Program Files\Common Files\Microsoft Shared\data.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Filters\update.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\update.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\SpeechEngines\data.exe"C:\Program Files\Common Files\SpeechEngines\data.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
-
-
C:\Program Files\DVD Maker\Shared\System Restore.exe"C:\Program Files\DVD Maker\Shared\System Restore.exe" C:\Program Files\DVD Maker\Shared\6⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\8⤵
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
-
-
C:\Program Files\Mozilla Firefox\update.exe"C:\Program Files\Mozilla Firefox\update.exe" C:\Program Files\Mozilla Firefox\5⤵
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Drops file in Program Files directory
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
-
C:\Program Files (x86)\Microsoft Sync Framework\data.exe"C:\Program Files (x86)\Microsoft Sync Framework\data.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
-
C:\Users\Admin\Contacts\data.exeC:\Users\Admin\Contacts\data.exe C:\Users\Admin\Contacts\6⤵
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5a1b6c6ecb0f0c3ac0458cfbaeee2e63e
SHA12424f41e7f421453bdc24b345946fe4af9bfd861
SHA2565a95ec430ae85c0ecf6363b24f2dedca5ece4b4241fa189adcc722a7dc8ca19f
SHA5129106638190343c70f7612c81367dd6f5b8572e9715fb5645c9333bb641c82629b8a01602533718f7451c3ffb33683de287030ed26dd7f95c202442ad98d8b080
-
Filesize
72KB
MD525859d8e2e133d1398d4ac26e0fb05d0
SHA12f8eec0abcbfa960002963668a024751e25f1e5e
SHA256f39826ff8fc99a70362628f2b30a1cbccc469c5d6ce0a221fd3fddeacf1c442c
SHA512d3b213524a59556ed5041b800f3a6f1e6802ab8ca1114cdac0be99552cba2ef52a50b2a4a492886867d29a56b8dc75ee5920a1b72a6385a34f7e5788b42e7f15
-
Filesize
72KB
MD525859d8e2e133d1398d4ac26e0fb05d0
SHA12f8eec0abcbfa960002963668a024751e25f1e5e
SHA256f39826ff8fc99a70362628f2b30a1cbccc469c5d6ce0a221fd3fddeacf1c442c
SHA512d3b213524a59556ed5041b800f3a6f1e6802ab8ca1114cdac0be99552cba2ef52a50b2a4a492886867d29a56b8dc75ee5920a1b72a6385a34f7e5788b42e7f15
-
Filesize
72KB
MD5bfbc42241848c2a17c49e6addf992be5
SHA1de781ababb88072595445855d58fe91be29f082b
SHA25682b1d2605aad61ded8d274992c58645806cb3dbd3a9c3cc84aaebe90b59e833e
SHA512487fe8edec9acdca2f6ce9b47ed576090408a64b12a3f789d7271c685c3ee69b29f83ca33126798c936c6e25cb61667929a2aa0f380fca275f5d2791677d8918
-
Filesize
72KB
MD525edad9786cb057e777e79ce35ae26c1
SHA147a5aa7eefbdebab22e0a9558f66851963c487fc
SHA2564b5a9d8a76dc438785e97a06580f558b5f8e4c89d365bec14b7c48762dbe9f57
SHA512a2604f6a19b264fa8040bfe217d40a0a3691a7721f80bc9016f8ce09ab5d7ab7cd7d9288ec0053f42b2014173af58ecc7ee3a840edd7f65ec892769bf2bee1ae
-
Filesize
72KB
MD525edad9786cb057e777e79ce35ae26c1
SHA147a5aa7eefbdebab22e0a9558f66851963c487fc
SHA2564b5a9d8a76dc438785e97a06580f558b5f8e4c89d365bec14b7c48762dbe9f57
SHA512a2604f6a19b264fa8040bfe217d40a0a3691a7721f80bc9016f8ce09ab5d7ab7cd7d9288ec0053f42b2014173af58ecc7ee3a840edd7f65ec892769bf2bee1ae
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5f8de6bdee8182ab0fd30c559e06b490e
SHA10258ebe71f14ef299f3942f5df2731998af1e508
SHA2566091721f9b8e7339c6827b960ac5555b583929c0a9a48e85920e2c633bf386e9
SHA512fa1459e0968869011e550c672ae7566efb98229aed9be824c5fa5548b730820c246d99a4da1a016dd4531bc392c9ad54f7cec38f4c4cad0b1ee6f946fb4a9e17
-
Filesize
72KB
MD5f8de6bdee8182ab0fd30c559e06b490e
SHA10258ebe71f14ef299f3942f5df2731998af1e508
SHA2566091721f9b8e7339c6827b960ac5555b583929c0a9a48e85920e2c633bf386e9
SHA512fa1459e0968869011e550c672ae7566efb98229aed9be824c5fa5548b730820c246d99a4da1a016dd4531bc392c9ad54f7cec38f4c4cad0b1ee6f946fb4a9e17
-
Filesize
72KB
MD56055fb7491e0b2d09d7f2c6d9211a1e3
SHA16c497e9655b543dd824ebe632375eea8aaa0c2d5
SHA25610a9535a7344644c0a435025353cb7a815129646886d07ea9216be79680dbd56
SHA512e2193a8510ebc5a7bd81620b49918a28533f0d4b6a76c4e29e673044035ce7d87694ed12b5b657264aa6661b474523c34fa3ab83fa974e1ce5d6c7f19957db2f
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD59536a06568aee0b7cc6fe8555ef9d1cd
SHA14b110e94195bdc784095fd6550586761f6a24f58
SHA25697e996f38efcf96f4146ef5169261c0928a0c62f20a65d3787b6cdfa1eeb8f8a
SHA512136c225252b939ca43222746dcd5ea08cff2aae4a2ade11b69da3fb608f687f17dbb32c8133975bed72a17515f1af2f36bc8ee73f9fff0fe55d1d93b5f89d3df
-
Filesize
72KB
MD59536a06568aee0b7cc6fe8555ef9d1cd
SHA14b110e94195bdc784095fd6550586761f6a24f58
SHA25697e996f38efcf96f4146ef5169261c0928a0c62f20a65d3787b6cdfa1eeb8f8a
SHA512136c225252b939ca43222746dcd5ea08cff2aae4a2ade11b69da3fb608f687f17dbb32c8133975bed72a17515f1af2f36bc8ee73f9fff0fe55d1d93b5f89d3df
-
Filesize
72KB
MD5973f32a21a0c36a64583a7f1c0836b24
SHA1a3be530542d75b83d68d02722c6d6898f1b62359
SHA25656125e919995d1c8a9580892f6715784e749b3e40509017e25d6b139603e5385
SHA512e6d2363934758475f9b75ec82a48687736e1619dd8c5eef0c04f4064a279c0a533f6f2b73627324fa5f9bee9e90f8661578bd313c6d04c9c3765608ffc47a03a
-
Filesize
72KB
MD5973f32a21a0c36a64583a7f1c0836b24
SHA1a3be530542d75b83d68d02722c6d6898f1b62359
SHA25656125e919995d1c8a9580892f6715784e749b3e40509017e25d6b139603e5385
SHA512e6d2363934758475f9b75ec82a48687736e1619dd8c5eef0c04f4064a279c0a533f6f2b73627324fa5f9bee9e90f8661578bd313c6d04c9c3765608ffc47a03a
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD5e77123a9a82a6af8de4586c56d8e797d
SHA19251b365dc66f1b8d73c6a7b0a52e588d5d48fcf
SHA2563dcde80dfb271aa6d4b89406ad01fcfc8d1f431c3c0baa2d5f04e6af880e2179
SHA512e53ff2bdf73547c595ac8f50cbb253c7ec2e582011580f8f850e835908751ad1e8379e6b06c0e038de7cc93ebbf5c6aef9a4c7cee71dd12830794215488875ef
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD5e77123a9a82a6af8de4586c56d8e797d
SHA19251b365dc66f1b8d73c6a7b0a52e588d5d48fcf
SHA2563dcde80dfb271aa6d4b89406ad01fcfc8d1f431c3c0baa2d5f04e6af880e2179
SHA512e53ff2bdf73547c595ac8f50cbb253c7ec2e582011580f8f850e835908751ad1e8379e6b06c0e038de7cc93ebbf5c6aef9a4c7cee71dd12830794215488875ef
-
Filesize
72KB
MD59ec79db82cee8ec8383cac881daebdd8
SHA1fc5c414de7deb2875b5ff4186c87e4ccecc569de
SHA2560fc8c135fbea40b9a4de38aafb1308766f4d94c2081734b087e852f51660e2f7
SHA512ec749cf79226905678c19e0cdd30e5a157d5671dc9679d8b3e981ded6f631665e8709b33cd053fb435fa965ab5f01320cf359baf3cd19b67e52dacdd41cc2c45
-
Filesize
72KB
MD59ec79db82cee8ec8383cac881daebdd8
SHA1fc5c414de7deb2875b5ff4186c87e4ccecc569de
SHA2560fc8c135fbea40b9a4de38aafb1308766f4d94c2081734b087e852f51660e2f7
SHA512ec749cf79226905678c19e0cdd30e5a157d5671dc9679d8b3e981ded6f631665e8709b33cd053fb435fa965ab5f01320cf359baf3cd19b67e52dacdd41cc2c45
-
Filesize
72KB
MD5a1b6c6ecb0f0c3ac0458cfbaeee2e63e
SHA12424f41e7f421453bdc24b345946fe4af9bfd861
SHA2565a95ec430ae85c0ecf6363b24f2dedca5ece4b4241fa189adcc722a7dc8ca19f
SHA5129106638190343c70f7612c81367dd6f5b8572e9715fb5645c9333bb641c82629b8a01602533718f7451c3ffb33683de287030ed26dd7f95c202442ad98d8b080
-
Filesize
72KB
MD5a1b6c6ecb0f0c3ac0458cfbaeee2e63e
SHA12424f41e7f421453bdc24b345946fe4af9bfd861
SHA2565a95ec430ae85c0ecf6363b24f2dedca5ece4b4241fa189adcc722a7dc8ca19f
SHA5129106638190343c70f7612c81367dd6f5b8572e9715fb5645c9333bb641c82629b8a01602533718f7451c3ffb33683de287030ed26dd7f95c202442ad98d8b080
-
Filesize
72KB
MD525859d8e2e133d1398d4ac26e0fb05d0
SHA12f8eec0abcbfa960002963668a024751e25f1e5e
SHA256f39826ff8fc99a70362628f2b30a1cbccc469c5d6ce0a221fd3fddeacf1c442c
SHA512d3b213524a59556ed5041b800f3a6f1e6802ab8ca1114cdac0be99552cba2ef52a50b2a4a492886867d29a56b8dc75ee5920a1b72a6385a34f7e5788b42e7f15
-
Filesize
72KB
MD525859d8e2e133d1398d4ac26e0fb05d0
SHA12f8eec0abcbfa960002963668a024751e25f1e5e
SHA256f39826ff8fc99a70362628f2b30a1cbccc469c5d6ce0a221fd3fddeacf1c442c
SHA512d3b213524a59556ed5041b800f3a6f1e6802ab8ca1114cdac0be99552cba2ef52a50b2a4a492886867d29a56b8dc75ee5920a1b72a6385a34f7e5788b42e7f15
-
Filesize
72KB
MD5bfbc42241848c2a17c49e6addf992be5
SHA1de781ababb88072595445855d58fe91be29f082b
SHA25682b1d2605aad61ded8d274992c58645806cb3dbd3a9c3cc84aaebe90b59e833e
SHA512487fe8edec9acdca2f6ce9b47ed576090408a64b12a3f789d7271c685c3ee69b29f83ca33126798c936c6e25cb61667929a2aa0f380fca275f5d2791677d8918
-
Filesize
72KB
MD5bfbc42241848c2a17c49e6addf992be5
SHA1de781ababb88072595445855d58fe91be29f082b
SHA25682b1d2605aad61ded8d274992c58645806cb3dbd3a9c3cc84aaebe90b59e833e
SHA512487fe8edec9acdca2f6ce9b47ed576090408a64b12a3f789d7271c685c3ee69b29f83ca33126798c936c6e25cb61667929a2aa0f380fca275f5d2791677d8918
-
Filesize
72KB
MD525edad9786cb057e777e79ce35ae26c1
SHA147a5aa7eefbdebab22e0a9558f66851963c487fc
SHA2564b5a9d8a76dc438785e97a06580f558b5f8e4c89d365bec14b7c48762dbe9f57
SHA512a2604f6a19b264fa8040bfe217d40a0a3691a7721f80bc9016f8ce09ab5d7ab7cd7d9288ec0053f42b2014173af58ecc7ee3a840edd7f65ec892769bf2bee1ae
-
Filesize
72KB
MD525edad9786cb057e777e79ce35ae26c1
SHA147a5aa7eefbdebab22e0a9558f66851963c487fc
SHA2564b5a9d8a76dc438785e97a06580f558b5f8e4c89d365bec14b7c48762dbe9f57
SHA512a2604f6a19b264fa8040bfe217d40a0a3691a7721f80bc9016f8ce09ab5d7ab7cd7d9288ec0053f42b2014173af58ecc7ee3a840edd7f65ec892769bf2bee1ae
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5f8de6bdee8182ab0fd30c559e06b490e
SHA10258ebe71f14ef299f3942f5df2731998af1e508
SHA2566091721f9b8e7339c6827b960ac5555b583929c0a9a48e85920e2c633bf386e9
SHA512fa1459e0968869011e550c672ae7566efb98229aed9be824c5fa5548b730820c246d99a4da1a016dd4531bc392c9ad54f7cec38f4c4cad0b1ee6f946fb4a9e17
-
Filesize
72KB
MD5f8de6bdee8182ab0fd30c559e06b490e
SHA10258ebe71f14ef299f3942f5df2731998af1e508
SHA2566091721f9b8e7339c6827b960ac5555b583929c0a9a48e85920e2c633bf386e9
SHA512fa1459e0968869011e550c672ae7566efb98229aed9be824c5fa5548b730820c246d99a4da1a016dd4531bc392c9ad54f7cec38f4c4cad0b1ee6f946fb4a9e17
-
Filesize
72KB
MD56055fb7491e0b2d09d7f2c6d9211a1e3
SHA16c497e9655b543dd824ebe632375eea8aaa0c2d5
SHA25610a9535a7344644c0a435025353cb7a815129646886d07ea9216be79680dbd56
SHA512e2193a8510ebc5a7bd81620b49918a28533f0d4b6a76c4e29e673044035ce7d87694ed12b5b657264aa6661b474523c34fa3ab83fa974e1ce5d6c7f19957db2f
-
Filesize
72KB
MD56055fb7491e0b2d09d7f2c6d9211a1e3
SHA16c497e9655b543dd824ebe632375eea8aaa0c2d5
SHA25610a9535a7344644c0a435025353cb7a815129646886d07ea9216be79680dbd56
SHA512e2193a8510ebc5a7bd81620b49918a28533f0d4b6a76c4e29e673044035ce7d87694ed12b5b657264aa6661b474523c34fa3ab83fa974e1ce5d6c7f19957db2f
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD5ac844c3e8c29e6da06afe556474e0518
SHA1ef3e6fc492241e8f47bd9682b7bdd28770fc39fa
SHA256e8e162562f7f0cb234a349cb4fa25ff4aa8374ddcd41a0970588cc4cfde66305
SHA512e1ce79bfb6dcb3e4bb5706d563997b1e977a0a2015c0a90a8dad191201cf20e1a31c4ad00f994d1d9e33e50aa2cb703f56ccab37669cd3c1ed8bd83f2c80966b
-
Filesize
72KB
MD56f0da201ee2bc09b238d9b60e52eaf9d
SHA1fff03ac2fb7fd24467e9eb6dee11c6a041d2dbfe
SHA2560122620c70032da3745f1cb2821a11f84d77151dae4c9a3ade5bdc429d38f9df
SHA51250ee2b98eebe37da6f5da9e2c8480ab93dc10dd7722c7e3c7df69e60ce90e812bf8f85b7bd7c55b2adf6453c247d6af8d372b2b9e1e7ab620a9110ed2b547264
-
Filesize
72KB
MD59536a06568aee0b7cc6fe8555ef9d1cd
SHA14b110e94195bdc784095fd6550586761f6a24f58
SHA25697e996f38efcf96f4146ef5169261c0928a0c62f20a65d3787b6cdfa1eeb8f8a
SHA512136c225252b939ca43222746dcd5ea08cff2aae4a2ade11b69da3fb608f687f17dbb32c8133975bed72a17515f1af2f36bc8ee73f9fff0fe55d1d93b5f89d3df
-
Filesize
72KB
MD59536a06568aee0b7cc6fe8555ef9d1cd
SHA14b110e94195bdc784095fd6550586761f6a24f58
SHA25697e996f38efcf96f4146ef5169261c0928a0c62f20a65d3787b6cdfa1eeb8f8a
SHA512136c225252b939ca43222746dcd5ea08cff2aae4a2ade11b69da3fb608f687f17dbb32c8133975bed72a17515f1af2f36bc8ee73f9fff0fe55d1d93b5f89d3df
-
Filesize
72KB
MD5973f32a21a0c36a64583a7f1c0836b24
SHA1a3be530542d75b83d68d02722c6d6898f1b62359
SHA25656125e919995d1c8a9580892f6715784e749b3e40509017e25d6b139603e5385
SHA512e6d2363934758475f9b75ec82a48687736e1619dd8c5eef0c04f4064a279c0a533f6f2b73627324fa5f9bee9e90f8661578bd313c6d04c9c3765608ffc47a03a
-
Filesize
72KB
MD5973f32a21a0c36a64583a7f1c0836b24
SHA1a3be530542d75b83d68d02722c6d6898f1b62359
SHA25656125e919995d1c8a9580892f6715784e749b3e40509017e25d6b139603e5385
SHA512e6d2363934758475f9b75ec82a48687736e1619dd8c5eef0c04f4064a279c0a533f6f2b73627324fa5f9bee9e90f8661578bd313c6d04c9c3765608ffc47a03a
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD5e77123a9a82a6af8de4586c56d8e797d
SHA19251b365dc66f1b8d73c6a7b0a52e588d5d48fcf
SHA2563dcde80dfb271aa6d4b89406ad01fcfc8d1f431c3c0baa2d5f04e6af880e2179
SHA512e53ff2bdf73547c595ac8f50cbb253c7ec2e582011580f8f850e835908751ad1e8379e6b06c0e038de7cc93ebbf5c6aef9a4c7cee71dd12830794215488875ef
-
Filesize
72KB
MD5e77123a9a82a6af8de4586c56d8e797d
SHA19251b365dc66f1b8d73c6a7b0a52e588d5d48fcf
SHA2563dcde80dfb271aa6d4b89406ad01fcfc8d1f431c3c0baa2d5f04e6af880e2179
SHA512e53ff2bdf73547c595ac8f50cbb253c7ec2e582011580f8f850e835908751ad1e8379e6b06c0e038de7cc93ebbf5c6aef9a4c7cee71dd12830794215488875ef
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD55604abfd0707789a1df33fc8725e8776
SHA198b08d7de91087b841b38d06c67a54c3064ec6df
SHA256587063a0cc61d76666e0d1c015ef923db8d8e8f37599d9b9a9cd55234705d599
SHA51266c66b617ef5ac434f4c0786b11c39e5867af8ed48934100be1efc611e99a7cd9f2aac28284630909dcb67ca61998e2ec1825982704a90efdb0655aacf5e7875
-
Filesize
72KB
MD5e77123a9a82a6af8de4586c56d8e797d
SHA19251b365dc66f1b8d73c6a7b0a52e588d5d48fcf
SHA2563dcde80dfb271aa6d4b89406ad01fcfc8d1f431c3c0baa2d5f04e6af880e2179
SHA512e53ff2bdf73547c595ac8f50cbb253c7ec2e582011580f8f850e835908751ad1e8379e6b06c0e038de7cc93ebbf5c6aef9a4c7cee71dd12830794215488875ef
-
Filesize
72KB
MD5e77123a9a82a6af8de4586c56d8e797d
SHA19251b365dc66f1b8d73c6a7b0a52e588d5d48fcf
SHA2563dcde80dfb271aa6d4b89406ad01fcfc8d1f431c3c0baa2d5f04e6af880e2179
SHA512e53ff2bdf73547c595ac8f50cbb253c7ec2e582011580f8f850e835908751ad1e8379e6b06c0e038de7cc93ebbf5c6aef9a4c7cee71dd12830794215488875ef
-
Filesize
8KB
-
Filesize
8KB