Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe
Resource
win10v2004-20220901-en
General
-
Target
888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe
-
Size
72KB
-
MD5
046495160a7163b714a2e630dcd4a695
-
SHA1
6d4c27689994f0c33ef0a8257e055780a124524c
-
SHA256
888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62
-
SHA512
4fbb5f7cc30c00d3b5dfe518c3be1ac393b2943b20fcbd3f1d5cc2f07ff8458519a055d6350c686ef071e91b457e8aab32c4dd3d51fda0d7208e081e194b5f0f
-
SSDEEP
768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRr9cq:teThavEjDWguK9p
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe -
Executes dropped EXE 64 IoCs
pid Process 840 backup.exe 1736 backup.exe 552 backup.exe 688 backup.exe 1524 backup.exe 1780 System Restore.exe 1376 backup.exe 1256 backup.exe 932 backup.exe 1704 backup.exe 1976 backup.exe 1084 backup.exe 832 backup.exe 1788 backup.exe 936 backup.exe 1172 backup.exe 1836 backup.exe 1776 backup.exe 1744 backup.exe 1536 backup.exe 620 data.exe 596 backup.exe 1732 data.exe 1408 backup.exe 1780 backup.exe 1224 backup.exe 288 backup.exe 1336 backup.exe 1724 backup.exe 1192 backup.exe 1944 backup.exe 1968 backup.exe 932 backup.exe 304 backup.exe 1996 backup.exe 1900 backup.exe 1588 backup.exe 904 backup.exe 1084 backup.exe 1212 backup.exe 2000 System Restore.exe 1324 backup.exe 956 backup.exe 2028 System Restore.exe 2004 backup.exe 1464 backup.exe 1776 backup.exe 1528 backup.exe 588 backup.exe 1536 backup.exe 1848 backup.exe 584 backup.exe 836 backup.exe 980 backup.exe 1636 backup.exe 1640 backup.exe 1412 backup.exe 2016 backup.exe 1972 backup.exe 1704 backup.exe 1784 backup.exe 1908 backup.exe 1100 backup.exe 1932 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 1256 backup.exe 1256 backup.exe 932 backup.exe 932 backup.exe 1256 backup.exe 1256 backup.exe 1976 backup.exe 1976 backup.exe 1084 backup.exe 1084 backup.exe 1976 backup.exe 1976 backup.exe 1788 backup.exe 1788 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 936 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1836 backup.exe 1256 backup.exe 1788 backup.exe 1976 backup.exe 936 backup.exe 1256 backup.exe 1976 backup.exe 936 backup.exe 1788 backup.exe 1836 backup.exe 1780 backup.exe 1780 backup.exe 1788 backup.exe 1788 backup.exe 1780 backup.exe 1780 backup.exe 1192 backup.exe 1192 backup.exe 288 backup.exe 288 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files\Mozilla Firefox\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\msadc\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 840 backup.exe 1736 backup.exe 552 backup.exe 688 backup.exe 1524 backup.exe 1780 System Restore.exe 1376 backup.exe 1256 backup.exe 932 backup.exe 1704 backup.exe 1976 backup.exe 1084 backup.exe 832 backup.exe 1788 backup.exe 936 backup.exe 1172 backup.exe 1836 backup.exe 1776 backup.exe 1744 backup.exe 1536 backup.exe 620 data.exe 596 backup.exe 1732 data.exe 288 backup.exe 1224 backup.exe 1780 backup.exe 1336 backup.exe 1408 backup.exe 1724 backup.exe 1192 backup.exe 1944 backup.exe 1968 backup.exe 932 backup.exe 1996 backup.exe 304 backup.exe 1588 backup.exe 1900 backup.exe 904 backup.exe 1084 backup.exe 2000 System Restore.exe 1212 backup.exe 1324 backup.exe 956 backup.exe 2028 System Restore.exe 1464 backup.exe 1776 backup.exe 588 backup.exe 584 backup.exe 1536 backup.exe 1848 backup.exe 836 backup.exe 980 backup.exe 1640 backup.exe 1412 backup.exe 1636 backup.exe 2016 backup.exe 1704 backup.exe 1784 backup.exe 1972 backup.exe 1908 backup.exe 1932 backup.exe 1100 backup.exe 1664 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 840 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 27 PID 1252 wrote to memory of 840 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 27 PID 1252 wrote to memory of 840 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 27 PID 1252 wrote to memory of 840 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 27 PID 1252 wrote to memory of 1736 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 28 PID 1252 wrote to memory of 1736 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 28 PID 1252 wrote to memory of 1736 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 28 PID 1252 wrote to memory of 1736 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 28 PID 1252 wrote to memory of 552 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 29 PID 1252 wrote to memory of 552 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 29 PID 1252 wrote to memory of 552 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 29 PID 1252 wrote to memory of 552 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 29 PID 1252 wrote to memory of 688 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 30 PID 1252 wrote to memory of 688 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 30 PID 1252 wrote to memory of 688 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 30 PID 1252 wrote to memory of 688 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 30 PID 1252 wrote to memory of 1524 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 31 PID 1252 wrote to memory of 1524 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 31 PID 1252 wrote to memory of 1524 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 31 PID 1252 wrote to memory of 1524 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 31 PID 1252 wrote to memory of 1780 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 32 PID 1252 wrote to memory of 1780 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 32 PID 1252 wrote to memory of 1780 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 32 PID 1252 wrote to memory of 1780 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 32 PID 1252 wrote to memory of 1376 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 33 PID 1252 wrote to memory of 1376 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 33 PID 1252 wrote to memory of 1376 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 33 PID 1252 wrote to memory of 1376 1252 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe 33 PID 840 wrote to memory of 1256 840 backup.exe 34 PID 840 wrote to memory of 1256 840 backup.exe 34 PID 840 wrote to memory of 1256 840 backup.exe 34 PID 840 wrote to memory of 1256 840 backup.exe 34 PID 1256 wrote to memory of 932 1256 backup.exe 35 PID 1256 wrote to memory of 932 1256 backup.exe 35 PID 1256 wrote to memory of 932 1256 backup.exe 35 PID 1256 wrote to memory of 932 1256 backup.exe 35 PID 932 wrote to memory of 1704 932 backup.exe 36 PID 932 wrote to memory of 1704 932 backup.exe 36 PID 932 wrote to memory of 1704 932 backup.exe 36 PID 932 wrote to memory of 1704 932 backup.exe 36 PID 1256 wrote to memory of 1976 1256 backup.exe 37 PID 1256 wrote to memory of 1976 1256 backup.exe 37 PID 1256 wrote to memory of 1976 1256 backup.exe 37 PID 1256 wrote to memory of 1976 1256 backup.exe 37 PID 1976 wrote to memory of 1084 1976 backup.exe 38 PID 1976 wrote to memory of 1084 1976 backup.exe 38 PID 1976 wrote to memory of 1084 1976 backup.exe 38 PID 1976 wrote to memory of 1084 1976 backup.exe 38 PID 1084 wrote to memory of 832 1084 backup.exe 39 PID 1084 wrote to memory of 832 1084 backup.exe 39 PID 1084 wrote to memory of 832 1084 backup.exe 39 PID 1084 wrote to memory of 832 1084 backup.exe 39 PID 1976 wrote to memory of 1788 1976 backup.exe 40 PID 1976 wrote to memory of 1788 1976 backup.exe 40 PID 1976 wrote to memory of 1788 1976 backup.exe 40 PID 1976 wrote to memory of 1788 1976 backup.exe 40 PID 1788 wrote to memory of 936 1788 backup.exe 41 PID 1788 wrote to memory of 936 1788 backup.exe 41 PID 1788 wrote to memory of 936 1788 backup.exe 41 PID 1788 wrote to memory of 936 1788 backup.exe 41 PID 936 wrote to memory of 1172 936 backup.exe 42 PID 936 wrote to memory of 1172 936 backup.exe 42 PID 936 wrote to memory of 1172 936 backup.exe 42 PID 936 wrote to memory of 1172 936 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe"C:\Users\Admin\AppData\Local\Temp\888389bbc3daa582fb894d29c519063fed91a1f5def31ef6244cf9bf5439ef62.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\4077103362\backup.exeC:\Users\Admin\AppData\Local\Temp\4077103362\backup.exe C:\Users\Admin\AppData\Local\Temp\4077103362\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:840 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1256 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:932 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1976 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:832
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1788 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1836 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1744
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1732
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1900
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1464
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1848
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2016 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
PID:1040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1520
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
PID:932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵PID:572
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵PID:1852
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵PID:1644
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵PID:1372
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵PID:980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵PID:1324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵PID:304
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:1920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:1632
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:288 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:932
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1668
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵PID:1128
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1036
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:2008
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1980
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:904
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:1044
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:1892
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1192 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1968
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1588 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1212 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1776
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:584
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:980
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1908
-
-
C:\Program Files\Common Files\System\ado\ja-JP\update.exe"C:\Program Files\Common Files\System\ado\ja-JP\update.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:340
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:832
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1384
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1224
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:1648
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1032
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1776
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:1100
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1744
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1780 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1724
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1996
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:904
-
-
C:\Program Files\DVD Maker\it-IT\System Restore.exe"C:\Program Files\DVD Maker\it-IT\System Restore.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1784 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- System policy modification
PID:992
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- System policy modification
PID:2004
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:580
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1580
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1972
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:1900
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1432
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1132
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:2040
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\update.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵PID:540
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵PID:1848
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵PID:1256
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:532 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1968
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:640
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1428
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:332
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1368
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1636
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:1532
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:1720
-
-
C:\Program Files\VideoLAN\update.exe"C:\Program Files\VideoLAN\update.exe" C:\Program Files\VideoLAN\5⤵PID:1224
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1408 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:304 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1084 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:956
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:588 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:836
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1412
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1100 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1664
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
PID:1680
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
PID:956 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
PID:1240
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵PID:1996
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:2044
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:676
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:872
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1228
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:436
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:584 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:632
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1896
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1916
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1056
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1908
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:992
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft Office\update.exe"C:\Program Files (x86)\Microsoft Office\update.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1088
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:700
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
PID:688 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1412
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1664
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1984
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1376
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD585fd815ffe3e185132be04972bb53d1d
SHA15d2d55195ca89c81a6454035d1381c6b05834d53
SHA2566ed0521dd8504766328ca26b0c822e7927a9ce84dc6820488c6ef40663b24153
SHA5128a99d4b583c9055bc1926659a5e286b4abfca5a0d04e3b6190d4a45cd96d0ee4cff0d582ade83046ec5f9f67d25c3b77bb32cb3df25e5d9532477ed9b41f9541
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD53189d51671205c50aae25f362fc0fb71
SHA143bd26f67c7fcee46510dfd4486740510c1ad28b
SHA256ff330a817f9036693ab3974b159e1198d8588a55e6958b5e0e467acec89d7b24
SHA512812b7a5c26376573ff38fea47e8f7e3f7920b2df7d112bb5a5858e8f660efe8e1075a5a86ae0ec23d61a6d971b8b6dedfe90ee282263c4690ee73316fd3fb8bf
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD5469b055951c416b95ea17799c1f9faec
SHA18e00bf0fbba42079c2de7a7d465260d33f6e5b1e
SHA256856ff21b3b960ae6943f7556cf05d8213d3061b6d9c044f76c0819db301e48af
SHA5124a35444dfd294ff5117c7887df2ebb0e056f3332ac882e0400ec15ec6a0efecda618955dbe1e1ff70270a14832ba5a28632cd8a2bf599c664707acf646ca7e88
-
Filesize
72KB
MD53189d51671205c50aae25f362fc0fb71
SHA143bd26f67c7fcee46510dfd4486740510c1ad28b
SHA256ff330a817f9036693ab3974b159e1198d8588a55e6958b5e0e467acec89d7b24
SHA512812b7a5c26376573ff38fea47e8f7e3f7920b2df7d112bb5a5858e8f660efe8e1075a5a86ae0ec23d61a6d971b8b6dedfe90ee282263c4690ee73316fd3fb8bf
-
Filesize
72KB
MD53189d51671205c50aae25f362fc0fb71
SHA143bd26f67c7fcee46510dfd4486740510c1ad28b
SHA256ff330a817f9036693ab3974b159e1198d8588a55e6958b5e0e467acec89d7b24
SHA512812b7a5c26376573ff38fea47e8f7e3f7920b2df7d112bb5a5858e8f660efe8e1075a5a86ae0ec23d61a6d971b8b6dedfe90ee282263c4690ee73316fd3fb8bf
-
Filesize
72KB
MD5e91cbae18a12eeef97475db8f4c5238b
SHA1c422379acb5c870591b59269e13779e0032767e5
SHA2569e9669b9005e1222bccf9478e453a875bece1b64949fc8cf1e23a9322a327d0b
SHA512ecd42fce61912f753c56ee08884189a449799d41d693011127d365cfd4d1c5d5df053f918518eb79d526d4de59d182dceaaf6009e9d04dacc9329f792c30e066
-
Filesize
72KB
MD5469b055951c416b95ea17799c1f9faec
SHA18e00bf0fbba42079c2de7a7d465260d33f6e5b1e
SHA256856ff21b3b960ae6943f7556cf05d8213d3061b6d9c044f76c0819db301e48af
SHA5124a35444dfd294ff5117c7887df2ebb0e056f3332ac882e0400ec15ec6a0efecda618955dbe1e1ff70270a14832ba5a28632cd8a2bf599c664707acf646ca7e88
-
Filesize
72KB
MD5469b055951c416b95ea17799c1f9faec
SHA18e00bf0fbba42079c2de7a7d465260d33f6e5b1e
SHA256856ff21b3b960ae6943f7556cf05d8213d3061b6d9c044f76c0819db301e48af
SHA5124a35444dfd294ff5117c7887df2ebb0e056f3332ac882e0400ec15ec6a0efecda618955dbe1e1ff70270a14832ba5a28632cd8a2bf599c664707acf646ca7e88
-
Filesize
72KB
MD5e91cbae18a12eeef97475db8f4c5238b
SHA1c422379acb5c870591b59269e13779e0032767e5
SHA2569e9669b9005e1222bccf9478e453a875bece1b64949fc8cf1e23a9322a327d0b
SHA512ecd42fce61912f753c56ee08884189a449799d41d693011127d365cfd4d1c5d5df053f918518eb79d526d4de59d182dceaaf6009e9d04dacc9329f792c30e066
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD5b1534fcc2e8803b32ee4ca0770382899
SHA148d55b9f041570a15613ea54f2121f49a9d2ba85
SHA2567b8f108ec2608e5833ce35a5c89c9303168520dd0ef68336caedf0310b10e32b
SHA51242bad185aa4763ea72675b59a2a654cf3f1ce2ec961b7cf77482b763f064d2009e00d19569bf001feb7bbb486fdd8e1dd4a43e432fbccc40fca8455f42298f3d
-
Filesize
72KB
MD5b1534fcc2e8803b32ee4ca0770382899
SHA148d55b9f041570a15613ea54f2121f49a9d2ba85
SHA2567b8f108ec2608e5833ce35a5c89c9303168520dd0ef68336caedf0310b10e32b
SHA51242bad185aa4763ea72675b59a2a654cf3f1ce2ec961b7cf77482b763f064d2009e00d19569bf001feb7bbb486fdd8e1dd4a43e432fbccc40fca8455f42298f3d
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD523f75afbcb43a103e5d6553e10b35c52
SHA1557a98f5967c38e49ab906955e2058368166e36d
SHA25695997707ee939f7fd07c12dae73a549c35d13b3308299557346f7efdd028a9ff
SHA512d91e02bcf34c5bd752cc497abf61cda2f2baa06eba5055d42f6de0db08061edd86fac4aa7a5a997659aaf5a88aacc24abc9ac6ff3637a927ee8b79f293aef79c
-
Filesize
72KB
MD523f75afbcb43a103e5d6553e10b35c52
SHA1557a98f5967c38e49ab906955e2058368166e36d
SHA25695997707ee939f7fd07c12dae73a549c35d13b3308299557346f7efdd028a9ff
SHA512d91e02bcf34c5bd752cc497abf61cda2f2baa06eba5055d42f6de0db08061edd86fac4aa7a5a997659aaf5a88aacc24abc9ac6ff3637a927ee8b79f293aef79c
-
Filesize
72KB
MD585fd815ffe3e185132be04972bb53d1d
SHA15d2d55195ca89c81a6454035d1381c6b05834d53
SHA2566ed0521dd8504766328ca26b0c822e7927a9ce84dc6820488c6ef40663b24153
SHA5128a99d4b583c9055bc1926659a5e286b4abfca5a0d04e3b6190d4a45cd96d0ee4cff0d582ade83046ec5f9f67d25c3b77bb32cb3df25e5d9532477ed9b41f9541
-
Filesize
72KB
MD585fd815ffe3e185132be04972bb53d1d
SHA15d2d55195ca89c81a6454035d1381c6b05834d53
SHA2566ed0521dd8504766328ca26b0c822e7927a9ce84dc6820488c6ef40663b24153
SHA5128a99d4b583c9055bc1926659a5e286b4abfca5a0d04e3b6190d4a45cd96d0ee4cff0d582ade83046ec5f9f67d25c3b77bb32cb3df25e5d9532477ed9b41f9541
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD53189d51671205c50aae25f362fc0fb71
SHA143bd26f67c7fcee46510dfd4486740510c1ad28b
SHA256ff330a817f9036693ab3974b159e1198d8588a55e6958b5e0e467acec89d7b24
SHA512812b7a5c26376573ff38fea47e8f7e3f7920b2df7d112bb5a5858e8f660efe8e1075a5a86ae0ec23d61a6d971b8b6dedfe90ee282263c4690ee73316fd3fb8bf
-
Filesize
72KB
MD53189d51671205c50aae25f362fc0fb71
SHA143bd26f67c7fcee46510dfd4486740510c1ad28b
SHA256ff330a817f9036693ab3974b159e1198d8588a55e6958b5e0e467acec89d7b24
SHA512812b7a5c26376573ff38fea47e8f7e3f7920b2df7d112bb5a5858e8f660efe8e1075a5a86ae0ec23d61a6d971b8b6dedfe90ee282263c4690ee73316fd3fb8bf
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD5469b055951c416b95ea17799c1f9faec
SHA18e00bf0fbba42079c2de7a7d465260d33f6e5b1e
SHA256856ff21b3b960ae6943f7556cf05d8213d3061b6d9c044f76c0819db301e48af
SHA5124a35444dfd294ff5117c7887df2ebb0e056f3332ac882e0400ec15ec6a0efecda618955dbe1e1ff70270a14832ba5a28632cd8a2bf599c664707acf646ca7e88
-
Filesize
72KB
MD5469b055951c416b95ea17799c1f9faec
SHA18e00bf0fbba42079c2de7a7d465260d33f6e5b1e
SHA256856ff21b3b960ae6943f7556cf05d8213d3061b6d9c044f76c0819db301e48af
SHA5124a35444dfd294ff5117c7887df2ebb0e056f3332ac882e0400ec15ec6a0efecda618955dbe1e1ff70270a14832ba5a28632cd8a2bf599c664707acf646ca7e88
-
Filesize
72KB
MD53189d51671205c50aae25f362fc0fb71
SHA143bd26f67c7fcee46510dfd4486740510c1ad28b
SHA256ff330a817f9036693ab3974b159e1198d8588a55e6958b5e0e467acec89d7b24
SHA512812b7a5c26376573ff38fea47e8f7e3f7920b2df7d112bb5a5858e8f660efe8e1075a5a86ae0ec23d61a6d971b8b6dedfe90ee282263c4690ee73316fd3fb8bf
-
Filesize
72KB
MD53189d51671205c50aae25f362fc0fb71
SHA143bd26f67c7fcee46510dfd4486740510c1ad28b
SHA256ff330a817f9036693ab3974b159e1198d8588a55e6958b5e0e467acec89d7b24
SHA512812b7a5c26376573ff38fea47e8f7e3f7920b2df7d112bb5a5858e8f660efe8e1075a5a86ae0ec23d61a6d971b8b6dedfe90ee282263c4690ee73316fd3fb8bf
-
Filesize
72KB
MD5e91cbae18a12eeef97475db8f4c5238b
SHA1c422379acb5c870591b59269e13779e0032767e5
SHA2569e9669b9005e1222bccf9478e453a875bece1b64949fc8cf1e23a9322a327d0b
SHA512ecd42fce61912f753c56ee08884189a449799d41d693011127d365cfd4d1c5d5df053f918518eb79d526d4de59d182dceaaf6009e9d04dacc9329f792c30e066
-
Filesize
72KB
MD5e91cbae18a12eeef97475db8f4c5238b
SHA1c422379acb5c870591b59269e13779e0032767e5
SHA2569e9669b9005e1222bccf9478e453a875bece1b64949fc8cf1e23a9322a327d0b
SHA512ecd42fce61912f753c56ee08884189a449799d41d693011127d365cfd4d1c5d5df053f918518eb79d526d4de59d182dceaaf6009e9d04dacc9329f792c30e066
-
Filesize
72KB
MD5469b055951c416b95ea17799c1f9faec
SHA18e00bf0fbba42079c2de7a7d465260d33f6e5b1e
SHA256856ff21b3b960ae6943f7556cf05d8213d3061b6d9c044f76c0819db301e48af
SHA5124a35444dfd294ff5117c7887df2ebb0e056f3332ac882e0400ec15ec6a0efecda618955dbe1e1ff70270a14832ba5a28632cd8a2bf599c664707acf646ca7e88
-
Filesize
72KB
MD5469b055951c416b95ea17799c1f9faec
SHA18e00bf0fbba42079c2de7a7d465260d33f6e5b1e
SHA256856ff21b3b960ae6943f7556cf05d8213d3061b6d9c044f76c0819db301e48af
SHA5124a35444dfd294ff5117c7887df2ebb0e056f3332ac882e0400ec15ec6a0efecda618955dbe1e1ff70270a14832ba5a28632cd8a2bf599c664707acf646ca7e88
-
Filesize
72KB
MD5e91cbae18a12eeef97475db8f4c5238b
SHA1c422379acb5c870591b59269e13779e0032767e5
SHA2569e9669b9005e1222bccf9478e453a875bece1b64949fc8cf1e23a9322a327d0b
SHA512ecd42fce61912f753c56ee08884189a449799d41d693011127d365cfd4d1c5d5df053f918518eb79d526d4de59d182dceaaf6009e9d04dacc9329f792c30e066
-
Filesize
72KB
MD5e91cbae18a12eeef97475db8f4c5238b
SHA1c422379acb5c870591b59269e13779e0032767e5
SHA2569e9669b9005e1222bccf9478e453a875bece1b64949fc8cf1e23a9322a327d0b
SHA512ecd42fce61912f753c56ee08884189a449799d41d693011127d365cfd4d1c5d5df053f918518eb79d526d4de59d182dceaaf6009e9d04dacc9329f792c30e066
-
Filesize
72KB
MD5b02e6c2c2c7dbfd6442f0f4ea1669233
SHA1649930f2d9059ecd511b306c09af1d2d0e3abe59
SHA256427f90cf0060af9344396295cdb747ad9cd45e2762fc9f92243ce214ea5c953c
SHA5125cc517601ae9e72de3b994a646e7e8309f1a4bbb66c52aa71ea2dba87f8d055686a883225481a34e9cf6f35d975a35df9add7c630b29630e4c6fe21b50a4652d
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD52586a93b1fc8651de02f781230ed9aaa
SHA1cb1e35c9deaece5568c0afa864e1d6884cc17876
SHA2567ea8b7bcc72e52685670b46781c05902ad27870159f533f67a0fbfdd2fd23784
SHA51228748878ff857baded3c04cd6f19a227213484ec0c40f3c60363179331f9a28f0f83660b43dcce9312a02134b97b33d9ec977be91f5213c5990d58d2bd6f6ee8
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD5a49900b9e37abf8fcbe0224f0275c2e5
SHA11743d6833346bcfe4fb24517dd1e48679275389c
SHA2561c1c17266534d323a3d6370a32a3c1c8d46f72b3ef0ac7cd50a2d7baa1946887
SHA51267edefbf1dee6ae2c85f4b08128280b2ed07e62612a00225badfe2e5a54439485edeba7f8942ed5ee1a6a6e69d20838f2996bc196bfc1ddeb678ef752590034e
-
Filesize
72KB
MD5b1534fcc2e8803b32ee4ca0770382899
SHA148d55b9f041570a15613ea54f2121f49a9d2ba85
SHA2567b8f108ec2608e5833ce35a5c89c9303168520dd0ef68336caedf0310b10e32b
SHA51242bad185aa4763ea72675b59a2a654cf3f1ce2ec961b7cf77482b763f064d2009e00d19569bf001feb7bbb486fdd8e1dd4a43e432fbccc40fca8455f42298f3d
-
Filesize
72KB
MD5b1534fcc2e8803b32ee4ca0770382899
SHA148d55b9f041570a15613ea54f2121f49a9d2ba85
SHA2567b8f108ec2608e5833ce35a5c89c9303168520dd0ef68336caedf0310b10e32b
SHA51242bad185aa4763ea72675b59a2a654cf3f1ce2ec961b7cf77482b763f064d2009e00d19569bf001feb7bbb486fdd8e1dd4a43e432fbccc40fca8455f42298f3d
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00
-
Filesize
72KB
MD5bb1c20d8a79df4733c0e191ebfc3f2a8
SHA1a67597f29ed41e9393288769ef852b17c31ccd86
SHA2562e308951553ea0d8a34bf9d8effe76ce06e5fac8aedd76972bb23809fe491051
SHA512e29ee9c9db186c21baed9d486126aba860ebbb084dbfe41a076371d968471747b7a9728bc36978877ae598e0c0b7030549a92a27eda7885658af66e509fcfa00