Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
06/11/2022, 12:31
General
-
Target
87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022.exe
-
Size
72KB
-
MD5
097cf4b184553e8dcabf58666397143b
-
SHA1
6fa2970ac5e5c9becad97979b7d739b5fd05ac55
-
SHA256
87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022
-
SHA512
4b4010be0041e5dc52afb181be207da3f48f117fa36d6f15042d1981f93c17c5dddda09bdc7b61a9b89088474860694f8b938de9d7de4afe34d99bcb8daf9aa1
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf28:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Disables RegEdit via registry modification 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022.exe"C:\Users\Admin\AppData\Local\Temp\87a62558f4ef53bfa41d4d5c813781b944846b7e0131b729f89018fec91c5022.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2357837601\backup.exeC:\Users\Admin\AppData\Local\Temp\2357837601\backup.exe C:\Users\Admin\AppData\Local\Temp\2357837601\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\System Restore.exe"C:\Program Files\7-Zip\System Restore.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Disables RegEdit via registry modification
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\data.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\data.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
-
-
-
-
C:\Program Files\Common Files\Services\update.exe"C:\Program Files\Common Files\Services\update.exe" C:\Program Files\Common Files\Services\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Disables RegEdit via registry modification
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
-
-
C:\Program Files\Common Files\System\ado\fr-FR\update.exe"C:\Program Files\Common Files\System\ado\fr-FR\update.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
-
C:\Program Files\Common Files\System\de-DE\System Restore.exe"C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- System policy modification
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
-
-
C:\Program Files\DVD Maker\es-ES\System Restore.exe"C:\Program Files\DVD Maker\es-ES\System Restore.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\Shared\update.exe"C:\Program Files\DVD Maker\Shared\update.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Drops file in Program Files directory
-
C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
-
-
-
-
-
C:\Program Files\Internet Explorer\data.exe"C:\Program Files\Internet Explorer\data.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
-
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵
-
-
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- System policy modification
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Disables RegEdit via registry modification
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵
- Disables RegEdit via registry modification
-
-
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Disables RegEdit via registry modification
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\update.exe"C:\Program Files (x86)\Common Files\DESIGNER\update.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\7⤵
-
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\7⤵
-
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
- System policy modification
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵
-
C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\7⤵
-
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\7⤵
-
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- System policy modification
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Disables RegEdit via registry modification
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
- System policy modification
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- System policy modification
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- Disables RegEdit via registry modification
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- System policy modification
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵
-
C:\Windows\AppPatch\AppPatch64\backup.exeC:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD51285372ccec5c4c5bf5cfe2fed96eae9
SHA1fe11cf1b15d4b41cb40d3a6b0cd74586692c0966
SHA256e85d131a2de5f68c081854062854fff946730ea1c225943708bf47601ee61d2e
SHA512e146e171106da2b54f63941829811dc7d1685e19147b8199937c992b797524e57c4e15944bff015073f68c2b8eb6fbf4ab66a84fe54f0667cf23d3b7ef488a84
-
Filesize
72KB
MD5038835e36a2b377f114c61cc0ed1b2c3
SHA1144b00624b8d95933e9c159965fc76f0833dd6d0
SHA256e6785c42c6dbc8e66b374fb842455aae4c52a5361bb28a165e783dcad147eb91
SHA51288701f62f582fdee57494a4da39cd649174c9d970a0e01cc233604443acb4026bae9aceefc201c8449db64e09c7fb232c9f0d2f81229404142e37202a80ba85c
-
Filesize
72KB
MD5038835e36a2b377f114c61cc0ed1b2c3
SHA1144b00624b8d95933e9c159965fc76f0833dd6d0
SHA256e6785c42c6dbc8e66b374fb842455aae4c52a5361bb28a165e783dcad147eb91
SHA51288701f62f582fdee57494a4da39cd649174c9d970a0e01cc233604443acb4026bae9aceefc201c8449db64e09c7fb232c9f0d2f81229404142e37202a80ba85c
-
Filesize
72KB
MD562e1b0ba1357093a0a1b2136ddda9246
SHA1ad445138332b20281eb037b3ebff2e1bd938d0a5
SHA2567775ce546dde3a70a54a0164b0f2d551d8cefe452f6ad15191340b1d35f89116
SHA51209aa1887cfe6d46d18256472e80686e786c67e29fa31b66be35ff6f8d3adb58ec40b785b44a8024b7ee8e95bcf127dfb9322b6a13a3f256ca8e1a66368fca52b
-
Filesize
72KB
MD5959ab022ffd6eec049b985efcba70340
SHA18feb9640041677c09807f3a77636df30604b1687
SHA25665723ae0384ab25114c70180800e2aa4f282519222dab43c934d8e8e37c0cc58
SHA5128c652569212fd7929eb65113a060eddd50f64dd818198deb882cf9c159a2ec9269e4fd5a7515860423843200a3104e4398222c49b9aded4a959d6cb9e250897f
-
Filesize
72KB
MD5959ab022ffd6eec049b985efcba70340
SHA18feb9640041677c09807f3a77636df30604b1687
SHA25665723ae0384ab25114c70180800e2aa4f282519222dab43c934d8e8e37c0cc58
SHA5128c652569212fd7929eb65113a060eddd50f64dd818198deb882cf9c159a2ec9269e4fd5a7515860423843200a3104e4398222c49b9aded4a959d6cb9e250897f
-
Filesize
72KB
MD5ccf61aa0a383c110e7813a5f4d21a222
SHA1d741a29d232ceec4aaa32626002e70a969cf853f
SHA256112c29077522a9e24517bcc97235a9d18f0bef5cc5716063c72019a8b571a029
SHA5128df7ff49c3239f2e23bafa219969e02053e0ee60247d9cd2a08b4f409e8d31543381c7dbe9c9460347a5d7a79de5550521f172c2ff3777200b6cbaca0e0540eb
-
Filesize
72KB
MD5d2915647b9f3ba26b1ebd91669423681
SHA1e9bf4ebdd6d5aad20e76f718e263948bd4419e0b
SHA25635d6690441129d1671992a66adce373b2969a34050ddb0a922fefbecb105488c
SHA5120d9d476c25ffcf76c097ea908b3aec822e5232e3633817a685a9ddf574aa786cb7abb986951ce94a77c663354a0b4f18420ace7ec30e4a8d4a5196b0504327a3
-
Filesize
72KB
MD5d2915647b9f3ba26b1ebd91669423681
SHA1e9bf4ebdd6d5aad20e76f718e263948bd4419e0b
SHA25635d6690441129d1671992a66adce373b2969a34050ddb0a922fefbecb105488c
SHA5120d9d476c25ffcf76c097ea908b3aec822e5232e3633817a685a9ddf574aa786cb7abb986951ce94a77c663354a0b4f18420ace7ec30e4a8d4a5196b0504327a3
-
Filesize
72KB
MD53ddcad76b8e0f4a996f3db28f099e7c1
SHA11a9fadf53905be2042f8f82fbb453d8a94178051
SHA256c561cd019ee923e9db508c395f13e119e5eae41e2a0a3cecb7776d2f92f63a8d
SHA5128f66a4e97eaa3980c0da1958c720869b4ae1a7bac3c4c50fb7d69088b1020573c86337f8cf7f6d5ac79b3a20d2daffd80ecd98851993e3c3847c500932f81e8a
-
Filesize
72KB
MD5b2cedcbb57418c468922439e15a0f12d
SHA139c2dd8468caabf75778970438ffd4d76df711ce
SHA2562bd97ce1100e2eac0457c18b48c10f98175685abb20874a37293e82ccdba130a
SHA5128f512be5b631dc6e7127c12fa3e4c756b207ccf121199c394f06c340250bbdaedbca2e3b942da449c691f1c5adb66bccf64af73c4a33128a10537ba69070a5fd
-
Filesize
72KB
MD5b2cedcbb57418c468922439e15a0f12d
SHA139c2dd8468caabf75778970438ffd4d76df711ce
SHA2562bd97ce1100e2eac0457c18b48c10f98175685abb20874a37293e82ccdba130a
SHA5128f512be5b631dc6e7127c12fa3e4c756b207ccf121199c394f06c340250bbdaedbca2e3b942da449c691f1c5adb66bccf64af73c4a33128a10537ba69070a5fd
-
Filesize
72KB
MD53ddcad76b8e0f4a996f3db28f099e7c1
SHA11a9fadf53905be2042f8f82fbb453d8a94178051
SHA256c561cd019ee923e9db508c395f13e119e5eae41e2a0a3cecb7776d2f92f63a8d
SHA5128f66a4e97eaa3980c0da1958c720869b4ae1a7bac3c4c50fb7d69088b1020573c86337f8cf7f6d5ac79b3a20d2daffd80ecd98851993e3c3847c500932f81e8a
-
Filesize
72KB
MD5f64c6fc934e1d7a012b6cca73205e7c2
SHA1821eec0ec6e52ac169aea95c31e16610da6cea4e
SHA25696893e1a76aedcab14d88eac39ef3ac112d1bdd91c8d503161220dec413282f6
SHA512b1eb657299de6848a7fdc05211e2989bdf53228ac417c3313c7c9ecc525f7e104cf89668b157943668b5cd3b4ffcfdd1121b949e87d640c958bfb04ee6b2adda
-
Filesize
72KB
MD5f64c6fc934e1d7a012b6cca73205e7c2
SHA1821eec0ec6e52ac169aea95c31e16610da6cea4e
SHA25696893e1a76aedcab14d88eac39ef3ac112d1bdd91c8d503161220dec413282f6
SHA512b1eb657299de6848a7fdc05211e2989bdf53228ac417c3313c7c9ecc525f7e104cf89668b157943668b5cd3b4ffcfdd1121b949e87d640c958bfb04ee6b2adda
-
Filesize
72KB
MD5c733e488f8c78d1f2737bd9fc178abbe
SHA1652890d9399c1352ddc85c5597ee0f04599baa68
SHA25648713b2c45d183b33f3be53874f3215a2968460ea619e1ad9ba7dd635600983f
SHA51206eafdabdb0ffe885232c3b6f790c4ab1d8d2a02a61ed4ff8a0188c8b87870b08ed0455ac4ae98a9cddce49b29bea5fe91fe736ca8ad7011d690e2f02348fc3c
-
Filesize
72KB
MD5c733e488f8c78d1f2737bd9fc178abbe
SHA1652890d9399c1352ddc85c5597ee0f04599baa68
SHA25648713b2c45d183b33f3be53874f3215a2968460ea619e1ad9ba7dd635600983f
SHA51206eafdabdb0ffe885232c3b6f790c4ab1d8d2a02a61ed4ff8a0188c8b87870b08ed0455ac4ae98a9cddce49b29bea5fe91fe736ca8ad7011d690e2f02348fc3c
-
Filesize
72KB
MD55478cb5350a5341fce25c3513d9d3a91
SHA14d7dcf53011a5a71532751d269305e912d8f32db
SHA256f2aaba26b627e5666c43bb7eb15d878505435467021faf0cdc8526c3d4196a93
SHA5121f16f89eb183983ab374326f9b73f43f6d334bb5a6e7bc7966ce3966be5f2b75f0a30086aa6d49462c66892e955ca058cd291374ec20586c90c80e3d6da472f6
-
Filesize
72KB
MD55478cb5350a5341fce25c3513d9d3a91
SHA14d7dcf53011a5a71532751d269305e912d8f32db
SHA256f2aaba26b627e5666c43bb7eb15d878505435467021faf0cdc8526c3d4196a93
SHA5121f16f89eb183983ab374326f9b73f43f6d334bb5a6e7bc7966ce3966be5f2b75f0a30086aa6d49462c66892e955ca058cd291374ec20586c90c80e3d6da472f6
-
Filesize
72KB
MD55687dc9b80e078792f34e962f9d3aea9
SHA112d2bc6742901df6e034e28c6b1da13159b9bf32
SHA256064e04942ab8f268d3c74671f4535731d3bf7d849f223dc0ba9522781e52f339
SHA5123f1929b3b1be05014c161bfb9e82f3b8f89c48b57dc9777399c8fa58b2149f9ff53a2c994eda7b514fe1474a853f39cdb2525235daa9a8b47b4c8c204d070cfa
-
Filesize
72KB
MD55687dc9b80e078792f34e962f9d3aea9
SHA112d2bc6742901df6e034e28c6b1da13159b9bf32
SHA256064e04942ab8f268d3c74671f4535731d3bf7d849f223dc0ba9522781e52f339
SHA5123f1929b3b1be05014c161bfb9e82f3b8f89c48b57dc9777399c8fa58b2149f9ff53a2c994eda7b514fe1474a853f39cdb2525235daa9a8b47b4c8c204d070cfa
-
Filesize
72KB
MD51d68c43bd73bb6f080e43f5349de03ef
SHA19c2e8cd71f2c62bc51cf55f5fd7b98b9a63ddf3d
SHA256d6678f9f7f0f9b9a5fa5fd708632b0e1252fca8b123f0457a0db2ce8146aab2b
SHA5125b837cfd50dbb8ccd9256bb6747eebc44694c51cf2f25d638623dcd922d0e04a68f159c3b472e32cb7627dbadd4f0e79f5d6e1b958ceac70a77179478ef0a54a
-
Filesize
72KB
MD574609bad4e70ed98963164c9549586ab
SHA1a7c020651786142246b5845537e2eedd12d1453e
SHA256e84e870af4182ff912c8f2816d937e61d37f7b4601af08d523a16d6dbaf87dcc
SHA5127703cabce1cd97c126ee691dbbaefa6f5c6f8fc43c7e2a8c5083f5425c25ba85dc39b9b7e1ccefcf271337b7c25edfb24abde1a6289a0bdc349b9852166b7b4c
-
Filesize
72KB
MD5f28587392ad75cd5a682b2b4c35ca867
SHA19ff5b0d2a9f21419b48228958096443f2aaf9b6c
SHA25622ee7e36a7601c414f4a8f3157d50f3e59f02d769f73f99e12da733aeed0bc34
SHA512ed812d002371b0bdca29e443933d8d205286703c8122e990257f847239d5d805ff35d87e8e22fe5db16c982a55ab6a7151fb42231f2e12957ac5810265931719
-
Filesize
72KB
MD51d68c43bd73bb6f080e43f5349de03ef
SHA19c2e8cd71f2c62bc51cf55f5fd7b98b9a63ddf3d
SHA256d6678f9f7f0f9b9a5fa5fd708632b0e1252fca8b123f0457a0db2ce8146aab2b
SHA5125b837cfd50dbb8ccd9256bb6747eebc44694c51cf2f25d638623dcd922d0e04a68f159c3b472e32cb7627dbadd4f0e79f5d6e1b958ceac70a77179478ef0a54a
-
Filesize
72KB
MD5a77d7298cff85fd7c007fde541e3c2f2
SHA1c790537abfe66c10561a55955d7283b32443c8ec
SHA25648247fcd92ea81f5bf02900e8c3b1a1c60c5fb566e47ba7c1878fae2bf3c5179
SHA5122b91b6ae78209b9f491d3c5555b292ac15812ffa0d7b4b205a5d7e943385aa8daa7db5765156f6a7389e680d268b42d11302c69c47a7aa1cc6b6d8928d3b5f36
-
Filesize
72KB
MD5a77d7298cff85fd7c007fde541e3c2f2
SHA1c790537abfe66c10561a55955d7283b32443c8ec
SHA25648247fcd92ea81f5bf02900e8c3b1a1c60c5fb566e47ba7c1878fae2bf3c5179
SHA5122b91b6ae78209b9f491d3c5555b292ac15812ffa0d7b4b205a5d7e943385aa8daa7db5765156f6a7389e680d268b42d11302c69c47a7aa1cc6b6d8928d3b5f36
-
Filesize
72KB
MD51285372ccec5c4c5bf5cfe2fed96eae9
SHA1fe11cf1b15d4b41cb40d3a6b0cd74586692c0966
SHA256e85d131a2de5f68c081854062854fff946730ea1c225943708bf47601ee61d2e
SHA512e146e171106da2b54f63941829811dc7d1685e19147b8199937c992b797524e57c4e15944bff015073f68c2b8eb6fbf4ab66a84fe54f0667cf23d3b7ef488a84
-
Filesize
72KB
MD51285372ccec5c4c5bf5cfe2fed96eae9
SHA1fe11cf1b15d4b41cb40d3a6b0cd74586692c0966
SHA256e85d131a2de5f68c081854062854fff946730ea1c225943708bf47601ee61d2e
SHA512e146e171106da2b54f63941829811dc7d1685e19147b8199937c992b797524e57c4e15944bff015073f68c2b8eb6fbf4ab66a84fe54f0667cf23d3b7ef488a84
-
Filesize
72KB
MD5038835e36a2b377f114c61cc0ed1b2c3
SHA1144b00624b8d95933e9c159965fc76f0833dd6d0
SHA256e6785c42c6dbc8e66b374fb842455aae4c52a5361bb28a165e783dcad147eb91
SHA51288701f62f582fdee57494a4da39cd649174c9d970a0e01cc233604443acb4026bae9aceefc201c8449db64e09c7fb232c9f0d2f81229404142e37202a80ba85c
-
Filesize
72KB
MD5038835e36a2b377f114c61cc0ed1b2c3
SHA1144b00624b8d95933e9c159965fc76f0833dd6d0
SHA256e6785c42c6dbc8e66b374fb842455aae4c52a5361bb28a165e783dcad147eb91
SHA51288701f62f582fdee57494a4da39cd649174c9d970a0e01cc233604443acb4026bae9aceefc201c8449db64e09c7fb232c9f0d2f81229404142e37202a80ba85c
-
Filesize
72KB
MD562e1b0ba1357093a0a1b2136ddda9246
SHA1ad445138332b20281eb037b3ebff2e1bd938d0a5
SHA2567775ce546dde3a70a54a0164b0f2d551d8cefe452f6ad15191340b1d35f89116
SHA51209aa1887cfe6d46d18256472e80686e786c67e29fa31b66be35ff6f8d3adb58ec40b785b44a8024b7ee8e95bcf127dfb9322b6a13a3f256ca8e1a66368fca52b
-
Filesize
72KB
MD562e1b0ba1357093a0a1b2136ddda9246
SHA1ad445138332b20281eb037b3ebff2e1bd938d0a5
SHA2567775ce546dde3a70a54a0164b0f2d551d8cefe452f6ad15191340b1d35f89116
SHA51209aa1887cfe6d46d18256472e80686e786c67e29fa31b66be35ff6f8d3adb58ec40b785b44a8024b7ee8e95bcf127dfb9322b6a13a3f256ca8e1a66368fca52b
-
Filesize
72KB
MD5959ab022ffd6eec049b985efcba70340
SHA18feb9640041677c09807f3a77636df30604b1687
SHA25665723ae0384ab25114c70180800e2aa4f282519222dab43c934d8e8e37c0cc58
SHA5128c652569212fd7929eb65113a060eddd50f64dd818198deb882cf9c159a2ec9269e4fd5a7515860423843200a3104e4398222c49b9aded4a959d6cb9e250897f
-
Filesize
72KB
MD5959ab022ffd6eec049b985efcba70340
SHA18feb9640041677c09807f3a77636df30604b1687
SHA25665723ae0384ab25114c70180800e2aa4f282519222dab43c934d8e8e37c0cc58
SHA5128c652569212fd7929eb65113a060eddd50f64dd818198deb882cf9c159a2ec9269e4fd5a7515860423843200a3104e4398222c49b9aded4a959d6cb9e250897f
-
Filesize
72KB
MD5ccf61aa0a383c110e7813a5f4d21a222
SHA1d741a29d232ceec4aaa32626002e70a969cf853f
SHA256112c29077522a9e24517bcc97235a9d18f0bef5cc5716063c72019a8b571a029
SHA5128df7ff49c3239f2e23bafa219969e02053e0ee60247d9cd2a08b4f409e8d31543381c7dbe9c9460347a5d7a79de5550521f172c2ff3777200b6cbaca0e0540eb
-
Filesize
72KB
MD5ccf61aa0a383c110e7813a5f4d21a222
SHA1d741a29d232ceec4aaa32626002e70a969cf853f
SHA256112c29077522a9e24517bcc97235a9d18f0bef5cc5716063c72019a8b571a029
SHA5128df7ff49c3239f2e23bafa219969e02053e0ee60247d9cd2a08b4f409e8d31543381c7dbe9c9460347a5d7a79de5550521f172c2ff3777200b6cbaca0e0540eb
-
Filesize
72KB
MD5d2915647b9f3ba26b1ebd91669423681
SHA1e9bf4ebdd6d5aad20e76f718e263948bd4419e0b
SHA25635d6690441129d1671992a66adce373b2969a34050ddb0a922fefbecb105488c
SHA5120d9d476c25ffcf76c097ea908b3aec822e5232e3633817a685a9ddf574aa786cb7abb986951ce94a77c663354a0b4f18420ace7ec30e4a8d4a5196b0504327a3
-
Filesize
72KB
MD5d2915647b9f3ba26b1ebd91669423681
SHA1e9bf4ebdd6d5aad20e76f718e263948bd4419e0b
SHA25635d6690441129d1671992a66adce373b2969a34050ddb0a922fefbecb105488c
SHA5120d9d476c25ffcf76c097ea908b3aec822e5232e3633817a685a9ddf574aa786cb7abb986951ce94a77c663354a0b4f18420ace7ec30e4a8d4a5196b0504327a3
-
Filesize
72KB
MD53ddcad76b8e0f4a996f3db28f099e7c1
SHA11a9fadf53905be2042f8f82fbb453d8a94178051
SHA256c561cd019ee923e9db508c395f13e119e5eae41e2a0a3cecb7776d2f92f63a8d
SHA5128f66a4e97eaa3980c0da1958c720869b4ae1a7bac3c4c50fb7d69088b1020573c86337f8cf7f6d5ac79b3a20d2daffd80ecd98851993e3c3847c500932f81e8a
-
Filesize
72KB
MD53ddcad76b8e0f4a996f3db28f099e7c1
SHA11a9fadf53905be2042f8f82fbb453d8a94178051
SHA256c561cd019ee923e9db508c395f13e119e5eae41e2a0a3cecb7776d2f92f63a8d
SHA5128f66a4e97eaa3980c0da1958c720869b4ae1a7bac3c4c50fb7d69088b1020573c86337f8cf7f6d5ac79b3a20d2daffd80ecd98851993e3c3847c500932f81e8a
-
Filesize
72KB
MD5b2cedcbb57418c468922439e15a0f12d
SHA139c2dd8468caabf75778970438ffd4d76df711ce
SHA2562bd97ce1100e2eac0457c18b48c10f98175685abb20874a37293e82ccdba130a
SHA5128f512be5b631dc6e7127c12fa3e4c756b207ccf121199c394f06c340250bbdaedbca2e3b942da449c691f1c5adb66bccf64af73c4a33128a10537ba69070a5fd
-
Filesize
72KB
MD5b2cedcbb57418c468922439e15a0f12d
SHA139c2dd8468caabf75778970438ffd4d76df711ce
SHA2562bd97ce1100e2eac0457c18b48c10f98175685abb20874a37293e82ccdba130a
SHA5128f512be5b631dc6e7127c12fa3e4c756b207ccf121199c394f06c340250bbdaedbca2e3b942da449c691f1c5adb66bccf64af73c4a33128a10537ba69070a5fd
-
Filesize
72KB
MD53ddcad76b8e0f4a996f3db28f099e7c1
SHA11a9fadf53905be2042f8f82fbb453d8a94178051
SHA256c561cd019ee923e9db508c395f13e119e5eae41e2a0a3cecb7776d2f92f63a8d
SHA5128f66a4e97eaa3980c0da1958c720869b4ae1a7bac3c4c50fb7d69088b1020573c86337f8cf7f6d5ac79b3a20d2daffd80ecd98851993e3c3847c500932f81e8a
-
Filesize
72KB
MD53ddcad76b8e0f4a996f3db28f099e7c1
SHA11a9fadf53905be2042f8f82fbb453d8a94178051
SHA256c561cd019ee923e9db508c395f13e119e5eae41e2a0a3cecb7776d2f92f63a8d
SHA5128f66a4e97eaa3980c0da1958c720869b4ae1a7bac3c4c50fb7d69088b1020573c86337f8cf7f6d5ac79b3a20d2daffd80ecd98851993e3c3847c500932f81e8a
-
Filesize
72KB
MD5ba3990904e5aa26cd37058bdcfd6da81
SHA1b65355453f8833a5850101581c10d6e69adc104e
SHA2568a3c6b437bc1f370a7ca61a59847ee4acdcef4b41825776dfdb322447751d589
SHA51232376032a8e7318595dbb52dafa3100edad1bd236df20b86d9dad5b2f887d9efb04a35210d40869d94e79ebeaaa9f2f751c73f7b9b74c2883e7aaa33ae16cc86
-
Filesize
72KB
MD5f64c6fc934e1d7a012b6cca73205e7c2
SHA1821eec0ec6e52ac169aea95c31e16610da6cea4e
SHA25696893e1a76aedcab14d88eac39ef3ac112d1bdd91c8d503161220dec413282f6
SHA512b1eb657299de6848a7fdc05211e2989bdf53228ac417c3313c7c9ecc525f7e104cf89668b157943668b5cd3b4ffcfdd1121b949e87d640c958bfb04ee6b2adda
-
Filesize
72KB
MD5f64c6fc934e1d7a012b6cca73205e7c2
SHA1821eec0ec6e52ac169aea95c31e16610da6cea4e
SHA25696893e1a76aedcab14d88eac39ef3ac112d1bdd91c8d503161220dec413282f6
SHA512b1eb657299de6848a7fdc05211e2989bdf53228ac417c3313c7c9ecc525f7e104cf89668b157943668b5cd3b4ffcfdd1121b949e87d640c958bfb04ee6b2adda
-
Filesize
72KB
MD5c733e488f8c78d1f2737bd9fc178abbe
SHA1652890d9399c1352ddc85c5597ee0f04599baa68
SHA25648713b2c45d183b33f3be53874f3215a2968460ea619e1ad9ba7dd635600983f
SHA51206eafdabdb0ffe885232c3b6f790c4ab1d8d2a02a61ed4ff8a0188c8b87870b08ed0455ac4ae98a9cddce49b29bea5fe91fe736ca8ad7011d690e2f02348fc3c
-
Filesize
72KB
MD5c733e488f8c78d1f2737bd9fc178abbe
SHA1652890d9399c1352ddc85c5597ee0f04599baa68
SHA25648713b2c45d183b33f3be53874f3215a2968460ea619e1ad9ba7dd635600983f
SHA51206eafdabdb0ffe885232c3b6f790c4ab1d8d2a02a61ed4ff8a0188c8b87870b08ed0455ac4ae98a9cddce49b29bea5fe91fe736ca8ad7011d690e2f02348fc3c
-
Filesize
72KB
MD55478cb5350a5341fce25c3513d9d3a91
SHA14d7dcf53011a5a71532751d269305e912d8f32db
SHA256f2aaba26b627e5666c43bb7eb15d878505435467021faf0cdc8526c3d4196a93
SHA5121f16f89eb183983ab374326f9b73f43f6d334bb5a6e7bc7966ce3966be5f2b75f0a30086aa6d49462c66892e955ca058cd291374ec20586c90c80e3d6da472f6
-
Filesize
72KB
MD55478cb5350a5341fce25c3513d9d3a91
SHA14d7dcf53011a5a71532751d269305e912d8f32db
SHA256f2aaba26b627e5666c43bb7eb15d878505435467021faf0cdc8526c3d4196a93
SHA5121f16f89eb183983ab374326f9b73f43f6d334bb5a6e7bc7966ce3966be5f2b75f0a30086aa6d49462c66892e955ca058cd291374ec20586c90c80e3d6da472f6
-
Filesize
72KB
MD55687dc9b80e078792f34e962f9d3aea9
SHA112d2bc6742901df6e034e28c6b1da13159b9bf32
SHA256064e04942ab8f268d3c74671f4535731d3bf7d849f223dc0ba9522781e52f339
SHA5123f1929b3b1be05014c161bfb9e82f3b8f89c48b57dc9777399c8fa58b2149f9ff53a2c994eda7b514fe1474a853f39cdb2525235daa9a8b47b4c8c204d070cfa
-
Filesize
72KB
MD55687dc9b80e078792f34e962f9d3aea9
SHA112d2bc6742901df6e034e28c6b1da13159b9bf32
SHA256064e04942ab8f268d3c74671f4535731d3bf7d849f223dc0ba9522781e52f339
SHA5123f1929b3b1be05014c161bfb9e82f3b8f89c48b57dc9777399c8fa58b2149f9ff53a2c994eda7b514fe1474a853f39cdb2525235daa9a8b47b4c8c204d070cfa
-
Filesize
72KB
MD55687dc9b80e078792f34e962f9d3aea9
SHA112d2bc6742901df6e034e28c6b1da13159b9bf32
SHA256064e04942ab8f268d3c74671f4535731d3bf7d849f223dc0ba9522781e52f339
SHA5123f1929b3b1be05014c161bfb9e82f3b8f89c48b57dc9777399c8fa58b2149f9ff53a2c994eda7b514fe1474a853f39cdb2525235daa9a8b47b4c8c204d070cfa
-
Filesize
72KB
MD55687dc9b80e078792f34e962f9d3aea9
SHA112d2bc6742901df6e034e28c6b1da13159b9bf32
SHA256064e04942ab8f268d3c74671f4535731d3bf7d849f223dc0ba9522781e52f339
SHA5123f1929b3b1be05014c161bfb9e82f3b8f89c48b57dc9777399c8fa58b2149f9ff53a2c994eda7b514fe1474a853f39cdb2525235daa9a8b47b4c8c204d070cfa
-
Filesize
72KB
MD51d68c43bd73bb6f080e43f5349de03ef
SHA19c2e8cd71f2c62bc51cf55f5fd7b98b9a63ddf3d
SHA256d6678f9f7f0f9b9a5fa5fd708632b0e1252fca8b123f0457a0db2ce8146aab2b
SHA5125b837cfd50dbb8ccd9256bb6747eebc44694c51cf2f25d638623dcd922d0e04a68f159c3b472e32cb7627dbadd4f0e79f5d6e1b958ceac70a77179478ef0a54a
-
Filesize
72KB
MD51d68c43bd73bb6f080e43f5349de03ef
SHA19c2e8cd71f2c62bc51cf55f5fd7b98b9a63ddf3d
SHA256d6678f9f7f0f9b9a5fa5fd708632b0e1252fca8b123f0457a0db2ce8146aab2b
SHA5125b837cfd50dbb8ccd9256bb6747eebc44694c51cf2f25d638623dcd922d0e04a68f159c3b472e32cb7627dbadd4f0e79f5d6e1b958ceac70a77179478ef0a54a
-
Filesize
72KB
MD574609bad4e70ed98963164c9549586ab
SHA1a7c020651786142246b5845537e2eedd12d1453e
SHA256e84e870af4182ff912c8f2816d937e61d37f7b4601af08d523a16d6dbaf87dcc
SHA5127703cabce1cd97c126ee691dbbaefa6f5c6f8fc43c7e2a8c5083f5425c25ba85dc39b9b7e1ccefcf271337b7c25edfb24abde1a6289a0bdc349b9852166b7b4c
-
Filesize
72KB
MD574609bad4e70ed98963164c9549586ab
SHA1a7c020651786142246b5845537e2eedd12d1453e
SHA256e84e870af4182ff912c8f2816d937e61d37f7b4601af08d523a16d6dbaf87dcc
SHA5127703cabce1cd97c126ee691dbbaefa6f5c6f8fc43c7e2a8c5083f5425c25ba85dc39b9b7e1ccefcf271337b7c25edfb24abde1a6289a0bdc349b9852166b7b4c
-
Filesize
72KB
MD5f28587392ad75cd5a682b2b4c35ca867
SHA19ff5b0d2a9f21419b48228958096443f2aaf9b6c
SHA25622ee7e36a7601c414f4a8f3157d50f3e59f02d769f73f99e12da733aeed0bc34
SHA512ed812d002371b0bdca29e443933d8d205286703c8122e990257f847239d5d805ff35d87e8e22fe5db16c982a55ab6a7151fb42231f2e12957ac5810265931719
-
Filesize
72KB
MD5f28587392ad75cd5a682b2b4c35ca867
SHA19ff5b0d2a9f21419b48228958096443f2aaf9b6c
SHA25622ee7e36a7601c414f4a8f3157d50f3e59f02d769f73f99e12da733aeed0bc34
SHA512ed812d002371b0bdca29e443933d8d205286703c8122e990257f847239d5d805ff35d87e8e22fe5db16c982a55ab6a7151fb42231f2e12957ac5810265931719
-
Filesize
72KB
MD51d68c43bd73bb6f080e43f5349de03ef
SHA19c2e8cd71f2c62bc51cf55f5fd7b98b9a63ddf3d
SHA256d6678f9f7f0f9b9a5fa5fd708632b0e1252fca8b123f0457a0db2ce8146aab2b
SHA5125b837cfd50dbb8ccd9256bb6747eebc44694c51cf2f25d638623dcd922d0e04a68f159c3b472e32cb7627dbadd4f0e79f5d6e1b958ceac70a77179478ef0a54a
-
Filesize
72KB
MD51d68c43bd73bb6f080e43f5349de03ef
SHA19c2e8cd71f2c62bc51cf55f5fd7b98b9a63ddf3d
SHA256d6678f9f7f0f9b9a5fa5fd708632b0e1252fca8b123f0457a0db2ce8146aab2b
SHA5125b837cfd50dbb8ccd9256bb6747eebc44694c51cf2f25d638623dcd922d0e04a68f159c3b472e32cb7627dbadd4f0e79f5d6e1b958ceac70a77179478ef0a54a
-
Filesize
8KB
-
Filesize
8KB