Analysis
-
max time kernel
156s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07/11/2022, 00:27
General
-
Target
f38d597571263afb5fada39707610a9567bfc0febf7145b225992c0babf023f4.exe
-
Size
72KB
-
MD5
043969b9c3e1be1a1467b194d6be8615
-
SHA1
72b0963368af678b3ddf0931150ef1c77fd2da20
-
SHA256
f38d597571263afb5fada39707610a9567bfc0febf7145b225992c0babf023f4
-
SHA512
8536298f93bc7ce4ed1052b59c5ab18b6c82923ee9991f3cfb2b601560f274b0d0fa44a84762d34949a5344e2d7cb0b88d3864cf86b8e6e8ab8968b0fc059f91
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2k:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Disables RegEdit via registry modification 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f38d597571263afb5fada39707610a9567bfc0febf7145b225992c0babf023f4.exe"C:\Users\Admin\AppData\Local\Temp\f38d597571263afb5fada39707610a9567bfc0febf7145b225992c0babf023f4.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\143093843\backup.exeC:\Users\Admin\AppData\Local\Temp\143093843\backup.exe C:\Users\Admin\AppData\Local\Temp\143093843\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
-
-
C:\Program Files\Internet Explorer\es-ES\data.exe"C:\Program Files\Internet Explorer\es-ES\data.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
-
-
C:\Program Files\Java\jre7\System Restore.exe"C:\Program Files\Java\jre7\System Restore.exe" C:\Program Files\Java\jre7\6⤵
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵
-
-
C:\Program Files\Microsoft Games\FreeCell\data.exe"C:\Program Files\Microsoft Games\FreeCell\data.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵
-
-
C:\Program Files\Microsoft Games\Hearts\backup.exe"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\6⤵
-
-
C:\Program Files\Microsoft Games\Mahjong\backup.exe"C:\Program Files\Microsoft Games\Mahjong\backup.exe" C:\Program Files\Microsoft Games\Mahjong\6⤵
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- System policy modification
-
C:\Program Files\Microsoft Office\Office14\backup.exe"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Microsoft Office\Office14\1033\backup.exe"C:\Program Files\Microsoft Office\Office14\1033\backup.exe" C:\Program Files\Microsoft Office\Office14\1033\7⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Disables RegEdit via registry modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe"C:\Program Files (x86)\Common Files\SpeechEngines\System Restore.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵
-
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe"C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\6⤵
-
-
C:\Program Files (x86)\Microsoft Office\Document Themes 14\System Restore.exe"C:\Program Files (x86)\Microsoft Office\Document Themes 14\System Restore.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\6⤵
-
-
C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe"C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\6⤵
-
-
C:\Program Files (x86)\Microsoft Office\Office14\backup.exe"C:\Program Files (x86)\Microsoft Office\Office14\backup.exe" C:\Program Files (x86)\Microsoft Office\Office14\6⤵
-
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- System policy modification
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD572f69eb93d8d903ed06c8f793bfce427
SHA1d8b7bb691a9e9b6f5114aa2a58ba0a2819d06df5
SHA25688fa7f9c9b3b18f12cdceafc2b153eb08e8790e43361fe5216a393ad043a310d
SHA51294c1eb4e965fc96db899b43fed95154a0ba38c0f09668335ed2d41963073cbc40f773726f5edfcf5cb373836989ce7fa9ebe7121f22ace19b481b6684e097d37
-
Filesize
72KB
MD53e2742942aa6c8c3057c517785099f17
SHA1ace5534dec4ac27d62f7485409056b6f03530158
SHA25616bd20b602077b1ab7207efc16cf966690248b504c8714a2c3234c3e972578d1
SHA512b97369956a8f0cf78a4612067e21ca10f7296dd52141cc7819e2f8a4156dd18be274148287be36070535c82659b9acf188fa1dde0505ed54d7ad07c104f2b327
-
Filesize
72KB
MD53e2742942aa6c8c3057c517785099f17
SHA1ace5534dec4ac27d62f7485409056b6f03530158
SHA25616bd20b602077b1ab7207efc16cf966690248b504c8714a2c3234c3e972578d1
SHA512b97369956a8f0cf78a4612067e21ca10f7296dd52141cc7819e2f8a4156dd18be274148287be36070535c82659b9acf188fa1dde0505ed54d7ad07c104f2b327
-
Filesize
72KB
MD55cffdbfbe0c1051baefedf9505b4bd0e
SHA1f238491fb16fd4ff8093ca5eaee19da53f77b6ff
SHA25621a019ff665edebef56724c4d737d1fb7ca7da94e381ba5691d9a1abfe6994f0
SHA512f57cd21bed5f75bc4dde4be19aace3649e73412a68507e79069f85f2000fefc9ea63b8a7a15cee196bff20894d2a47237fd5e32380e47e94fa702f2acc024d20
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD5006c8d279de3798ad80f7adc4c1fa59a
SHA1444339b5a89b2edfffc01e318471c2d4635198dc
SHA256ede1851644aefc02836475d0d82282284ce7c1495f7a706109147864dbb53217
SHA512f4f22a5d7e6cb2fcaf7d587ba81257a257a3b24949be96ecacc0c575b9537b36cb949b5584a1b7eb5b5f68263d77cae85e7946cfb8925f14772ce5e49e7667aa
-
Filesize
72KB
MD5e885d8a4902306fd2af9ed8458219d9e
SHA1f3a4e19d24ebfe11486311fc994b49daebeab191
SHA256838052cc9270c8ed15538487031b635824fdd4a21dc5282b06e4352f6923eb1a
SHA512f05483fbcc3c30a8ebeb0d44a82b284ca7949d01c7d2dfa0a5b37e8b2b568392cc89de54171c41b042d2723a3df2ead1cec0bda837343f851fade4a715560567
-
Filesize
72KB
MD5e885d8a4902306fd2af9ed8458219d9e
SHA1f3a4e19d24ebfe11486311fc994b49daebeab191
SHA256838052cc9270c8ed15538487031b635824fdd4a21dc5282b06e4352f6923eb1a
SHA512f05483fbcc3c30a8ebeb0d44a82b284ca7949d01c7d2dfa0a5b37e8b2b568392cc89de54171c41b042d2723a3df2ead1cec0bda837343f851fade4a715560567
-
Filesize
72KB
MD53bb0c2e50d2680d386391db18cc0c445
SHA1ae1923e0082a0b299d47c9f705c6a0da94e50276
SHA2567ae3ff695b01110a1c4d6dde2738aaabee644303b04c342b535e8065ad7532b3
SHA512b4cc22860663b6cd95998af5165f66621b9514286c49f76ac0297224b83b15c1ee2668bc44609c28eebc7524720fe09e9693fe5c681fdbc488c3c7facb75a175
-
Filesize
72KB
MD5006c8d279de3798ad80f7adc4c1fa59a
SHA1444339b5a89b2edfffc01e318471c2d4635198dc
SHA256ede1851644aefc02836475d0d82282284ce7c1495f7a706109147864dbb53217
SHA512f4f22a5d7e6cb2fcaf7d587ba81257a257a3b24949be96ecacc0c575b9537b36cb949b5584a1b7eb5b5f68263d77cae85e7946cfb8925f14772ce5e49e7667aa
-
Filesize
72KB
MD5006c8d279de3798ad80f7adc4c1fa59a
SHA1444339b5a89b2edfffc01e318471c2d4635198dc
SHA256ede1851644aefc02836475d0d82282284ce7c1495f7a706109147864dbb53217
SHA512f4f22a5d7e6cb2fcaf7d587ba81257a257a3b24949be96ecacc0c575b9537b36cb949b5584a1b7eb5b5f68263d77cae85e7946cfb8925f14772ce5e49e7667aa
-
Filesize
72KB
MD53bb0c2e50d2680d386391db18cc0c445
SHA1ae1923e0082a0b299d47c9f705c6a0da94e50276
SHA2567ae3ff695b01110a1c4d6dde2738aaabee644303b04c342b535e8065ad7532b3
SHA512b4cc22860663b6cd95998af5165f66621b9514286c49f76ac0297224b83b15c1ee2668bc44609c28eebc7524720fe09e9693fe5c681fdbc488c3c7facb75a175
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD59fe93d2aa7fb0c61c0ebc9bdb7a5320c
SHA1905b4bbe79eb52d3ae44a7075cb92d824f726585
SHA256057bed5a7086748e8775dcf108d4105093676087b3a774d05ccf3c85498b3a8f
SHA5126888e0c3541cdfb4c39b27c2e4841d762247856ef1862795c2d58233aeb459933b79ab4ec07826712be4365aec0b8c6566ee9631e83b8f7d36ca0f2a760f33f7
-
Filesize
72KB
MD59fe93d2aa7fb0c61c0ebc9bdb7a5320c
SHA1905b4bbe79eb52d3ae44a7075cb92d824f726585
SHA256057bed5a7086748e8775dcf108d4105093676087b3a774d05ccf3c85498b3a8f
SHA5126888e0c3541cdfb4c39b27c2e4841d762247856ef1862795c2d58233aeb459933b79ab4ec07826712be4365aec0b8c6566ee9631e83b8f7d36ca0f2a760f33f7
-
Filesize
72KB
MD53d38e182ee432941fa1fbf70717f861a
SHA1a7ee97294b7939204617167038874966a3de650d
SHA256d3890e6c1fc2661b0d5df64edc9af94a929b70791369b4cbf993bc32ec8e13f3
SHA5129f3c2c56983231adba73109f7c6a7ace1ac0197b564b5c6e250c08246f7fb9853c2c3b6455f722838384a82a20f3ec471dcd8ee9346c4a1a6d4d4e51460c59f0
-
Filesize
72KB
MD53d38e182ee432941fa1fbf70717f861a
SHA1a7ee97294b7939204617167038874966a3de650d
SHA256d3890e6c1fc2661b0d5df64edc9af94a929b70791369b4cbf993bc32ec8e13f3
SHA5129f3c2c56983231adba73109f7c6a7ace1ac0197b564b5c6e250c08246f7fb9853c2c3b6455f722838384a82a20f3ec471dcd8ee9346c4a1a6d4d4e51460c59f0
-
Filesize
72KB
MD598684b8cf38b6c101f380c57806a0bd8
SHA14be42b55be19514f6ee4f9138e1ec5306ae55e35
SHA256e216b466ed17bd5e40a097f791558237bc2c068cba41391ad712d323bd1d3c5e
SHA5125b8e22624010bfe43df2657a7e795300e7920f16f5a8e417b97d8d5d8ca64676a70cb7869571dc121116f45f068664b06265aceb7a94b85cc5fe8f07a704608c
-
Filesize
72KB
MD5f1720d44054ad1cbceeef3939f021c95
SHA10911ae538a26542470badf60916bab59e44a917a
SHA256b0c86719c4d0a301dedbf15556c643c4f0a86861de371e299ba00e0b58682ac5
SHA512e56abbb28cea926cade5dd06189064768d13421e4c54418423d9cd243905e2b4c3f17ecfad71f982c9fcc44ff0c0207f18115e2156bf5cf110dac1409d080f72
-
Filesize
72KB
MD5f1720d44054ad1cbceeef3939f021c95
SHA10911ae538a26542470badf60916bab59e44a917a
SHA256b0c86719c4d0a301dedbf15556c643c4f0a86861de371e299ba00e0b58682ac5
SHA512e56abbb28cea926cade5dd06189064768d13421e4c54418423d9cd243905e2b4c3f17ecfad71f982c9fcc44ff0c0207f18115e2156bf5cf110dac1409d080f72
-
Filesize
72KB
MD5bc940180657ea0e3b343ad5de9fcc259
SHA1bf9346f058b16668694ff32b5e97cc6598215517
SHA256f1771f73fe881070608570ac23df70037e059cfa5aba2b2b05e180fa8bee0d68
SHA512bf8219fde9ee05a2ce9d9d2f543d3d06f6992cdc3c5d57a3f1d0ab16e444923598e86a64d563a950a3c8733e87abc2ba398d6e41909588ca92f9e82cf12fe453
-
Filesize
72KB
MD5dc582750b0bb729e110cf53a30255d3d
SHA18f76c0b2eca689fd043c064c4a6e5e15deb50998
SHA25612760e95baf4fe1fa06dbc62fff5e2e56c776f1ecb4368bde28717d779e19063
SHA5125361d0b9ba7ca1f41a18ddd0fccc0725c3c65735b1cb426f7ebe18f9c077fadb658043dafdcfba6925f343c4d4833918f4d7c030bab6424a92abb41436d11be7
-
Filesize
72KB
MD5bc940180657ea0e3b343ad5de9fcc259
SHA1bf9346f058b16668694ff32b5e97cc6598215517
SHA256f1771f73fe881070608570ac23df70037e059cfa5aba2b2b05e180fa8bee0d68
SHA512bf8219fde9ee05a2ce9d9d2f543d3d06f6992cdc3c5d57a3f1d0ab16e444923598e86a64d563a950a3c8733e87abc2ba398d6e41909588ca92f9e82cf12fe453
-
Filesize
72KB
MD5661f9252cc9848b320bda022aa9da83d
SHA1dc70706139dc1e49c74d541fa8d9a35c512bb182
SHA256fa53fee2fd79d23322ffa1761eb19641177966952e0e659b86a1d1321408df3c
SHA51286792642ce57006735d0e03525bd78f53af57e021068ba5117c478cfff2ad70a14b5ee1d47fa2108efbc5e0a88341ba158f1d3b5e6147372f842d739d9d1501f
-
Filesize
72KB
MD5661f9252cc9848b320bda022aa9da83d
SHA1dc70706139dc1e49c74d541fa8d9a35c512bb182
SHA256fa53fee2fd79d23322ffa1761eb19641177966952e0e659b86a1d1321408df3c
SHA51286792642ce57006735d0e03525bd78f53af57e021068ba5117c478cfff2ad70a14b5ee1d47fa2108efbc5e0a88341ba158f1d3b5e6147372f842d739d9d1501f
-
Filesize
72KB
MD572f69eb93d8d903ed06c8f793bfce427
SHA1d8b7bb691a9e9b6f5114aa2a58ba0a2819d06df5
SHA25688fa7f9c9b3b18f12cdceafc2b153eb08e8790e43361fe5216a393ad043a310d
SHA51294c1eb4e965fc96db899b43fed95154a0ba38c0f09668335ed2d41963073cbc40f773726f5edfcf5cb373836989ce7fa9ebe7121f22ace19b481b6684e097d37
-
Filesize
72KB
MD572f69eb93d8d903ed06c8f793bfce427
SHA1d8b7bb691a9e9b6f5114aa2a58ba0a2819d06df5
SHA25688fa7f9c9b3b18f12cdceafc2b153eb08e8790e43361fe5216a393ad043a310d
SHA51294c1eb4e965fc96db899b43fed95154a0ba38c0f09668335ed2d41963073cbc40f773726f5edfcf5cb373836989ce7fa9ebe7121f22ace19b481b6684e097d37
-
Filesize
72KB
MD53e2742942aa6c8c3057c517785099f17
SHA1ace5534dec4ac27d62f7485409056b6f03530158
SHA25616bd20b602077b1ab7207efc16cf966690248b504c8714a2c3234c3e972578d1
SHA512b97369956a8f0cf78a4612067e21ca10f7296dd52141cc7819e2f8a4156dd18be274148287be36070535c82659b9acf188fa1dde0505ed54d7ad07c104f2b327
-
Filesize
72KB
MD53e2742942aa6c8c3057c517785099f17
SHA1ace5534dec4ac27d62f7485409056b6f03530158
SHA25616bd20b602077b1ab7207efc16cf966690248b504c8714a2c3234c3e972578d1
SHA512b97369956a8f0cf78a4612067e21ca10f7296dd52141cc7819e2f8a4156dd18be274148287be36070535c82659b9acf188fa1dde0505ed54d7ad07c104f2b327
-
Filesize
72KB
MD55cffdbfbe0c1051baefedf9505b4bd0e
SHA1f238491fb16fd4ff8093ca5eaee19da53f77b6ff
SHA25621a019ff665edebef56724c4d737d1fb7ca7da94e381ba5691d9a1abfe6994f0
SHA512f57cd21bed5f75bc4dde4be19aace3649e73412a68507e79069f85f2000fefc9ea63b8a7a15cee196bff20894d2a47237fd5e32380e47e94fa702f2acc024d20
-
Filesize
72KB
MD55cffdbfbe0c1051baefedf9505b4bd0e
SHA1f238491fb16fd4ff8093ca5eaee19da53f77b6ff
SHA25621a019ff665edebef56724c4d737d1fb7ca7da94e381ba5691d9a1abfe6994f0
SHA512f57cd21bed5f75bc4dde4be19aace3649e73412a68507e79069f85f2000fefc9ea63b8a7a15cee196bff20894d2a47237fd5e32380e47e94fa702f2acc024d20
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD5006c8d279de3798ad80f7adc4c1fa59a
SHA1444339b5a89b2edfffc01e318471c2d4635198dc
SHA256ede1851644aefc02836475d0d82282284ce7c1495f7a706109147864dbb53217
SHA512f4f22a5d7e6cb2fcaf7d587ba81257a257a3b24949be96ecacc0c575b9537b36cb949b5584a1b7eb5b5f68263d77cae85e7946cfb8925f14772ce5e49e7667aa
-
Filesize
72KB
MD5006c8d279de3798ad80f7adc4c1fa59a
SHA1444339b5a89b2edfffc01e318471c2d4635198dc
SHA256ede1851644aefc02836475d0d82282284ce7c1495f7a706109147864dbb53217
SHA512f4f22a5d7e6cb2fcaf7d587ba81257a257a3b24949be96ecacc0c575b9537b36cb949b5584a1b7eb5b5f68263d77cae85e7946cfb8925f14772ce5e49e7667aa
-
Filesize
72KB
MD5e885d8a4902306fd2af9ed8458219d9e
SHA1f3a4e19d24ebfe11486311fc994b49daebeab191
SHA256838052cc9270c8ed15538487031b635824fdd4a21dc5282b06e4352f6923eb1a
SHA512f05483fbcc3c30a8ebeb0d44a82b284ca7949d01c7d2dfa0a5b37e8b2b568392cc89de54171c41b042d2723a3df2ead1cec0bda837343f851fade4a715560567
-
Filesize
72KB
MD5e885d8a4902306fd2af9ed8458219d9e
SHA1f3a4e19d24ebfe11486311fc994b49daebeab191
SHA256838052cc9270c8ed15538487031b635824fdd4a21dc5282b06e4352f6923eb1a
SHA512f05483fbcc3c30a8ebeb0d44a82b284ca7949d01c7d2dfa0a5b37e8b2b568392cc89de54171c41b042d2723a3df2ead1cec0bda837343f851fade4a715560567
-
Filesize
72KB
MD53bb0c2e50d2680d386391db18cc0c445
SHA1ae1923e0082a0b299d47c9f705c6a0da94e50276
SHA2567ae3ff695b01110a1c4d6dde2738aaabee644303b04c342b535e8065ad7532b3
SHA512b4cc22860663b6cd95998af5165f66621b9514286c49f76ac0297224b83b15c1ee2668bc44609c28eebc7524720fe09e9693fe5c681fdbc488c3c7facb75a175
-
Filesize
72KB
MD53bb0c2e50d2680d386391db18cc0c445
SHA1ae1923e0082a0b299d47c9f705c6a0da94e50276
SHA2567ae3ff695b01110a1c4d6dde2738aaabee644303b04c342b535e8065ad7532b3
SHA512b4cc22860663b6cd95998af5165f66621b9514286c49f76ac0297224b83b15c1ee2668bc44609c28eebc7524720fe09e9693fe5c681fdbc488c3c7facb75a175
-
Filesize
72KB
MD5006c8d279de3798ad80f7adc4c1fa59a
SHA1444339b5a89b2edfffc01e318471c2d4635198dc
SHA256ede1851644aefc02836475d0d82282284ce7c1495f7a706109147864dbb53217
SHA512f4f22a5d7e6cb2fcaf7d587ba81257a257a3b24949be96ecacc0c575b9537b36cb949b5584a1b7eb5b5f68263d77cae85e7946cfb8925f14772ce5e49e7667aa
-
Filesize
72KB
MD5006c8d279de3798ad80f7adc4c1fa59a
SHA1444339b5a89b2edfffc01e318471c2d4635198dc
SHA256ede1851644aefc02836475d0d82282284ce7c1495f7a706109147864dbb53217
SHA512f4f22a5d7e6cb2fcaf7d587ba81257a257a3b24949be96ecacc0c575b9537b36cb949b5584a1b7eb5b5f68263d77cae85e7946cfb8925f14772ce5e49e7667aa
-
Filesize
72KB
MD53bb0c2e50d2680d386391db18cc0c445
SHA1ae1923e0082a0b299d47c9f705c6a0da94e50276
SHA2567ae3ff695b01110a1c4d6dde2738aaabee644303b04c342b535e8065ad7532b3
SHA512b4cc22860663b6cd95998af5165f66621b9514286c49f76ac0297224b83b15c1ee2668bc44609c28eebc7524720fe09e9693fe5c681fdbc488c3c7facb75a175
-
Filesize
72KB
MD53bb0c2e50d2680d386391db18cc0c445
SHA1ae1923e0082a0b299d47c9f705c6a0da94e50276
SHA2567ae3ff695b01110a1c4d6dde2738aaabee644303b04c342b535e8065ad7532b3
SHA512b4cc22860663b6cd95998af5165f66621b9514286c49f76ac0297224b83b15c1ee2668bc44609c28eebc7524720fe09e9693fe5c681fdbc488c3c7facb75a175
-
Filesize
72KB
MD53ab9d4f4e78361f72b41e5779ace7874
SHA1084c568c89bdfa3c650c56876a1271f36c65437a
SHA25653c493e89135cdd39b966f2610a8b82287daa55b1b7bf97a74741d068521743d
SHA512d0360ab03118beaf2a811319c77d90c1621d1289846639e1fb17306165a7aeea482548c118ab00a80e481fb3186097b14859a8a9d7a402734ef06eb382026daf
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD520ad66cdde2e43fdfc1036eec1525510
SHA11b529b66409985316655d7b564bbb063ed2a086d
SHA2569798d92801d1eb8870d0af75e7927652a8146eeb4fdda546a6df07a4afebc45b
SHA5126a5d98e6e880064ead73a774b18314855796f1855a0ad61ba844d21a56fd2ed09024155e8316b2b9d0d89989d60a710410e5346b1d50126002e4b5b67bc33cd9
-
Filesize
72KB
MD59fe93d2aa7fb0c61c0ebc9bdb7a5320c
SHA1905b4bbe79eb52d3ae44a7075cb92d824f726585
SHA256057bed5a7086748e8775dcf108d4105093676087b3a774d05ccf3c85498b3a8f
SHA5126888e0c3541cdfb4c39b27c2e4841d762247856ef1862795c2d58233aeb459933b79ab4ec07826712be4365aec0b8c6566ee9631e83b8f7d36ca0f2a760f33f7
-
Filesize
72KB
MD59fe93d2aa7fb0c61c0ebc9bdb7a5320c
SHA1905b4bbe79eb52d3ae44a7075cb92d824f726585
SHA256057bed5a7086748e8775dcf108d4105093676087b3a774d05ccf3c85498b3a8f
SHA5126888e0c3541cdfb4c39b27c2e4841d762247856ef1862795c2d58233aeb459933b79ab4ec07826712be4365aec0b8c6566ee9631e83b8f7d36ca0f2a760f33f7
-
Filesize
72KB
MD53d38e182ee432941fa1fbf70717f861a
SHA1a7ee97294b7939204617167038874966a3de650d
SHA256d3890e6c1fc2661b0d5df64edc9af94a929b70791369b4cbf993bc32ec8e13f3
SHA5129f3c2c56983231adba73109f7c6a7ace1ac0197b564b5c6e250c08246f7fb9853c2c3b6455f722838384a82a20f3ec471dcd8ee9346c4a1a6d4d4e51460c59f0
-
Filesize
72KB
MD53d38e182ee432941fa1fbf70717f861a
SHA1a7ee97294b7939204617167038874966a3de650d
SHA256d3890e6c1fc2661b0d5df64edc9af94a929b70791369b4cbf993bc32ec8e13f3
SHA5129f3c2c56983231adba73109f7c6a7ace1ac0197b564b5c6e250c08246f7fb9853c2c3b6455f722838384a82a20f3ec471dcd8ee9346c4a1a6d4d4e51460c59f0
-
Filesize
72KB
MD598684b8cf38b6c101f380c57806a0bd8
SHA14be42b55be19514f6ee4f9138e1ec5306ae55e35
SHA256e216b466ed17bd5e40a097f791558237bc2c068cba41391ad712d323bd1d3c5e
SHA5125b8e22624010bfe43df2657a7e795300e7920f16f5a8e417b97d8d5d8ca64676a70cb7869571dc121116f45f068664b06265aceb7a94b85cc5fe8f07a704608c
-
Filesize
72KB
MD598684b8cf38b6c101f380c57806a0bd8
SHA14be42b55be19514f6ee4f9138e1ec5306ae55e35
SHA256e216b466ed17bd5e40a097f791558237bc2c068cba41391ad712d323bd1d3c5e
SHA5125b8e22624010bfe43df2657a7e795300e7920f16f5a8e417b97d8d5d8ca64676a70cb7869571dc121116f45f068664b06265aceb7a94b85cc5fe8f07a704608c
-
Filesize
72KB
MD5f1720d44054ad1cbceeef3939f021c95
SHA10911ae538a26542470badf60916bab59e44a917a
SHA256b0c86719c4d0a301dedbf15556c643c4f0a86861de371e299ba00e0b58682ac5
SHA512e56abbb28cea926cade5dd06189064768d13421e4c54418423d9cd243905e2b4c3f17ecfad71f982c9fcc44ff0c0207f18115e2156bf5cf110dac1409d080f72
-
Filesize
72KB
MD5f1720d44054ad1cbceeef3939f021c95
SHA10911ae538a26542470badf60916bab59e44a917a
SHA256b0c86719c4d0a301dedbf15556c643c4f0a86861de371e299ba00e0b58682ac5
SHA512e56abbb28cea926cade5dd06189064768d13421e4c54418423d9cd243905e2b4c3f17ecfad71f982c9fcc44ff0c0207f18115e2156bf5cf110dac1409d080f72
-
Filesize
72KB
MD5f1720d44054ad1cbceeef3939f021c95
SHA10911ae538a26542470badf60916bab59e44a917a
SHA256b0c86719c4d0a301dedbf15556c643c4f0a86861de371e299ba00e0b58682ac5
SHA512e56abbb28cea926cade5dd06189064768d13421e4c54418423d9cd243905e2b4c3f17ecfad71f982c9fcc44ff0c0207f18115e2156bf5cf110dac1409d080f72
-
Filesize
72KB
MD5f1720d44054ad1cbceeef3939f021c95
SHA10911ae538a26542470badf60916bab59e44a917a
SHA256b0c86719c4d0a301dedbf15556c643c4f0a86861de371e299ba00e0b58682ac5
SHA512e56abbb28cea926cade5dd06189064768d13421e4c54418423d9cd243905e2b4c3f17ecfad71f982c9fcc44ff0c0207f18115e2156bf5cf110dac1409d080f72
-
Filesize
72KB
MD5bc940180657ea0e3b343ad5de9fcc259
SHA1bf9346f058b16668694ff32b5e97cc6598215517
SHA256f1771f73fe881070608570ac23df70037e059cfa5aba2b2b05e180fa8bee0d68
SHA512bf8219fde9ee05a2ce9d9d2f543d3d06f6992cdc3c5d57a3f1d0ab16e444923598e86a64d563a950a3c8733e87abc2ba398d6e41909588ca92f9e82cf12fe453
-
Filesize
72KB
MD5bc940180657ea0e3b343ad5de9fcc259
SHA1bf9346f058b16668694ff32b5e97cc6598215517
SHA256f1771f73fe881070608570ac23df70037e059cfa5aba2b2b05e180fa8bee0d68
SHA512bf8219fde9ee05a2ce9d9d2f543d3d06f6992cdc3c5d57a3f1d0ab16e444923598e86a64d563a950a3c8733e87abc2ba398d6e41909588ca92f9e82cf12fe453
-
Filesize
72KB
MD5dc582750b0bb729e110cf53a30255d3d
SHA18f76c0b2eca689fd043c064c4a6e5e15deb50998
SHA25612760e95baf4fe1fa06dbc62fff5e2e56c776f1ecb4368bde28717d779e19063
SHA5125361d0b9ba7ca1f41a18ddd0fccc0725c3c65735b1cb426f7ebe18f9c077fadb658043dafdcfba6925f343c4d4833918f4d7c030bab6424a92abb41436d11be7
-
Filesize
72KB
MD5dc582750b0bb729e110cf53a30255d3d
SHA18f76c0b2eca689fd043c064c4a6e5e15deb50998
SHA25612760e95baf4fe1fa06dbc62fff5e2e56c776f1ecb4368bde28717d779e19063
SHA5125361d0b9ba7ca1f41a18ddd0fccc0725c3c65735b1cb426f7ebe18f9c077fadb658043dafdcfba6925f343c4d4833918f4d7c030bab6424a92abb41436d11be7
-
Filesize
72KB
MD5bc940180657ea0e3b343ad5de9fcc259
SHA1bf9346f058b16668694ff32b5e97cc6598215517
SHA256f1771f73fe881070608570ac23df70037e059cfa5aba2b2b05e180fa8bee0d68
SHA512bf8219fde9ee05a2ce9d9d2f543d3d06f6992cdc3c5d57a3f1d0ab16e444923598e86a64d563a950a3c8733e87abc2ba398d6e41909588ca92f9e82cf12fe453
-
Filesize
72KB
MD5bc940180657ea0e3b343ad5de9fcc259
SHA1bf9346f058b16668694ff32b5e97cc6598215517
SHA256f1771f73fe881070608570ac23df70037e059cfa5aba2b2b05e180fa8bee0d68
SHA512bf8219fde9ee05a2ce9d9d2f543d3d06f6992cdc3c5d57a3f1d0ab16e444923598e86a64d563a950a3c8733e87abc2ba398d6e41909588ca92f9e82cf12fe453
-
Filesize
8KB