Analysis
-
max time kernel
183s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07/11/2022, 00:33
General
-
Target
b63077d5880f171ad30ddfb619694b3fde2e2b15b9dafcfdb2e197e566bb3985.exe
-
Size
72KB
-
MD5
052f888a7780355ec80ba2d4445fa170
-
SHA1
008c43b6afe6449975c32316483fbeb4ff62bc4f
-
SHA256
b63077d5880f171ad30ddfb619694b3fde2e2b15b9dafcfdb2e197e566bb3985
-
SHA512
83a8200231bc4a1d6753b08a3ba095429b0dfe07addd58f72939c963dc0e3c22ec4d360194cbf2d2c2d9167f6225e8df54d64b64ac9564ce5ed5e4202545cb41
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2d:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPJ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Disables RegEdit via registry modification 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b63077d5880f171ad30ddfb619694b3fde2e2b15b9dafcfdb2e197e566bb3985.exe"C:\Users\Admin\AppData\Local\Temp\b63077d5880f171ad30ddfb619694b3fde2e2b15b9dafcfdb2e197e566bb3985.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\2369443192\backup.exeC:\Users\Admin\AppData\Local\Temp\2369443192\backup.exe C:\Users\Admin\AppData\Local\Temp\2369443192\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\data.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\data.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\9⤵
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe"C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\update.exe"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\update.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe"C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\ru-RU\update.exe"C:\Program Files\Common Files\microsoft shared\ink\ru-RU\update.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Disables RegEdit via registry modification
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵
-
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files\Common Files\microsoft shared\VGX\backup.exe"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\7⤵
-
-
C:\Program Files\Common Files\microsoft shared\VC\backup.exe"C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\7⤵
-
-
C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\8⤵
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\9⤵
- System policy modification
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
-
C:\Program Files\Common Files\System\en-US\System Restore.exe"C:\Program Files\Common Files\System\en-US\System Restore.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\msadc\de-DE\data.exe"C:\Program Files\Common Files\System\msadc\de-DE\data.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
-
-
C:\Program Files\Google\System Restore.exe"C:\Program Files\Google\System Restore.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\System Restore.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵
- System policy modification
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
-
-
-
-
-
C:\Program Files\Internet Explorer\data.exe"C:\Program Files\Internet Explorer\data.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- System policy modification
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Disables RegEdit via registry modification
-
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵
-
-
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- System policy modification
-
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\8⤵
- System policy modification
-
-
C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\8⤵
-
-
-
C:\Program Files\Java\jdk1.8.0_66\include\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\8⤵
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\9⤵
-
-
-
-
-
C:\Program Files\Java\jre1.8.0_66\backup.exe"C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Java\jre1.8.0_66\bin\backup.exe"C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\7⤵
-
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Microsoft Office\Office16\backup.exe"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\6⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Microsoft Office\PackageManifests\backup.exe"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\6⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Microsoft Office\root\backup.exe"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\6⤵
-
-
-
-
C:\Program Files (x86)\update.exe"C:\Program Files (x86)\update.exe" C:\Program Files (x86)\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\8⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\9⤵
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵
- System policy modification
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\10⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\11⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\8⤵
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\data.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\data.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\8⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\update.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\7⤵
- Disables RegEdit via registry modification
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\9⤵
-
-
-
-
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- System policy modification
-
-
C:\Program Files (x86)\Google\Temp\System Restore.exe"C:\Program Files (x86)\Google\Temp\System Restore.exe" C:\Program Files (x86)\Google\Temp\6⤵
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe"C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\7⤵
-
-
C:\Program Files (x86)\Google\Update\Download\backup.exe"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\7⤵
-
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- System policy modification
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
-
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Disables RegEdit via registry modification
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- System policy modification
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Users\Admin\Downloads\data.exeC:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\6⤵
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
-
C:\Users\Admin\Music\System Restore.exe"C:\Users\Admin\Music\System Restore.exe" C:\Users\Admin\Music\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Users\Admin\OneDrive\data.exeC:\Users\Admin\OneDrive\data.exe C:\Users\Admin\OneDrive\6⤵
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Disables RegEdit via registry modification
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
-
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
-
C:\Windows\appcompat\appraiser\Telemetry\backup.exeC:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵
-
-
-
C:\Windows\appcompat\encapsulation\backup.exeC:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\6⤵
- Disables RegEdit via registry modification
-
-
C:\Windows\appcompat\Programs\backup.exeC:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\1⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\1⤵
- Disables RegEdit via registry modification
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD50e768841976a1862a7046bf90ae12309
SHA1212bf53ff8b0cfba9627c20850482e4187cde310
SHA2569068aae2bf382ca2adbff39b1fcc4614ef5bd0d4ceb82cd7aafc7d7d7224fde9
SHA512c534a0984b27782d1f17522a27d15e337ebadc67b357fdedcb85e5ed5695115ac0b3d249792d9a6cc35d35ec97e1bdeed257fde4aace14fbaa0cc15590a51813
-
Filesize
72KB
MD50e768841976a1862a7046bf90ae12309
SHA1212bf53ff8b0cfba9627c20850482e4187cde310
SHA2569068aae2bf382ca2adbff39b1fcc4614ef5bd0d4ceb82cd7aafc7d7d7224fde9
SHA512c534a0984b27782d1f17522a27d15e337ebadc67b357fdedcb85e5ed5695115ac0b3d249792d9a6cc35d35ec97e1bdeed257fde4aace14fbaa0cc15590a51813
-
Filesize
72KB
MD5921515ff4b2335e6e85250a879c83b11
SHA1aa69188bb318109d0945c1f73cc812a34c667fc9
SHA2560ad7bad267a5c08ee21f850a4d187b40e06771c925e38b1f3727d5e6c3ecefdc
SHA512f736016831fedbc4de56878753b0394944686c428d0b20db3013db3d83f57ea5705bc9c53b842d51dcf255c03d690c00afa1a5772c8ef587c802fa61a91707bb
-
Filesize
72KB
MD5921515ff4b2335e6e85250a879c83b11
SHA1aa69188bb318109d0945c1f73cc812a34c667fc9
SHA2560ad7bad267a5c08ee21f850a4d187b40e06771c925e38b1f3727d5e6c3ecefdc
SHA512f736016831fedbc4de56878753b0394944686c428d0b20db3013db3d83f57ea5705bc9c53b842d51dcf255c03d690c00afa1a5772c8ef587c802fa61a91707bb
-
Filesize
72KB
MD5ce5684a08a4edf7a4a81b5012f0c4966
SHA1a36c18ed8b7f4ada4264c8342c90df0bb0448f76
SHA256b4e6a79a4051b3e6e9a7e1e24180144931d8dbbe524f0ce59c307e2212af7acf
SHA512a7a3548be9fe24db575a58eb2e3ba9ffb4215d854d58f2fa02c6830649ddc4266b32d571218fd335caf26a00148791bdea4cd80fc3f425360cb39e6f4f7a3fa8
-
Filesize
72KB
MD5ce5684a08a4edf7a4a81b5012f0c4966
SHA1a36c18ed8b7f4ada4264c8342c90df0bb0448f76
SHA256b4e6a79a4051b3e6e9a7e1e24180144931d8dbbe524f0ce59c307e2212af7acf
SHA512a7a3548be9fe24db575a58eb2e3ba9ffb4215d854d58f2fa02c6830649ddc4266b32d571218fd335caf26a00148791bdea4cd80fc3f425360cb39e6f4f7a3fa8
-
Filesize
72KB
MD5921515ff4b2335e6e85250a879c83b11
SHA1aa69188bb318109d0945c1f73cc812a34c667fc9
SHA2560ad7bad267a5c08ee21f850a4d187b40e06771c925e38b1f3727d5e6c3ecefdc
SHA512f736016831fedbc4de56878753b0394944686c428d0b20db3013db3d83f57ea5705bc9c53b842d51dcf255c03d690c00afa1a5772c8ef587c802fa61a91707bb
-
Filesize
72KB
MD5921515ff4b2335e6e85250a879c83b11
SHA1aa69188bb318109d0945c1f73cc812a34c667fc9
SHA2560ad7bad267a5c08ee21f850a4d187b40e06771c925e38b1f3727d5e6c3ecefdc
SHA512f736016831fedbc4de56878753b0394944686c428d0b20db3013db3d83f57ea5705bc9c53b842d51dcf255c03d690c00afa1a5772c8ef587c802fa61a91707bb
-
Filesize
72KB
MD5ce5684a08a4edf7a4a81b5012f0c4966
SHA1a36c18ed8b7f4ada4264c8342c90df0bb0448f76
SHA256b4e6a79a4051b3e6e9a7e1e24180144931d8dbbe524f0ce59c307e2212af7acf
SHA512a7a3548be9fe24db575a58eb2e3ba9ffb4215d854d58f2fa02c6830649ddc4266b32d571218fd335caf26a00148791bdea4cd80fc3f425360cb39e6f4f7a3fa8
-
Filesize
72KB
MD5ce5684a08a4edf7a4a81b5012f0c4966
SHA1a36c18ed8b7f4ada4264c8342c90df0bb0448f76
SHA256b4e6a79a4051b3e6e9a7e1e24180144931d8dbbe524f0ce59c307e2212af7acf
SHA512a7a3548be9fe24db575a58eb2e3ba9ffb4215d854d58f2fa02c6830649ddc4266b32d571218fd335caf26a00148791bdea4cd80fc3f425360cb39e6f4f7a3fa8
-
Filesize
72KB
MD5b10755ab517105c0140309c27d33cc3c
SHA18ddb1b947e3d25a9deec377cd6cb29c021c602e5
SHA25688dec16e69ee44e9e83876f8275cbcc647ecea85d840fba8787df71fd27e8d1a
SHA5124673771b1a7d8174f4666247ee09a80200497896c0ad8988e94be731c0fd121e9c1c2707d0b4f6ba7077958cc11e848b0581fd6970fe8f7c1cfc6000f8470d46
-
Filesize
72KB
MD5b10755ab517105c0140309c27d33cc3c
SHA18ddb1b947e3d25a9deec377cd6cb29c021c602e5
SHA25688dec16e69ee44e9e83876f8275cbcc647ecea85d840fba8787df71fd27e8d1a
SHA5124673771b1a7d8174f4666247ee09a80200497896c0ad8988e94be731c0fd121e9c1c2707d0b4f6ba7077958cc11e848b0581fd6970fe8f7c1cfc6000f8470d46
-
Filesize
72KB
MD5d3c61385ccfbb0b376f32f7fb41f1097
SHA1ceb0bdf1d6541f4394bf1a6659148e58f1d83069
SHA256850e955dc2426d132cc1632ac3386cf3ef9a98bbf7c0ffbec29905231e71c302
SHA51224b22bf828ecc8ba2e9387857544d19c63c315583b94ccba07cbd643f5dcecfcfd03b6990fe2f2a34f57da49d12f034b9b361a7c0d5923aaf953503fc183c72f
-
Filesize
72KB
MD5d3c61385ccfbb0b376f32f7fb41f1097
SHA1ceb0bdf1d6541f4394bf1a6659148e58f1d83069
SHA256850e955dc2426d132cc1632ac3386cf3ef9a98bbf7c0ffbec29905231e71c302
SHA51224b22bf828ecc8ba2e9387857544d19c63c315583b94ccba07cbd643f5dcecfcfd03b6990fe2f2a34f57da49d12f034b9b361a7c0d5923aaf953503fc183c72f
-
Filesize
72KB
MD5654891ecd081d7b3243d64a2f1322d06
SHA1b23f50a2f012e60951b2521fc5f4bdbf0571f84f
SHA256b6416994c403d698ab65b69a26d70d7dcbb86f2b16c97670f34414cc288f0ce6
SHA512331616ce920f2351bdebb0a8d92c29d29d1993708a007265bb190a79ca63b82c063a4f89d6ec1d85d2b6e0420c98e7c23e55c9da3a756c9d8fb1e21efbfefba2
-
Filesize
72KB
MD5654891ecd081d7b3243d64a2f1322d06
SHA1b23f50a2f012e60951b2521fc5f4bdbf0571f84f
SHA256b6416994c403d698ab65b69a26d70d7dcbb86f2b16c97670f34414cc288f0ce6
SHA512331616ce920f2351bdebb0a8d92c29d29d1993708a007265bb190a79ca63b82c063a4f89d6ec1d85d2b6e0420c98e7c23e55c9da3a756c9d8fb1e21efbfefba2
-
Filesize
72KB
MD5b10755ab517105c0140309c27d33cc3c
SHA18ddb1b947e3d25a9deec377cd6cb29c021c602e5
SHA25688dec16e69ee44e9e83876f8275cbcc647ecea85d840fba8787df71fd27e8d1a
SHA5124673771b1a7d8174f4666247ee09a80200497896c0ad8988e94be731c0fd121e9c1c2707d0b4f6ba7077958cc11e848b0581fd6970fe8f7c1cfc6000f8470d46
-
Filesize
72KB
MD5b10755ab517105c0140309c27d33cc3c
SHA18ddb1b947e3d25a9deec377cd6cb29c021c602e5
SHA25688dec16e69ee44e9e83876f8275cbcc647ecea85d840fba8787df71fd27e8d1a
SHA5124673771b1a7d8174f4666247ee09a80200497896c0ad8988e94be731c0fd121e9c1c2707d0b4f6ba7077958cc11e848b0581fd6970fe8f7c1cfc6000f8470d46
-
Filesize
72KB
MD5654891ecd081d7b3243d64a2f1322d06
SHA1b23f50a2f012e60951b2521fc5f4bdbf0571f84f
SHA256b6416994c403d698ab65b69a26d70d7dcbb86f2b16c97670f34414cc288f0ce6
SHA512331616ce920f2351bdebb0a8d92c29d29d1993708a007265bb190a79ca63b82c063a4f89d6ec1d85d2b6e0420c98e7c23e55c9da3a756c9d8fb1e21efbfefba2
-
Filesize
72KB
MD5654891ecd081d7b3243d64a2f1322d06
SHA1b23f50a2f012e60951b2521fc5f4bdbf0571f84f
SHA256b6416994c403d698ab65b69a26d70d7dcbb86f2b16c97670f34414cc288f0ce6
SHA512331616ce920f2351bdebb0a8d92c29d29d1993708a007265bb190a79ca63b82c063a4f89d6ec1d85d2b6e0420c98e7c23e55c9da3a756c9d8fb1e21efbfefba2
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5dcc06285647e216c1f783132b81cffe9
SHA1500430faad914dd769bb429a36d017fb015066c9
SHA256f299c3fde4f8adfdcae8850c396ba6f4f4a0bd823fe9879142ff810889c059d2
SHA512e783fb1fb76bf70d3a85dea2036a516e3458526f6401fcfb5875fc6b5ac468d904d39c0eb3bfea526c3c6934b58da66354fc7dbc2cb5ab85ef11d86d90e63801
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5b767455cbb458db1aacbf05c2d66d4e1
SHA10f094aba49d6f74ba6f0842c9388fefc9a67f576
SHA256b27dde3d0e2cbd3b73aac7c177ee18ecc312b93014942ad87e342d8825b4f56b
SHA512cd4d0eb042a374302db764f5f4b55acba319b226530f968d6a6da63ba5e601d4d0f542f7e3b4c947ccc4f64f6e7a97e17c927cafafe40d0da7fcd0388413cc00
-
Filesize
72KB
MD5d4614ac2d30bb9e050152a03ad56b216
SHA1a311ebfcf26aa41ca36f57028294fceeb25ebc0c
SHA256d7fb58233f2e5205c54598cf22566fed475dbd9cdf0658d065964b5f3d8f37ee
SHA512e55d6dbb01c4c73584995f14f7b94a015e20104fbb3b96211246fcbf40089ff0c758754394941da2ec2d69bd7baa9d18b13745b8f9322b0be1960d3dff21c224
-
Filesize
72KB
MD5d4614ac2d30bb9e050152a03ad56b216
SHA1a311ebfcf26aa41ca36f57028294fceeb25ebc0c
SHA256d7fb58233f2e5205c54598cf22566fed475dbd9cdf0658d065964b5f3d8f37ee
SHA512e55d6dbb01c4c73584995f14f7b94a015e20104fbb3b96211246fcbf40089ff0c758754394941da2ec2d69bd7baa9d18b13745b8f9322b0be1960d3dff21c224
-
Filesize
72KB
MD53e402690215894cbf436e782cc6649ad
SHA16e80c339f6b79705b6e3ace904814dbdca7ab656
SHA256b56060844335fc8f9ed6c36b92614a41e460abaeb1c06f76494ee27ed829b54b
SHA51228e793022c1280dd2a45de1622ac1eea693ea9e8d2bb4c85f67f1645ebfe3a8fdac3219a1d870efa03dce48b0b79eab600d9adf3207cf524196d315802499657
-
Filesize
72KB
MD53e402690215894cbf436e782cc6649ad
SHA16e80c339f6b79705b6e3ace904814dbdca7ab656
SHA256b56060844335fc8f9ed6c36b92614a41e460abaeb1c06f76494ee27ed829b54b
SHA51228e793022c1280dd2a45de1622ac1eea693ea9e8d2bb4c85f67f1645ebfe3a8fdac3219a1d870efa03dce48b0b79eab600d9adf3207cf524196d315802499657
-
Filesize
72KB
MD5a9dcfb155bd9b47a21e0347d18244ef7
SHA13e34af7b103dc52604763722af6823250ad7ccae
SHA256d359eeb3b7f771de181846088b209325a8aaafc5d1ec0ad7759ee030f3fedd92
SHA5122ce0c794f06d1b5f7214b606da3e84d415c878a718a5a7561b788aae38130969c9517302a5af5a33f2079215d86c1dee519c914a6bfa953f6d1adaad95201cf9
-
Filesize
72KB
MD5a9dcfb155bd9b47a21e0347d18244ef7
SHA13e34af7b103dc52604763722af6823250ad7ccae
SHA256d359eeb3b7f771de181846088b209325a8aaafc5d1ec0ad7759ee030f3fedd92
SHA5122ce0c794f06d1b5f7214b606da3e84d415c878a718a5a7561b788aae38130969c9517302a5af5a33f2079215d86c1dee519c914a6bfa953f6d1adaad95201cf9
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD57e3a386e549aedee83b9b8aed5374eef
SHA15b425076911dba4ab207adf0930889de5af8743e
SHA2566b6ee549bc9e77b22bb190bb5b00afd9778284b57e1c1f78d171efa8c59978c1
SHA512293d656a4e4a6f59f01a4c1891eafe585c896c96d456b48f39a86fa97292528fe513751192bf97d4e2a172bf1ec1fdfbfe5332191efdeeffba75fc48cdc9061c
-
Filesize
72KB
MD57e3a386e549aedee83b9b8aed5374eef
SHA15b425076911dba4ab207adf0930889de5af8743e
SHA2566b6ee549bc9e77b22bb190bb5b00afd9778284b57e1c1f78d171efa8c59978c1
SHA512293d656a4e4a6f59f01a4c1891eafe585c896c96d456b48f39a86fa97292528fe513751192bf97d4e2a172bf1ec1fdfbfe5332191efdeeffba75fc48cdc9061c
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD5711e2de65d2f2e20d7b32d7be0b22a4f
SHA17e310a1fc8ac934677c6aabb647828ea8510aeba
SHA2560203ec947379423816a3cf27d70cf7226115add18c953b5f6e1ede27800ab1f9
SHA5128eb2aa0d5af72da2455afc2635ed611abf911dcca4eb83f542d1cded12fd984d58bdf7e33ab7b5f560eff0d908b593d34b33fe6d8b5c289e63f2e2ddb604a46a
-
Filesize
72KB
MD581420386e70382edaf66511271944868
SHA161ce56c6914c586471c89386c3cd4b4271d6c1cd
SHA2569cfc634e616893463d879d4df8b5d273a58c97738f78d4a111975591daff022a
SHA512373dbaf2c8fc9dbda2219e881bdf12f77691073eea1e5d88aaee4b0193c1d013cc96362a76fbaeeba0a24b552096afb0ee35512b980ab94bc97bb433a470712b
-
Filesize
72KB
MD581420386e70382edaf66511271944868
SHA161ce56c6914c586471c89386c3cd4b4271d6c1cd
SHA2569cfc634e616893463d879d4df8b5d273a58c97738f78d4a111975591daff022a
SHA512373dbaf2c8fc9dbda2219e881bdf12f77691073eea1e5d88aaee4b0193c1d013cc96362a76fbaeeba0a24b552096afb0ee35512b980ab94bc97bb433a470712b
-
Filesize
72KB
MD5594ade5f68b6c453a82442a62ed7d9fe
SHA1e0fe718cbce8f8b1f4da29dafac3f6fb7a7fdb80
SHA2567633cb872fcc076d34e266abe01f9472e19e897df0d5a2b141b97920d171bc0c
SHA512bfcb562fc5f6cce8724fb3e6ae8f63cd6cd9e757f64a3c12c1d92dfa881bc29859be2c75ca5193774e9f8d1a9903c1a6ffd8448f3482f6a2d142e7727348ac83
-
Filesize
72KB
MD5594ade5f68b6c453a82442a62ed7d9fe
SHA1e0fe718cbce8f8b1f4da29dafac3f6fb7a7fdb80
SHA2567633cb872fcc076d34e266abe01f9472e19e897df0d5a2b141b97920d171bc0c
SHA512bfcb562fc5f6cce8724fb3e6ae8f63cd6cd9e757f64a3c12c1d92dfa881bc29859be2c75ca5193774e9f8d1a9903c1a6ffd8448f3482f6a2d142e7727348ac83
-
Filesize
72KB
MD50e768841976a1862a7046bf90ae12309
SHA1212bf53ff8b0cfba9627c20850482e4187cde310
SHA2569068aae2bf382ca2adbff39b1fcc4614ef5bd0d4ceb82cd7aafc7d7d7224fde9
SHA512c534a0984b27782d1f17522a27d15e337ebadc67b357fdedcb85e5ed5695115ac0b3d249792d9a6cc35d35ec97e1bdeed257fde4aace14fbaa0cc15590a51813
-
Filesize
72KB
MD50e768841976a1862a7046bf90ae12309
SHA1212bf53ff8b0cfba9627c20850482e4187cde310
SHA2569068aae2bf382ca2adbff39b1fcc4614ef5bd0d4ceb82cd7aafc7d7d7224fde9
SHA512c534a0984b27782d1f17522a27d15e337ebadc67b357fdedcb85e5ed5695115ac0b3d249792d9a6cc35d35ec97e1bdeed257fde4aace14fbaa0cc15590a51813