Analysis
-
max time kernel
80s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07/11/2022, 17:50
General
-
Target
2f44129d9077e160278bd3a76dcd42d98729537bb064e732c4c88ecd87021beb.exe
-
Size
72KB
-
MD5
031571e2a42d4b74676f250bb57d2812
-
SHA1
e412bb226940f3bcc3e211c614dfe9828145abf8
-
SHA256
2f44129d9077e160278bd3a76dcd42d98729537bb064e732c4c88ecd87021beb
-
SHA512
d52d58dd1b592ae16d488704bc53db66209776195b04800661d8cacd9ee8fd6b9c9c5785f3974b639a4a9d9295cf34004ccf8def5b07586e875c054a4a04e617
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2a:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrW
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 57 IoCs
-
Disables RegEdit via registry modification 64 IoCs
-
Executes dropped EXE 60 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 54 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 60 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f44129d9077e160278bd3a76dcd42d98729537bb064e732c4c88ecd87021beb.exe"C:\Users\Admin\AppData\Local\Temp\2f44129d9077e160278bd3a76dcd42d98729537bb064e732c4c88ecd87021beb.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\4160964006\backup.exeC:\Users\Admin\AppData\Local\Temp\4160964006\backup.exe C:\Users\Admin\AppData\Local\Temp\4160964006\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\data.exe"C:\Program Files\7-Zip\data.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
-
-
C:\Program Files\Common Files\Services\update.exe"C:\Program Files\Common Files\Services\update.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft Office\data.exe"C:\Program Files (x86)\Microsoft Office\data.exe" C:\Program Files (x86)\Microsoft Office\5⤵
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD52dcd16134a45f26ddf7dd92e956573ab
SHA1c3e557a4fbbdc8044a00d9c413f7a1d880df67e1
SHA256eace13fb90a5d66d0b976c10eb684adf434b537968de4ca653b8b4d6f3dab11c
SHA51277e4078da73f51407222607f47b6adce3394a4d4bd2423b3fffde7e0e6746f6f0c162f261c3e562e67a52216f0dd42a9442b983ee6aca059cedab7da945cb0da
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD552bd3cbd1aa0549b6172a8875e1705bf
SHA12293d6ab89bd37f4ffb2fa4f0f6bdca5ab58e15a
SHA25650a87df9d164c1943e579c3e0cd7316efb416067510caae5959aa08ea19d7133
SHA512d272741388528979b309dd4d6b5ba45d98df1d7f53a299b9623e0e532d685731d03871d7226ad4fb59d7fd0b4d46f5533076ae2b74747ba4b72447a5de3244ef
-
Filesize
72KB
MD52dcd16134a45f26ddf7dd92e956573ab
SHA1c3e557a4fbbdc8044a00d9c413f7a1d880df67e1
SHA256eace13fb90a5d66d0b976c10eb684adf434b537968de4ca653b8b4d6f3dab11c
SHA51277e4078da73f51407222607f47b6adce3394a4d4bd2423b3fffde7e0e6746f6f0c162f261c3e562e67a52216f0dd42a9442b983ee6aca059cedab7da945cb0da
-
Filesize
72KB
MD52dcd16134a45f26ddf7dd92e956573ab
SHA1c3e557a4fbbdc8044a00d9c413f7a1d880df67e1
SHA256eace13fb90a5d66d0b976c10eb684adf434b537968de4ca653b8b4d6f3dab11c
SHA51277e4078da73f51407222607f47b6adce3394a4d4bd2423b3fffde7e0e6746f6f0c162f261c3e562e67a52216f0dd42a9442b983ee6aca059cedab7da945cb0da
-
Filesize
72KB
MD5e69b41ed22280d4150a3943b89f5342d
SHA1c7c089a0ae9a08a20f503a9dab7662fc1cfd381e
SHA2568ba869d225fe43bf2b4c74f32aa01f66ac27b5004bb9bd1ea7d8ac937dd3fad8
SHA5124ef171f1df7a67cf890f45e336310883b24ca1a66e16e48f3e0608dc4664c57019c0fd0e226e08b6d051f6077ac65db9dfa230ca37facc8ed88cdef948e7d8da
-
Filesize
72KB
MD552bd3cbd1aa0549b6172a8875e1705bf
SHA12293d6ab89bd37f4ffb2fa4f0f6bdca5ab58e15a
SHA25650a87df9d164c1943e579c3e0cd7316efb416067510caae5959aa08ea19d7133
SHA512d272741388528979b309dd4d6b5ba45d98df1d7f53a299b9623e0e532d685731d03871d7226ad4fb59d7fd0b4d46f5533076ae2b74747ba4b72447a5de3244ef
-
Filesize
72KB
MD552bd3cbd1aa0549b6172a8875e1705bf
SHA12293d6ab89bd37f4ffb2fa4f0f6bdca5ab58e15a
SHA25650a87df9d164c1943e579c3e0cd7316efb416067510caae5959aa08ea19d7133
SHA512d272741388528979b309dd4d6b5ba45d98df1d7f53a299b9623e0e532d685731d03871d7226ad4fb59d7fd0b4d46f5533076ae2b74747ba4b72447a5de3244ef
-
Filesize
72KB
MD57270365188490560b1f840a8003e289b
SHA11c912ba4301a528af58d5327e8244c47c335a012
SHA25625ba5a5ad2f0e478c87900724064c4808433d569b629dd892eea0d77008727cb
SHA5120999d87b631d8b398d3172a17a9441e466b64a76875cb8ca3541af3ef45f1f5086c9301eb239e6854468e8656613af248e34270f167aea3592717dd6774eee25
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD5582de23e9b7b4f5053637a5b3bf7bd1d
SHA17116573dc56cc9edf0ad6c261ffc8c626029388f
SHA25638ed6193814be3524b128b02795ff2677c604a179e445b8ad5192ece57a41522
SHA512c7f26bd0e2cefb53b24b584db03b46b85c8ac705a82fd0811de610e925765152af7eac792bbfe12429437915d40371c394f268114c80dec6178fb976f6aa6122
-
Filesize
72KB
MD5582de23e9b7b4f5053637a5b3bf7bd1d
SHA17116573dc56cc9edf0ad6c261ffc8c626029388f
SHA25638ed6193814be3524b128b02795ff2677c604a179e445b8ad5192ece57a41522
SHA512c7f26bd0e2cefb53b24b584db03b46b85c8ac705a82fd0811de610e925765152af7eac792bbfe12429437915d40371c394f268114c80dec6178fb976f6aa6122
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD5582de23e9b7b4f5053637a5b3bf7bd1d
SHA17116573dc56cc9edf0ad6c261ffc8c626029388f
SHA25638ed6193814be3524b128b02795ff2677c604a179e445b8ad5192ece57a41522
SHA512c7f26bd0e2cefb53b24b584db03b46b85c8ac705a82fd0811de610e925765152af7eac792bbfe12429437915d40371c394f268114c80dec6178fb976f6aa6122
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD5c2eee2cc75a7da1624d23d1b087df4e3
SHA16465c69248b2b2da14510051770ab7284cc05f8f
SHA256cc378ecbdc263bbe08988137fba996fc5befe1c11f294a0dba7d71d3d5bc9ff7
SHA512ba039203694233f506fb40481dc647afe4351088ab9c618eea6cb17a16cf83eb3ab2352b21f0ac3e3ea9dcc7fe31385816d9ca0f411a7eb89261104aed9f29a6
-
Filesize
72KB
MD5c2eee2cc75a7da1624d23d1b087df4e3
SHA16465c69248b2b2da14510051770ab7284cc05f8f
SHA256cc378ecbdc263bbe08988137fba996fc5befe1c11f294a0dba7d71d3d5bc9ff7
SHA512ba039203694233f506fb40481dc647afe4351088ab9c618eea6cb17a16cf83eb3ab2352b21f0ac3e3ea9dcc7fe31385816d9ca0f411a7eb89261104aed9f29a6
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD52dcd16134a45f26ddf7dd92e956573ab
SHA1c3e557a4fbbdc8044a00d9c413f7a1d880df67e1
SHA256eace13fb90a5d66d0b976c10eb684adf434b537968de4ca653b8b4d6f3dab11c
SHA51277e4078da73f51407222607f47b6adce3394a4d4bd2423b3fffde7e0e6746f6f0c162f261c3e562e67a52216f0dd42a9442b983ee6aca059cedab7da945cb0da
-
Filesize
72KB
MD52dcd16134a45f26ddf7dd92e956573ab
SHA1c3e557a4fbbdc8044a00d9c413f7a1d880df67e1
SHA256eace13fb90a5d66d0b976c10eb684adf434b537968de4ca653b8b4d6f3dab11c
SHA51277e4078da73f51407222607f47b6adce3394a4d4bd2423b3fffde7e0e6746f6f0c162f261c3e562e67a52216f0dd42a9442b983ee6aca059cedab7da945cb0da
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD552bd3cbd1aa0549b6172a8875e1705bf
SHA12293d6ab89bd37f4ffb2fa4f0f6bdca5ab58e15a
SHA25650a87df9d164c1943e579c3e0cd7316efb416067510caae5959aa08ea19d7133
SHA512d272741388528979b309dd4d6b5ba45d98df1d7f53a299b9623e0e532d685731d03871d7226ad4fb59d7fd0b4d46f5533076ae2b74747ba4b72447a5de3244ef
-
Filesize
72KB
MD552bd3cbd1aa0549b6172a8875e1705bf
SHA12293d6ab89bd37f4ffb2fa4f0f6bdca5ab58e15a
SHA25650a87df9d164c1943e579c3e0cd7316efb416067510caae5959aa08ea19d7133
SHA512d272741388528979b309dd4d6b5ba45d98df1d7f53a299b9623e0e532d685731d03871d7226ad4fb59d7fd0b4d46f5533076ae2b74747ba4b72447a5de3244ef
-
Filesize
72KB
MD52dcd16134a45f26ddf7dd92e956573ab
SHA1c3e557a4fbbdc8044a00d9c413f7a1d880df67e1
SHA256eace13fb90a5d66d0b976c10eb684adf434b537968de4ca653b8b4d6f3dab11c
SHA51277e4078da73f51407222607f47b6adce3394a4d4bd2423b3fffde7e0e6746f6f0c162f261c3e562e67a52216f0dd42a9442b983ee6aca059cedab7da945cb0da
-
Filesize
72KB
MD52dcd16134a45f26ddf7dd92e956573ab
SHA1c3e557a4fbbdc8044a00d9c413f7a1d880df67e1
SHA256eace13fb90a5d66d0b976c10eb684adf434b537968de4ca653b8b4d6f3dab11c
SHA51277e4078da73f51407222607f47b6adce3394a4d4bd2423b3fffde7e0e6746f6f0c162f261c3e562e67a52216f0dd42a9442b983ee6aca059cedab7da945cb0da
-
Filesize
72KB
MD5e69b41ed22280d4150a3943b89f5342d
SHA1c7c089a0ae9a08a20f503a9dab7662fc1cfd381e
SHA2568ba869d225fe43bf2b4c74f32aa01f66ac27b5004bb9bd1ea7d8ac937dd3fad8
SHA5124ef171f1df7a67cf890f45e336310883b24ca1a66e16e48f3e0608dc4664c57019c0fd0e226e08b6d051f6077ac65db9dfa230ca37facc8ed88cdef948e7d8da
-
Filesize
72KB
MD5e69b41ed22280d4150a3943b89f5342d
SHA1c7c089a0ae9a08a20f503a9dab7662fc1cfd381e
SHA2568ba869d225fe43bf2b4c74f32aa01f66ac27b5004bb9bd1ea7d8ac937dd3fad8
SHA5124ef171f1df7a67cf890f45e336310883b24ca1a66e16e48f3e0608dc4664c57019c0fd0e226e08b6d051f6077ac65db9dfa230ca37facc8ed88cdef948e7d8da
-
Filesize
72KB
MD552bd3cbd1aa0549b6172a8875e1705bf
SHA12293d6ab89bd37f4ffb2fa4f0f6bdca5ab58e15a
SHA25650a87df9d164c1943e579c3e0cd7316efb416067510caae5959aa08ea19d7133
SHA512d272741388528979b309dd4d6b5ba45d98df1d7f53a299b9623e0e532d685731d03871d7226ad4fb59d7fd0b4d46f5533076ae2b74747ba4b72447a5de3244ef
-
Filesize
72KB
MD552bd3cbd1aa0549b6172a8875e1705bf
SHA12293d6ab89bd37f4ffb2fa4f0f6bdca5ab58e15a
SHA25650a87df9d164c1943e579c3e0cd7316efb416067510caae5959aa08ea19d7133
SHA512d272741388528979b309dd4d6b5ba45d98df1d7f53a299b9623e0e532d685731d03871d7226ad4fb59d7fd0b4d46f5533076ae2b74747ba4b72447a5de3244ef
-
Filesize
72KB
MD57270365188490560b1f840a8003e289b
SHA11c912ba4301a528af58d5327e8244c47c335a012
SHA25625ba5a5ad2f0e478c87900724064c4808433d569b629dd892eea0d77008727cb
SHA5120999d87b631d8b398d3172a17a9441e466b64a76875cb8ca3541af3ef45f1f5086c9301eb239e6854468e8656613af248e34270f167aea3592717dd6774eee25
-
Filesize
72KB
MD57270365188490560b1f840a8003e289b
SHA11c912ba4301a528af58d5327e8244c47c335a012
SHA25625ba5a5ad2f0e478c87900724064c4808433d569b629dd892eea0d77008727cb
SHA5120999d87b631d8b398d3172a17a9441e466b64a76875cb8ca3541af3ef45f1f5086c9301eb239e6854468e8656613af248e34270f167aea3592717dd6774eee25
-
Filesize
72KB
MD57270365188490560b1f840a8003e289b
SHA11c912ba4301a528af58d5327e8244c47c335a012
SHA25625ba5a5ad2f0e478c87900724064c4808433d569b629dd892eea0d77008727cb
SHA5120999d87b631d8b398d3172a17a9441e466b64a76875cb8ca3541af3ef45f1f5086c9301eb239e6854468e8656613af248e34270f167aea3592717dd6774eee25
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD5be8f7763822d397589bd72a18fdefacd
SHA113ec51e325774d8bec87a70792ba3d15199fa31d
SHA256e5f3b043b03e84a5e5a4a7e3f55f3da06c8c00bb2fd6916d5d3db71adaf49f5b
SHA512cfe5d4cac91370485575a6ed0f18d8437737b00b8ebbda4da9b5a81a55b6acd5a4a7293469741c15fbd280a1583d542aeb30f5c67a20232002c26c014a53e288
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD57a85f2261469aa09bcb6f7b235c21de4
SHA1f1a191652f5dbf9f304ec5abc9547b4e3c975174
SHA256ad2d38a57328119d8b3ef38fac35a2ef2dff89424278aa694021b36582d55417
SHA51271413d55b5535fe74ff5a332df11a0a21176354205b87fcddef3972b76027a7ff679007d39258e6900fd0ff1e73e4d0f8b12afccfeef685fab6acb81b62517ad
-
Filesize
72KB
MD5582de23e9b7b4f5053637a5b3bf7bd1d
SHA17116573dc56cc9edf0ad6c261ffc8c626029388f
SHA25638ed6193814be3524b128b02795ff2677c604a179e445b8ad5192ece57a41522
SHA512c7f26bd0e2cefb53b24b584db03b46b85c8ac705a82fd0811de610e925765152af7eac792bbfe12429437915d40371c394f268114c80dec6178fb976f6aa6122
-
Filesize
72KB
MD5582de23e9b7b4f5053637a5b3bf7bd1d
SHA17116573dc56cc9edf0ad6c261ffc8c626029388f
SHA25638ed6193814be3524b128b02795ff2677c604a179e445b8ad5192ece57a41522
SHA512c7f26bd0e2cefb53b24b584db03b46b85c8ac705a82fd0811de610e925765152af7eac792bbfe12429437915d40371c394f268114c80dec6178fb976f6aa6122
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD5582de23e9b7b4f5053637a5b3bf7bd1d
SHA17116573dc56cc9edf0ad6c261ffc8c626029388f
SHA25638ed6193814be3524b128b02795ff2677c604a179e445b8ad5192ece57a41522
SHA512c7f26bd0e2cefb53b24b584db03b46b85c8ac705a82fd0811de610e925765152af7eac792bbfe12429437915d40371c394f268114c80dec6178fb976f6aa6122
-
Filesize
72KB
MD5582de23e9b7b4f5053637a5b3bf7bd1d
SHA17116573dc56cc9edf0ad6c261ffc8c626029388f
SHA25638ed6193814be3524b128b02795ff2677c604a179e445b8ad5192ece57a41522
SHA512c7f26bd0e2cefb53b24b584db03b46b85c8ac705a82fd0811de610e925765152af7eac792bbfe12429437915d40371c394f268114c80dec6178fb976f6aa6122
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
72KB
MD575243e652e10981fa455aadb6ed82324
SHA18cc286c9f3e1b9f49d538e1f47192a2ff4774c82
SHA25642754948533a4c3c49e4ce3eeee0119ad942a81056d5ffcfd9336a6b505539de
SHA51262e56f5a95993edaa80d58008cc987795d3c64c40cf9d1a6d49988207c22e21c1db57ca4ef41ae2de47a40ad32049d013ab073c253e0a1d8a2bf915c8bf9b898
-
Filesize
8KB
-
Filesize
8KB