Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe
Resource
win10v2004-20220812-en
General
-
Target
e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe
-
Size
72KB
-
MD5
06dfec4c3ff5b4af77e68b57dea37250
-
SHA1
601d704ca43f57df6cdc3c5b7b505de900a9a2de
-
SHA256
e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9
-
SHA512
003a2819a3188b3e4113c17acdc17a15ab7f6a7189715e2cdcd1f68d9eb00a311a0e19554ff4c64bc18d9cd1bbdb2e3cd5499ca9216c5040fcb17859549a994c
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf25:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrV
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1136 backup.exe 704 backup.exe 1000 backup.exe 1512 backup.exe 1752 backup.exe 1388 backup.exe 1672 update.exe 1292 backup.exe 1780 backup.exe 984 backup.exe 1900 update.exe 840 backup.exe 1200 backup.exe 1656 backup.exe 1140 backup.exe 304 backup.exe 1532 backup.exe 2016 backup.exe 1648 backup.exe 1384 backup.exe 1064 backup.exe 1768 backup.exe 1664 backup.exe 1560 backup.exe 1728 backup.exe 1544 backup.exe 1264 backup.exe 588 backup.exe 1872 backup.exe 1388 backup.exe 1772 backup.exe 1572 backup.exe 1600 backup.exe 868 backup.exe 1432 backup.exe 1416 System Restore.exe 1672 backup.exe 1372 backup.exe 1952 backup.exe 832 backup.exe 1776 backup.exe 1072 data.exe 1496 backup.exe 972 backup.exe 540 backup.exe 280 backup.exe 912 backup.exe 1504 backup.exe 628 backup.exe 856 backup.exe 272 backup.exe 1848 backup.exe 1724 backup.exe 1548 backup.exe 552 backup.exe 828 backup.exe 800 backup.exe 1116 backup.exe 1388 backup.exe 960 backup.exe 1572 backup.exe 1600 backup.exe 1964 backup.exe 560 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 1752 backup.exe 1752 backup.exe 1388 backup.exe 1388 backup.exe 1752 backup.exe 1752 backup.exe 1780 backup.exe 1780 backup.exe 984 backup.exe 1900 update.exe 1672 update.exe 1672 update.exe 1900 update.exe 1900 update.exe 1672 update.exe 1780 backup.exe 1780 backup.exe 840 backup.exe 840 backup.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 1200 backup.exe 1200 backup.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 1200 backup.exe 1200 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 1872 backup.exe 1872 backup.exe 1872 backup.exe 1872 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Reference Assemblies\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\data.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe backup.exe File opened for modification C:\Program Files\VideoLAN\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 1136 backup.exe 704 backup.exe 1000 backup.exe 1512 backup.exe 1752 backup.exe 1388 backup.exe 1292 backup.exe 1780 backup.exe 984 backup.exe 1672 update.exe 1900 update.exe 840 backup.exe 1200 backup.exe 1656 backup.exe 1140 backup.exe 304 backup.exe 1532 backup.exe 2016 backup.exe 1648 backup.exe 1384 backup.exe 1064 backup.exe 1768 backup.exe 1664 backup.exe 1560 backup.exe 1728 backup.exe 1544 backup.exe 1264 backup.exe 588 backup.exe 1872 backup.exe 1388 backup.exe 1772 backup.exe 1572 backup.exe 1600 backup.exe 868 backup.exe 1432 backup.exe 1416 System Restore.exe 1672 backup.exe 1372 backup.exe 832 backup.exe 1776 backup.exe 1952 backup.exe 1072 data.exe 1496 backup.exe 540 backup.exe 972 backup.exe 1504 backup.exe 280 backup.exe 912 backup.exe 628 backup.exe 856 backup.exe 272 backup.exe 1848 backup.exe 1724 backup.exe 1548 backup.exe 552 backup.exe 828 backup.exe 800 backup.exe 1116 backup.exe 1388 backup.exe 960 backup.exe 1572 backup.exe 1600 backup.exe 1964 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 288 wrote to memory of 1136 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 26 PID 288 wrote to memory of 1136 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 26 PID 288 wrote to memory of 1136 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 26 PID 288 wrote to memory of 1136 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 26 PID 288 wrote to memory of 704 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 27 PID 288 wrote to memory of 704 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 27 PID 288 wrote to memory of 704 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 27 PID 288 wrote to memory of 704 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 27 PID 288 wrote to memory of 1000 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 28 PID 288 wrote to memory of 1000 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 28 PID 288 wrote to memory of 1000 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 28 PID 288 wrote to memory of 1000 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 28 PID 288 wrote to memory of 1512 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 29 PID 288 wrote to memory of 1512 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 29 PID 288 wrote to memory of 1512 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 29 PID 288 wrote to memory of 1512 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 29 PID 1136 wrote to memory of 1752 1136 backup.exe 31 PID 1136 wrote to memory of 1752 1136 backup.exe 31 PID 1136 wrote to memory of 1752 1136 backup.exe 31 PID 1136 wrote to memory of 1752 1136 backup.exe 31 PID 1752 wrote to memory of 1388 1752 backup.exe 32 PID 1752 wrote to memory of 1388 1752 backup.exe 32 PID 1752 wrote to memory of 1388 1752 backup.exe 32 PID 1752 wrote to memory of 1388 1752 backup.exe 32 PID 288 wrote to memory of 1672 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 30 PID 288 wrote to memory of 1672 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 30 PID 288 wrote to memory of 1672 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 30 PID 288 wrote to memory of 1672 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 30 PID 288 wrote to memory of 1672 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 30 PID 288 wrote to memory of 1672 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 30 PID 288 wrote to memory of 1672 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 30 PID 1388 wrote to memory of 1292 1388 backup.exe 33 PID 1388 wrote to memory of 1292 1388 backup.exe 33 PID 1388 wrote to memory of 1292 1388 backup.exe 33 PID 1388 wrote to memory of 1292 1388 backup.exe 33 PID 1752 wrote to memory of 1780 1752 backup.exe 34 PID 1752 wrote to memory of 1780 1752 backup.exe 34 PID 1752 wrote to memory of 1780 1752 backup.exe 34 PID 1752 wrote to memory of 1780 1752 backup.exe 34 PID 1780 wrote to memory of 984 1780 backup.exe 35 PID 1780 wrote to memory of 984 1780 backup.exe 35 PID 1780 wrote to memory of 984 1780 backup.exe 35 PID 1780 wrote to memory of 984 1780 backup.exe 35 PID 984 wrote to memory of 1900 984 backup.exe 36 PID 984 wrote to memory of 1900 984 backup.exe 36 PID 984 wrote to memory of 1900 984 backup.exe 36 PID 984 wrote to memory of 1900 984 backup.exe 36 PID 984 wrote to memory of 1900 984 backup.exe 36 PID 984 wrote to memory of 1900 984 backup.exe 36 PID 984 wrote to memory of 1900 984 backup.exe 36 PID 1780 wrote to memory of 840 1780 backup.exe 37 PID 1780 wrote to memory of 840 1780 backup.exe 37 PID 1780 wrote to memory of 840 1780 backup.exe 37 PID 1780 wrote to memory of 840 1780 backup.exe 37 PID 840 wrote to memory of 1200 840 backup.exe 38 PID 840 wrote to memory of 1200 840 backup.exe 38 PID 840 wrote to memory of 1200 840 backup.exe 38 PID 840 wrote to memory of 1200 840 backup.exe 38 PID 288 wrote to memory of 1656 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 39 PID 288 wrote to memory of 1656 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 39 PID 288 wrote to memory of 1656 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 39 PID 288 wrote to memory of 1656 288 e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe 39 PID 1200 wrote to memory of 1140 1200 backup.exe 40 PID 1200 wrote to memory of 1140 1200 backup.exe 40 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe"C:\Users\Admin\AppData\Local\Temp\e64f8aee573ca3686c27b6009fd8b914602c3b731ee390ae80d1fb8376bfc8d9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Users\Admin\AppData\Local\Temp\1902929976\backup.exeC:\Users\Admin\AppData\Local\Temp\1902929976\backup.exe C:\Users\Admin\AppData\Local\Temp\1902929976\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1388 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1292
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1780 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Program Files\7-Zip\Lang\update.exe"C:\Program Files\7-Zip\Lang\update.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1140
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2016
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1664
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1264
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1872 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1388
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1572
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1432
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:280
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- System policy modification
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- System policy modification
PID:304
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1140
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:1724
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
PID:800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:1008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵PID:1420
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵PID:1388
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵PID:2064
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵PID:2144
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵PID:2308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵PID:2408
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:972 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:800
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1512
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
PID:1164
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1220
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1504 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- System policy modification
PID:532
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
PID:1388
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1488
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1616
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:1096
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1332
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵PID:2096
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\update.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\update.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵PID:2168
-
-
-
C:\Program Files\Common Files\Services\System Restore.exe"C:\Program Files\Common Files\Services\System Restore.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1416
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:832 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:912
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1848 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:960
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Disables RegEdit via registry modification
PID:1120
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:2044
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1064
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1664
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1320
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:268
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1140
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1748
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:880
-
-
C:\Program Files\Common Files\System\it-IT\update.exe"C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\7⤵PID:1740
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:2112
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:2232
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:2352
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1672 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1372
-
-
C:\Program Files\DVD Maker\en-US\data.exe"C:\Program Files\DVD Maker\en-US\data.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1072
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:540
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:828
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Disables RegEdit via registry modification
PID:1968
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:932
-
-
C:\Program Files\DVD Maker\Shared\update.exe"C:\Program Files\DVD Maker\Shared\update.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1124 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:908 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:760
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1072
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- Modifies visibility of file extensions in Explorer
PID:964
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1500
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:972
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:2072
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:2132
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:2268
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:2368
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
- System policy modification
PID:400 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1432
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1644 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1504
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:704
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:932
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1728
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:2176
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2300
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵PID:2400
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1576
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1624
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:552 -
C:\Program Files\Microsoft Office\Office14\backup.exe"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\6⤵PID:2200
-
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:2080
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:2160
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:2292
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2392
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:868 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1952 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1496 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:856 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:272
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1388
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1564 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
PID:1656
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1088
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵PID:1988
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵PID:1420
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵PID:1872
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:992 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵PID:1512
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1336 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵PID:1684
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:1640
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵PID:1952
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1088
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:800
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:1164
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1372 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:956
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1680
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1628
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:400
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵PID:964
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:1348
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1244 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1084 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1048
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:1772
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:268
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1520
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1708
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:1984
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵PID:1340
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵PID:1672
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵PID:2184
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:832
-
-
C:\Program Files (x86)\Internet Explorer\update.exe"C:\Program Files (x86)\Internet Explorer\update.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:984
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\System Restore.exe"C:\Program Files (x86)\Microsoft Synchronization Services\System Restore.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:2344
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- System policy modification
PID:1160 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
PID:872 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1572
-
-
C:\Users\Admin\Desktop\data.exeC:\Users\Admin\Desktop\data.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2044
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:532
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- System policy modification
PID:844
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:592
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵PID:2056
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵PID:2152
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:2284
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:2384
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1720
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:1416
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:704
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:304
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD599734a1265137ba4731b6ec641c82062
SHA17327fe3a97bfdfce1fe021be775beb5512deb29b
SHA256b0871979646e21877697a2a99c77e328365e47c714130f73db383ffc20fcc66a
SHA512ef86183e96926a6f1e073b3697c88e8db0c9ab77967205ef1cd5ec132cfbc2422e5a05c306ba5347f9d202b7c47d4b407aa609bc947ea3e7f053207516037c95
-
Filesize
72KB
MD58102b4544c0a0a97d61672e08105ff5d
SHA1f56925d2f503de5767805289fd86d07cf30b378f
SHA256f5228a17b3e912735a3e8a5e2fdf5b1e2857872c276bdce3ba5b23e9bccdf3ed
SHA512e815331c334db3a979d03f2a9db144a17a30f2e594df1e8cee4a1a43882dea6980b72b1b2fcb96a84fa8d9e1d26351d9a6c5a8e2e5881c632df64c15f9a5c41b
-
Filesize
72KB
MD58102b4544c0a0a97d61672e08105ff5d
SHA1f56925d2f503de5767805289fd86d07cf30b378f
SHA256f5228a17b3e912735a3e8a5e2fdf5b1e2857872c276bdce3ba5b23e9bccdf3ed
SHA512e815331c334db3a979d03f2a9db144a17a30f2e594df1e8cee4a1a43882dea6980b72b1b2fcb96a84fa8d9e1d26351d9a6c5a8e2e5881c632df64c15f9a5c41b
-
Filesize
72KB
MD55ebc272117927d8cae6f496c4858bf04
SHA1b69080a830c7cd7da3f5b426722fcb297463fa84
SHA256b98a956bf15ee6365e22c2f74231f54352f7e61a6630bc867d036907a7b86a54
SHA51226ca6a3ab270a7f0af24d9dc8dd26213cea9fc3d30a76b0e070691d1ae54bc4998324b825937a806ca66a00f5ee059a4d435cea3f70f77ca8111adb5b33283fb
-
Filesize
72KB
MD55ebc272117927d8cae6f496c4858bf04
SHA1b69080a830c7cd7da3f5b426722fcb297463fa84
SHA256b98a956bf15ee6365e22c2f74231f54352f7e61a6630bc867d036907a7b86a54
SHA51226ca6a3ab270a7f0af24d9dc8dd26213cea9fc3d30a76b0e070691d1ae54bc4998324b825937a806ca66a00f5ee059a4d435cea3f70f77ca8111adb5b33283fb
-
Filesize
72KB
MD5293d5d59477d1e0576dcfd00ac7a1d59
SHA14f6a1c439d177eeadf40d18bb80aec8e585f3f86
SHA25646723403404d0b3f4ac5ef2449d93c96ce8e4db34c19aff90d21d1517f7d270f
SHA5128c4afbb7301c6e486875f66ffc3b17043fe238b02e88dbf3dafa67d44faef660bffe6f71d16802857f2278bff732eedff9021c37f9925dfbff445d4eed1343d2
-
Filesize
72KB
MD5293d5d59477d1e0576dcfd00ac7a1d59
SHA14f6a1c439d177eeadf40d18bb80aec8e585f3f86
SHA25646723403404d0b3f4ac5ef2449d93c96ce8e4db34c19aff90d21d1517f7d270f
SHA5128c4afbb7301c6e486875f66ffc3b17043fe238b02e88dbf3dafa67d44faef660bffe6f71d16802857f2278bff732eedff9021c37f9925dfbff445d4eed1343d2
-
Filesize
72KB
MD5efc50dc23d7ea72dfbd542e914ce8ef5
SHA11a95a47c19f828dca1715dc6987745576a837691
SHA256db069dae954cb00f3a2bcc056c90fb6d0e0d8858543eb8adbdd6c55bab338d8b
SHA512554d193c3a3eb3a6fbc428ee59d2e8bb7a25dcc919931a81143d926021a3b3cc442769297dbf9fd87aa983b52425b710214ec90380c4e7dbf7d7790b97555895
-
Filesize
72KB
MD587fb5aa8e0b83639d361c3a45c4b1553
SHA12040c7987b05f0e2f2c37ba3f990a888a45984d6
SHA2560026b93177482fb83014f1269fa9acf10cc701d7e3d43f652787030266acb79c
SHA512a03318ce79e66b11649f7d2f4ef0b00a1d89e49b1e5ae8be6dbdad8e730d74320f85c5388354532ec4d163897bdb9536a8f2b14646addb304e4c26d1928f1ab8
-
Filesize
72KB
MD587fb5aa8e0b83639d361c3a45c4b1553
SHA12040c7987b05f0e2f2c37ba3f990a888a45984d6
SHA2560026b93177482fb83014f1269fa9acf10cc701d7e3d43f652787030266acb79c
SHA512a03318ce79e66b11649f7d2f4ef0b00a1d89e49b1e5ae8be6dbdad8e730d74320f85c5388354532ec4d163897bdb9536a8f2b14646addb304e4c26d1928f1ab8
-
Filesize
72KB
MD5efc50dc23d7ea72dfbd542e914ce8ef5
SHA11a95a47c19f828dca1715dc6987745576a837691
SHA256db069dae954cb00f3a2bcc056c90fb6d0e0d8858543eb8adbdd6c55bab338d8b
SHA512554d193c3a3eb3a6fbc428ee59d2e8bb7a25dcc919931a81143d926021a3b3cc442769297dbf9fd87aa983b52425b710214ec90380c4e7dbf7d7790b97555895
-
Filesize
72KB
MD5efc50dc23d7ea72dfbd542e914ce8ef5
SHA11a95a47c19f828dca1715dc6987745576a837691
SHA256db069dae954cb00f3a2bcc056c90fb6d0e0d8858543eb8adbdd6c55bab338d8b
SHA512554d193c3a3eb3a6fbc428ee59d2e8bb7a25dcc919931a81143d926021a3b3cc442769297dbf9fd87aa983b52425b710214ec90380c4e7dbf7d7790b97555895
-
Filesize
72KB
MD525350d45be55f3c248c6f9fc878e5ccc
SHA18618ee41d799b990f7ddf4510f8129cf67a94a44
SHA256f031ea658547e621d73467375e596e7be42a64a26d7dba42d50120809eeb99b6
SHA5123d797aa25b2f1d76c05e46c9d6c0f34c20ef29ca360a881079e71c75eee96d50d208b59cf2ddffba9bcf0fa072446b2e763d0f2d4429bdd192a6db996615caa2
-
Filesize
72KB
MD525350d45be55f3c248c6f9fc878e5ccc
SHA18618ee41d799b990f7ddf4510f8129cf67a94a44
SHA256f031ea658547e621d73467375e596e7be42a64a26d7dba42d50120809eeb99b6
SHA5123d797aa25b2f1d76c05e46c9d6c0f34c20ef29ca360a881079e71c75eee96d50d208b59cf2ddffba9bcf0fa072446b2e763d0f2d4429bdd192a6db996615caa2
-
Filesize
72KB
MD5316d6123bd04da001af024e54c91539b
SHA164010284df9cb1f88c4df7d5863bfac033ad0b8b
SHA25627b0d4d56671fb654062a589aa5d16e3cf7a6c7aedc7b955866975b9049f0c37
SHA512c7736836dc3fa1cf3f3dddf0de78997148668afe4b8d664d23303f5c9fc7c994fbebf11769a61b23e8a044c95b2c94c5401e305f75bb20243ae6f1402af40cc3
-
Filesize
72KB
MD5316d6123bd04da001af024e54c91539b
SHA164010284df9cb1f88c4df7d5863bfac033ad0b8b
SHA25627b0d4d56671fb654062a589aa5d16e3cf7a6c7aedc7b955866975b9049f0c37
SHA512c7736836dc3fa1cf3f3dddf0de78997148668afe4b8d664d23303f5c9fc7c994fbebf11769a61b23e8a044c95b2c94c5401e305f75bb20243ae6f1402af40cc3
-
Filesize
72KB
MD5c3ad0fd1027d35c1f824c4cb60cc4d41
SHA1b7609177fd2dafca5f1a59ba1193bd1378946675
SHA256d80584896b968f13eacf81b44d04db154a3eac7d335fe6ceddfda7c76652f5a5
SHA512099b2bd98112a6701177f88f481ba22933df4ab3bd0e2fdbc3129ab2ec3d3e42f0df3326f6bd0f15e18506ebcdc1ac1781654b95c3e17c3850aafd42022097fc
-
Filesize
72KB
MD5c3ad0fd1027d35c1f824c4cb60cc4d41
SHA1b7609177fd2dafca5f1a59ba1193bd1378946675
SHA256d80584896b968f13eacf81b44d04db154a3eac7d335fe6ceddfda7c76652f5a5
SHA512099b2bd98112a6701177f88f481ba22933df4ab3bd0e2fdbc3129ab2ec3d3e42f0df3326f6bd0f15e18506ebcdc1ac1781654b95c3e17c3850aafd42022097fc
-
Filesize
72KB
MD566f5f9b637d93953643acb0c08507ce8
SHA15b45805a5c3089c7c54342520012bc63f8e7e6f9
SHA256de528bbad938c6969866c65b787b54156ea65626c189661387094b5b5c91dc77
SHA512f00097f015e1b2a9a9ea35a125066b43706955f44b965168587a52091db56dcafee8d06530d52857a87519272e29665c25b3a671fd670b89b8aa808280ee7d04
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
Filesize
72KB
MD52755431326920b73ab315c6c72fa0256
SHA16ace9526863f06b49cf9ffa2f2d079de665e486b
SHA256ec0e89409280afa5bc720fc40a8ca384708aa4940d0174f672769f37694efdd1
SHA5123237216982305ec4f1eb7c899061b991c7c645fd0d2d8b7b07ed5a90c93ea9e523f44be3372bdc68f63fb631a993ec47e1a867c7b9fbc5106ad81cd46f049fb0
-
Filesize
72KB
MD566f5f9b637d93953643acb0c08507ce8
SHA15b45805a5c3089c7c54342520012bc63f8e7e6f9
SHA256de528bbad938c6969866c65b787b54156ea65626c189661387094b5b5c91dc77
SHA512f00097f015e1b2a9a9ea35a125066b43706955f44b965168587a52091db56dcafee8d06530d52857a87519272e29665c25b3a671fd670b89b8aa808280ee7d04
-
Filesize
72KB
MD5deb4a344856de53bcd1c7d27f1c10719
SHA138c02bfc586ae0c3d9e1ac076b6f8ac2f1e8b5ce
SHA256bca3e214bfeb49253168507a7dbd9edd0f8e12759bb6fdad8617699d377af80e
SHA5124c6db68e5bcb43454f2a93fed3fa20a7143fec08db6833de959b67cf073be2e60db00c295aefe57dfb4cf15c8a65fe08fba9629f28382533468737752298df21
-
Filesize
72KB
MD578c3df17a1ce4949f0d33c4f337c8ca9
SHA124dfc8c362071de7bdb1d4bcb3aa93a3a79eef72
SHA256e5a166f956f4cf80c33e40932e891a6bb8f85cd9b2c780252fdf4ac96b9bc4fe
SHA51202a22f4e18ed883b97680b3bebdcffebba0a98626c23e6a81be8b8e74803524424d34527fce1af367c36d305eb228fe40fac21ef03e757848edea74d6f1089d4
-
Filesize
72KB
MD578c3df17a1ce4949f0d33c4f337c8ca9
SHA124dfc8c362071de7bdb1d4bcb3aa93a3a79eef72
SHA256e5a166f956f4cf80c33e40932e891a6bb8f85cd9b2c780252fdf4ac96b9bc4fe
SHA51202a22f4e18ed883b97680b3bebdcffebba0a98626c23e6a81be8b8e74803524424d34527fce1af367c36d305eb228fe40fac21ef03e757848edea74d6f1089d4
-
Filesize
72KB
MD599734a1265137ba4731b6ec641c82062
SHA17327fe3a97bfdfce1fe021be775beb5512deb29b
SHA256b0871979646e21877697a2a99c77e328365e47c714130f73db383ffc20fcc66a
SHA512ef86183e96926a6f1e073b3697c88e8db0c9ab77967205ef1cd5ec132cfbc2422e5a05c306ba5347f9d202b7c47d4b407aa609bc947ea3e7f053207516037c95
-
Filesize
72KB
MD599734a1265137ba4731b6ec641c82062
SHA17327fe3a97bfdfce1fe021be775beb5512deb29b
SHA256b0871979646e21877697a2a99c77e328365e47c714130f73db383ffc20fcc66a
SHA512ef86183e96926a6f1e073b3697c88e8db0c9ab77967205ef1cd5ec132cfbc2422e5a05c306ba5347f9d202b7c47d4b407aa609bc947ea3e7f053207516037c95
-
Filesize
72KB
MD58102b4544c0a0a97d61672e08105ff5d
SHA1f56925d2f503de5767805289fd86d07cf30b378f
SHA256f5228a17b3e912735a3e8a5e2fdf5b1e2857872c276bdce3ba5b23e9bccdf3ed
SHA512e815331c334db3a979d03f2a9db144a17a30f2e594df1e8cee4a1a43882dea6980b72b1b2fcb96a84fa8d9e1d26351d9a6c5a8e2e5881c632df64c15f9a5c41b
-
Filesize
72KB
MD58102b4544c0a0a97d61672e08105ff5d
SHA1f56925d2f503de5767805289fd86d07cf30b378f
SHA256f5228a17b3e912735a3e8a5e2fdf5b1e2857872c276bdce3ba5b23e9bccdf3ed
SHA512e815331c334db3a979d03f2a9db144a17a30f2e594df1e8cee4a1a43882dea6980b72b1b2fcb96a84fa8d9e1d26351d9a6c5a8e2e5881c632df64c15f9a5c41b
-
Filesize
72KB
MD55ebc272117927d8cae6f496c4858bf04
SHA1b69080a830c7cd7da3f5b426722fcb297463fa84
SHA256b98a956bf15ee6365e22c2f74231f54352f7e61a6630bc867d036907a7b86a54
SHA51226ca6a3ab270a7f0af24d9dc8dd26213cea9fc3d30a76b0e070691d1ae54bc4998324b825937a806ca66a00f5ee059a4d435cea3f70f77ca8111adb5b33283fb
-
Filesize
72KB
MD55ebc272117927d8cae6f496c4858bf04
SHA1b69080a830c7cd7da3f5b426722fcb297463fa84
SHA256b98a956bf15ee6365e22c2f74231f54352f7e61a6630bc867d036907a7b86a54
SHA51226ca6a3ab270a7f0af24d9dc8dd26213cea9fc3d30a76b0e070691d1ae54bc4998324b825937a806ca66a00f5ee059a4d435cea3f70f77ca8111adb5b33283fb
-
Filesize
72KB
MD55ebc272117927d8cae6f496c4858bf04
SHA1b69080a830c7cd7da3f5b426722fcb297463fa84
SHA256b98a956bf15ee6365e22c2f74231f54352f7e61a6630bc867d036907a7b86a54
SHA51226ca6a3ab270a7f0af24d9dc8dd26213cea9fc3d30a76b0e070691d1ae54bc4998324b825937a806ca66a00f5ee059a4d435cea3f70f77ca8111adb5b33283fb
-
Filesize
72KB
MD55ebc272117927d8cae6f496c4858bf04
SHA1b69080a830c7cd7da3f5b426722fcb297463fa84
SHA256b98a956bf15ee6365e22c2f74231f54352f7e61a6630bc867d036907a7b86a54
SHA51226ca6a3ab270a7f0af24d9dc8dd26213cea9fc3d30a76b0e070691d1ae54bc4998324b825937a806ca66a00f5ee059a4d435cea3f70f77ca8111adb5b33283fb
-
Filesize
72KB
MD5293d5d59477d1e0576dcfd00ac7a1d59
SHA14f6a1c439d177eeadf40d18bb80aec8e585f3f86
SHA25646723403404d0b3f4ac5ef2449d93c96ce8e4db34c19aff90d21d1517f7d270f
SHA5128c4afbb7301c6e486875f66ffc3b17043fe238b02e88dbf3dafa67d44faef660bffe6f71d16802857f2278bff732eedff9021c37f9925dfbff445d4eed1343d2
-
Filesize
72KB
MD5293d5d59477d1e0576dcfd00ac7a1d59
SHA14f6a1c439d177eeadf40d18bb80aec8e585f3f86
SHA25646723403404d0b3f4ac5ef2449d93c96ce8e4db34c19aff90d21d1517f7d270f
SHA5128c4afbb7301c6e486875f66ffc3b17043fe238b02e88dbf3dafa67d44faef660bffe6f71d16802857f2278bff732eedff9021c37f9925dfbff445d4eed1343d2
-
Filesize
72KB
MD5efc50dc23d7ea72dfbd542e914ce8ef5
SHA11a95a47c19f828dca1715dc6987745576a837691
SHA256db069dae954cb00f3a2bcc056c90fb6d0e0d8858543eb8adbdd6c55bab338d8b
SHA512554d193c3a3eb3a6fbc428ee59d2e8bb7a25dcc919931a81143d926021a3b3cc442769297dbf9fd87aa983b52425b710214ec90380c4e7dbf7d7790b97555895
-
Filesize
72KB
MD5efc50dc23d7ea72dfbd542e914ce8ef5
SHA11a95a47c19f828dca1715dc6987745576a837691
SHA256db069dae954cb00f3a2bcc056c90fb6d0e0d8858543eb8adbdd6c55bab338d8b
SHA512554d193c3a3eb3a6fbc428ee59d2e8bb7a25dcc919931a81143d926021a3b3cc442769297dbf9fd87aa983b52425b710214ec90380c4e7dbf7d7790b97555895
-
Filesize
72KB
MD587fb5aa8e0b83639d361c3a45c4b1553
SHA12040c7987b05f0e2f2c37ba3f990a888a45984d6
SHA2560026b93177482fb83014f1269fa9acf10cc701d7e3d43f652787030266acb79c
SHA512a03318ce79e66b11649f7d2f4ef0b00a1d89e49b1e5ae8be6dbdad8e730d74320f85c5388354532ec4d163897bdb9536a8f2b14646addb304e4c26d1928f1ab8
-
Filesize
72KB
MD587fb5aa8e0b83639d361c3a45c4b1553
SHA12040c7987b05f0e2f2c37ba3f990a888a45984d6
SHA2560026b93177482fb83014f1269fa9acf10cc701d7e3d43f652787030266acb79c
SHA512a03318ce79e66b11649f7d2f4ef0b00a1d89e49b1e5ae8be6dbdad8e730d74320f85c5388354532ec4d163897bdb9536a8f2b14646addb304e4c26d1928f1ab8
-
Filesize
72KB
MD5cb076b9964f0e8069748dec01b170704
SHA1513af802b446299b820a0cbe0bc02a3061dcae78
SHA2569b68f73a65474ced9f3b4362986ccecbfe6dbea27c7a7ca52fa2b81daa30ef28
SHA512f5b14dce88534c2e413dcc5bacaba14bdf2a93833bac3061a4367e3d5e7041dbde6308987ba61ce27ac4a6200ed451c4f3e5915ca7cb8c35044a4f04ba7a3e1d
-
Filesize
72KB
MD5efc50dc23d7ea72dfbd542e914ce8ef5
SHA11a95a47c19f828dca1715dc6987745576a837691
SHA256db069dae954cb00f3a2bcc056c90fb6d0e0d8858543eb8adbdd6c55bab338d8b
SHA512554d193c3a3eb3a6fbc428ee59d2e8bb7a25dcc919931a81143d926021a3b3cc442769297dbf9fd87aa983b52425b710214ec90380c4e7dbf7d7790b97555895
-
Filesize
72KB
MD5efc50dc23d7ea72dfbd542e914ce8ef5
SHA11a95a47c19f828dca1715dc6987745576a837691
SHA256db069dae954cb00f3a2bcc056c90fb6d0e0d8858543eb8adbdd6c55bab338d8b
SHA512554d193c3a3eb3a6fbc428ee59d2e8bb7a25dcc919931a81143d926021a3b3cc442769297dbf9fd87aa983b52425b710214ec90380c4e7dbf7d7790b97555895
-
Filesize
72KB
MD525350d45be55f3c248c6f9fc878e5ccc
SHA18618ee41d799b990f7ddf4510f8129cf67a94a44
SHA256f031ea658547e621d73467375e596e7be42a64a26d7dba42d50120809eeb99b6
SHA5123d797aa25b2f1d76c05e46c9d6c0f34c20ef29ca360a881079e71c75eee96d50d208b59cf2ddffba9bcf0fa072446b2e763d0f2d4429bdd192a6db996615caa2
-
Filesize
72KB
MD525350d45be55f3c248c6f9fc878e5ccc
SHA18618ee41d799b990f7ddf4510f8129cf67a94a44
SHA256f031ea658547e621d73467375e596e7be42a64a26d7dba42d50120809eeb99b6
SHA5123d797aa25b2f1d76c05e46c9d6c0f34c20ef29ca360a881079e71c75eee96d50d208b59cf2ddffba9bcf0fa072446b2e763d0f2d4429bdd192a6db996615caa2
-
Filesize
72KB
MD5316d6123bd04da001af024e54c91539b
SHA164010284df9cb1f88c4df7d5863bfac033ad0b8b
SHA25627b0d4d56671fb654062a589aa5d16e3cf7a6c7aedc7b955866975b9049f0c37
SHA512c7736836dc3fa1cf3f3dddf0de78997148668afe4b8d664d23303f5c9fc7c994fbebf11769a61b23e8a044c95b2c94c5401e305f75bb20243ae6f1402af40cc3
-
Filesize
72KB
MD5316d6123bd04da001af024e54c91539b
SHA164010284df9cb1f88c4df7d5863bfac033ad0b8b
SHA25627b0d4d56671fb654062a589aa5d16e3cf7a6c7aedc7b955866975b9049f0c37
SHA512c7736836dc3fa1cf3f3dddf0de78997148668afe4b8d664d23303f5c9fc7c994fbebf11769a61b23e8a044c95b2c94c5401e305f75bb20243ae6f1402af40cc3
-
Filesize
72KB
MD5c3ad0fd1027d35c1f824c4cb60cc4d41
SHA1b7609177fd2dafca5f1a59ba1193bd1378946675
SHA256d80584896b968f13eacf81b44d04db154a3eac7d335fe6ceddfda7c76652f5a5
SHA512099b2bd98112a6701177f88f481ba22933df4ab3bd0e2fdbc3129ab2ec3d3e42f0df3326f6bd0f15e18506ebcdc1ac1781654b95c3e17c3850aafd42022097fc
-
Filesize
72KB
MD5c3ad0fd1027d35c1f824c4cb60cc4d41
SHA1b7609177fd2dafca5f1a59ba1193bd1378946675
SHA256d80584896b968f13eacf81b44d04db154a3eac7d335fe6ceddfda7c76652f5a5
SHA512099b2bd98112a6701177f88f481ba22933df4ab3bd0e2fdbc3129ab2ec3d3e42f0df3326f6bd0f15e18506ebcdc1ac1781654b95c3e17c3850aafd42022097fc
-
Filesize
72KB
MD566f5f9b637d93953643acb0c08507ce8
SHA15b45805a5c3089c7c54342520012bc63f8e7e6f9
SHA256de528bbad938c6969866c65b787b54156ea65626c189661387094b5b5c91dc77
SHA512f00097f015e1b2a9a9ea35a125066b43706955f44b965168587a52091db56dcafee8d06530d52857a87519272e29665c25b3a671fd670b89b8aa808280ee7d04
-
Filesize
72KB
MD566f5f9b637d93953643acb0c08507ce8
SHA15b45805a5c3089c7c54342520012bc63f8e7e6f9
SHA256de528bbad938c6969866c65b787b54156ea65626c189661387094b5b5c91dc77
SHA512f00097f015e1b2a9a9ea35a125066b43706955f44b965168587a52091db56dcafee8d06530d52857a87519272e29665c25b3a671fd670b89b8aa808280ee7d04
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD56b2f38a7b19f5e783436f8f3b174b2c0
SHA1ed06a2d1f6c57c0c9e6fa446b0b1517bcfaabbc2
SHA25641d6fff0dabc51ece6eae1e10d4c32bc56a4d450cc9f1a1f7087e5cc1b877575
SHA5121941ebd4896076506e7e3a1a28dc8186f4b937321daa3e979d2eb5bd7abd08ff7e83498cf55bcfcf2200d4450603f238af50fe88d9776081c707ced288c80c00
-
Filesize
72KB
MD52755431326920b73ab315c6c72fa0256
SHA16ace9526863f06b49cf9ffa2f2d079de665e486b
SHA256ec0e89409280afa5bc720fc40a8ca384708aa4940d0174f672769f37694efdd1
SHA5123237216982305ec4f1eb7c899061b991c7c645fd0d2d8b7b07ed5a90c93ea9e523f44be3372bdc68f63fb631a993ec47e1a867c7b9fbc5106ad81cd46f049fb0
-
Filesize
72KB
MD52755431326920b73ab315c6c72fa0256
SHA16ace9526863f06b49cf9ffa2f2d079de665e486b
SHA256ec0e89409280afa5bc720fc40a8ca384708aa4940d0174f672769f37694efdd1
SHA5123237216982305ec4f1eb7c899061b991c7c645fd0d2d8b7b07ed5a90c93ea9e523f44be3372bdc68f63fb631a993ec47e1a867c7b9fbc5106ad81cd46f049fb0
-
Filesize
72KB
MD566f5f9b637d93953643acb0c08507ce8
SHA15b45805a5c3089c7c54342520012bc63f8e7e6f9
SHA256de528bbad938c6969866c65b787b54156ea65626c189661387094b5b5c91dc77
SHA512f00097f015e1b2a9a9ea35a125066b43706955f44b965168587a52091db56dcafee8d06530d52857a87519272e29665c25b3a671fd670b89b8aa808280ee7d04
-
Filesize
72KB
MD566f5f9b637d93953643acb0c08507ce8
SHA15b45805a5c3089c7c54342520012bc63f8e7e6f9
SHA256de528bbad938c6969866c65b787b54156ea65626c189661387094b5b5c91dc77
SHA512f00097f015e1b2a9a9ea35a125066b43706955f44b965168587a52091db56dcafee8d06530d52857a87519272e29665c25b3a671fd670b89b8aa808280ee7d04
-
Filesize
72KB
MD5deb4a344856de53bcd1c7d27f1c10719
SHA138c02bfc586ae0c3d9e1ac076b6f8ac2f1e8b5ce
SHA256bca3e214bfeb49253168507a7dbd9edd0f8e12759bb6fdad8617699d377af80e
SHA5124c6db68e5bcb43454f2a93fed3fa20a7143fec08db6833de959b67cf073be2e60db00c295aefe57dfb4cf15c8a65fe08fba9629f28382533468737752298df21
-
Filesize
72KB
MD5deb4a344856de53bcd1c7d27f1c10719
SHA138c02bfc586ae0c3d9e1ac076b6f8ac2f1e8b5ce
SHA256bca3e214bfeb49253168507a7dbd9edd0f8e12759bb6fdad8617699d377af80e
SHA5124c6db68e5bcb43454f2a93fed3fa20a7143fec08db6833de959b67cf073be2e60db00c295aefe57dfb4cf15c8a65fe08fba9629f28382533468737752298df21