Analysis
-
max time kernel
75s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
02/12/2022, 20:18
General
-
Target
55607aa3cf0264157d303f4355dd8e7dc7968631bf932e0900ba4fabb5ad35c6.exe
-
Size
72KB
-
MD5
fca64661fdada274798058b11f8beb57
-
SHA1
6ce096857a018b459e26bcd10a4cea0c07511dd6
-
SHA256
55607aa3cf0264157d303f4355dd8e7dc7968631bf932e0900ba4fabb5ad35c6
-
SHA512
556460f6c83ccb6679ed6bfc81a3e627680baa2438aba3a42e3e9e429fba44f8c560a98ca88bffd0254a28826cc8679bdae2eb22ac891b73bada3c9326509a90
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2N:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrB
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Disables RegEdit via registry modification 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55607aa3cf0264157d303f4355dd8e7dc7968631bf932e0900ba4fabb5ad35c6.exe"C:\Users\Admin\AppData\Local\Temp\55607aa3cf0264157d303f4355dd8e7dc7968631bf932e0900ba4fabb5ad35c6.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\604410737\backup.exeC:\Users\Admin\AppData\Local\Temp\604410737\backup.exe C:\Users\Admin\AppData\Local\Temp\604410737\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Disables RegEdit via registry modification
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- System policy modification
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
-
C:\Program Files\Common Files\System\msadc\de-DE\data.exe"C:\Program Files\Common Files\System\msadc\de-DE\data.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
-
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\DVD Maker\ja-JP\update.exe"C:\Program Files\DVD Maker\ja-JP\update.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\8⤵
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\8⤵
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- System policy modification
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Disables RegEdit via registry modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\data.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
-
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- System policy modification
-
C:\Users\Admin\Contacts\data.exeC:\Users\Admin\Contacts\data.exe C:\Users\Admin\Contacts\6⤵
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
-
C:\Users\Admin\Documents\data.exeC:\Users\Admin\Documents\data.exe C:\Users\Admin\Documents\6⤵
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD54b277a200de21522da6c52a3911c7bee
SHA12c107d5eaaecc1e59811e4b8bddffcc31a5af575
SHA2562667b651fd3907f4f4804357d0e75852fa27799a6e1f27deab9bfc4f7d627fdb
SHA51299df6a67c8b96595a408abf79ee797a72c40d1b8b20b272620698d0a202ffdb40c8f33086cbf07c56cc1db4c0faa3a54c99fa4424593467cb9792c927479913f
-
Filesize
72KB
MD50e827ecb5b739b75f2a4a93dd0179844
SHA1e85757b8a00f5c00eab532d7004302e877dbdef1
SHA256a61a49ffb6cd3ebe8affe3dbad28c375073ca8671cab2ce10c787165692529d0
SHA5126b7936ebaec99db112b8de99890dc896df7e4028b1826d1a26c61ad6f59ac1ea54a422d55af912f94f120f7159479b25ec65fab617c45c4436fc395cd308f48d
-
Filesize
72KB
MD50e827ecb5b739b75f2a4a93dd0179844
SHA1e85757b8a00f5c00eab532d7004302e877dbdef1
SHA256a61a49ffb6cd3ebe8affe3dbad28c375073ca8671cab2ce10c787165692529d0
SHA5126b7936ebaec99db112b8de99890dc896df7e4028b1826d1a26c61ad6f59ac1ea54a422d55af912f94f120f7159479b25ec65fab617c45c4436fc395cd308f48d
-
Filesize
72KB
MD50afaeaf1da39b36cc585bbf9fae3b52d
SHA13dbc3376fcedd096b60274be8992fbd521a2b55f
SHA2561a2696d29d0df0155a9c940168e26218901cb0dcf74ee8e6c7548df3cbb0b00c
SHA512ca48679c981ad23d40386bebeab24e16706c77de8b660812a6c97895b1d87e1f80dbfdab1d6c7d89b92ae300bf04f01ec481f278a58b7c7645e98c740adb3874
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD59c11eb99d9b7a82cd21f70cdb9498d23
SHA1290628c3cd55872b8df0e2549bc9681f74887a51
SHA256791f559c01a0563a119643ff1c29bfc25744a886abf1530182afc8e1e435f32d
SHA512aaf46af69bab758e927d594652ae1616b5d96127837bd47ff414de4674433cc0d74ffc31c3e9da10e31ed75a9cf9221491ec927a5af5100daff14d222743b2ad
-
Filesize
72KB
MD50afaeaf1da39b36cc585bbf9fae3b52d
SHA13dbc3376fcedd096b60274be8992fbd521a2b55f
SHA2561a2696d29d0df0155a9c940168e26218901cb0dcf74ee8e6c7548df3cbb0b00c
SHA512ca48679c981ad23d40386bebeab24e16706c77de8b660812a6c97895b1d87e1f80dbfdab1d6c7d89b92ae300bf04f01ec481f278a58b7c7645e98c740adb3874
-
Filesize
72KB
MD50afaeaf1da39b36cc585bbf9fae3b52d
SHA13dbc3376fcedd096b60274be8992fbd521a2b55f
SHA2561a2696d29d0df0155a9c940168e26218901cb0dcf74ee8e6c7548df3cbb0b00c
SHA512ca48679c981ad23d40386bebeab24e16706c77de8b660812a6c97895b1d87e1f80dbfdab1d6c7d89b92ae300bf04f01ec481f278a58b7c7645e98c740adb3874
-
Filesize
72KB
MD5cd1a130d0e494b155344bb2ce508c36e
SHA1ad2d9f3f8be0e1b596096c7fa93d0441dabaec9a
SHA25610e8b7dd321d78c2a3b7582425b6c7edf9fd763657831e9b86b185f5449e9023
SHA512207de3c6c5a2b3f4cf661716dfe16dcab2b28f6d979b0bb0cfdfe1db0e599d5ffef1de27d4c4dbb83d34641e0e5c5346ff166898b49dd74ed2bec1b0e87897ce
-
Filesize
72KB
MD59c11eb99d9b7a82cd21f70cdb9498d23
SHA1290628c3cd55872b8df0e2549bc9681f74887a51
SHA256791f559c01a0563a119643ff1c29bfc25744a886abf1530182afc8e1e435f32d
SHA512aaf46af69bab758e927d594652ae1616b5d96127837bd47ff414de4674433cc0d74ffc31c3e9da10e31ed75a9cf9221491ec927a5af5100daff14d222743b2ad
-
Filesize
72KB
MD59c11eb99d9b7a82cd21f70cdb9498d23
SHA1290628c3cd55872b8df0e2549bc9681f74887a51
SHA256791f559c01a0563a119643ff1c29bfc25744a886abf1530182afc8e1e435f32d
SHA512aaf46af69bab758e927d594652ae1616b5d96127837bd47ff414de4674433cc0d74ffc31c3e9da10e31ed75a9cf9221491ec927a5af5100daff14d222743b2ad
-
Filesize
72KB
MD5cd1a130d0e494b155344bb2ce508c36e
SHA1ad2d9f3f8be0e1b596096c7fa93d0441dabaec9a
SHA25610e8b7dd321d78c2a3b7582425b6c7edf9fd763657831e9b86b185f5449e9023
SHA512207de3c6c5a2b3f4cf661716dfe16dcab2b28f6d979b0bb0cfdfe1db0e599d5ffef1de27d4c4dbb83d34641e0e5c5346ff166898b49dd74ed2bec1b0e87897ce
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD517526bbf97f61a5ae94a39d2b904125c
SHA1916c4e2a3453bddd455cdf05ceafd3a132d29941
SHA256ccdcd1200e397ac68700d80f385669922df4f0ecb51f3c9185db9f86da36a789
SHA512b4bb8410bbb0e4dd3c113b58a24bba1345702b7339663e1bef614d97883d70aa97657f5d678f985ec7f320785c6bd4fa209c9c9147ded01c086812bcd7274497
-
Filesize
72KB
MD517526bbf97f61a5ae94a39d2b904125c
SHA1916c4e2a3453bddd455cdf05ceafd3a132d29941
SHA256ccdcd1200e397ac68700d80f385669922df4f0ecb51f3c9185db9f86da36a789
SHA512b4bb8410bbb0e4dd3c113b58a24bba1345702b7339663e1bef614d97883d70aa97657f5d678f985ec7f320785c6bd4fa209c9c9147ded01c086812bcd7274497
-
Filesize
72KB
MD5ebb32810cdf4b9fcd1c2c8210260b51a
SHA18ac179fcdc6ccff6051017ddf0a7b3ec539ae735
SHA256e60089350115a1dd2ca725b6feec10b953c6878107818d3aad7baa155f261db5
SHA512eae3226d0032392c9a0d04ca5ab8b35c9150453b7ee9472d4b2c983eef1cd2ebf901c964f8903e85d05680318b205329433e10c85d28bed252a6b8f9ede867a1
-
Filesize
72KB
MD5ebb32810cdf4b9fcd1c2c8210260b51a
SHA18ac179fcdc6ccff6051017ddf0a7b3ec539ae735
SHA256e60089350115a1dd2ca725b6feec10b953c6878107818d3aad7baa155f261db5
SHA512eae3226d0032392c9a0d04ca5ab8b35c9150453b7ee9472d4b2c983eef1cd2ebf901c964f8903e85d05680318b205329433e10c85d28bed252a6b8f9ede867a1
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD5b21d56370f6f8108a61b45f3a65df717
SHA1ea2ff222c281ad5c193a969e6c8d4e33f23dfc96
SHA256c9fcd527f1a721270df857c5284f5d9fcf1fd7c476f5eb048aea49d4702fe0c8
SHA5122aad74449a94fd700654578097bf23cecbb7b5821b24415a0ab6f97bb24669df6aba254c1f9d7f1cb4ba6b63747fbe3eb4257c8780285dd9f9060532eaed7212
-
Filesize
72KB
MD5ebb32810cdf4b9fcd1c2c8210260b51a
SHA18ac179fcdc6ccff6051017ddf0a7b3ec539ae735
SHA256e60089350115a1dd2ca725b6feec10b953c6878107818d3aad7baa155f261db5
SHA512eae3226d0032392c9a0d04ca5ab8b35c9150453b7ee9472d4b2c983eef1cd2ebf901c964f8903e85d05680318b205329433e10c85d28bed252a6b8f9ede867a1
-
Filesize
72KB
MD5462f9c1665755af56e27c368e04c610d
SHA1dc01367417c2be0f728961566c34ec1e121972d3
SHA256041469113b52fc7307b31e911efd95fcd45b6d26f6451a08ea9c5bcd36dea1cd
SHA512cf69f4a262c4bc91d975510a17b124b243c47295adae898f18990fdf051e972014f28af9a0a16fbcea20148495816e8457c3604f6417c78c20cf679243b3bbad
-
Filesize
72KB
MD5604e86ddc94f0192979dabd309f1880c
SHA12330f8f88e3a89691c0a7e0d38d5c1572d0f5bff
SHA256baa1b99ab916078477e8150e6adf913e13acc4076fc8ebd7e496dc49b368ecc2
SHA512f7ab7c534eafd5854cda26bd4279f56e4fa12a0fd8527f60ecfd3255b4ecffc4748543ecedabcb03e37d0397f7a735e0d9786601b017439feb8640597dd86fc6
-
Filesize
72KB
MD5604e86ddc94f0192979dabd309f1880c
SHA12330f8f88e3a89691c0a7e0d38d5c1572d0f5bff
SHA256baa1b99ab916078477e8150e6adf913e13acc4076fc8ebd7e496dc49b368ecc2
SHA512f7ab7c534eafd5854cda26bd4279f56e4fa12a0fd8527f60ecfd3255b4ecffc4748543ecedabcb03e37d0397f7a735e0d9786601b017439feb8640597dd86fc6
-
Filesize
72KB
MD54b277a200de21522da6c52a3911c7bee
SHA12c107d5eaaecc1e59811e4b8bddffcc31a5af575
SHA2562667b651fd3907f4f4804357d0e75852fa27799a6e1f27deab9bfc4f7d627fdb
SHA51299df6a67c8b96595a408abf79ee797a72c40d1b8b20b272620698d0a202ffdb40c8f33086cbf07c56cc1db4c0faa3a54c99fa4424593467cb9792c927479913f
-
Filesize
72KB
MD54b277a200de21522da6c52a3911c7bee
SHA12c107d5eaaecc1e59811e4b8bddffcc31a5af575
SHA2562667b651fd3907f4f4804357d0e75852fa27799a6e1f27deab9bfc4f7d627fdb
SHA51299df6a67c8b96595a408abf79ee797a72c40d1b8b20b272620698d0a202ffdb40c8f33086cbf07c56cc1db4c0faa3a54c99fa4424593467cb9792c927479913f
-
Filesize
72KB
MD50e827ecb5b739b75f2a4a93dd0179844
SHA1e85757b8a00f5c00eab532d7004302e877dbdef1
SHA256a61a49ffb6cd3ebe8affe3dbad28c375073ca8671cab2ce10c787165692529d0
SHA5126b7936ebaec99db112b8de99890dc896df7e4028b1826d1a26c61ad6f59ac1ea54a422d55af912f94f120f7159479b25ec65fab617c45c4436fc395cd308f48d
-
Filesize
72KB
MD50e827ecb5b739b75f2a4a93dd0179844
SHA1e85757b8a00f5c00eab532d7004302e877dbdef1
SHA256a61a49ffb6cd3ebe8affe3dbad28c375073ca8671cab2ce10c787165692529d0
SHA5126b7936ebaec99db112b8de99890dc896df7e4028b1826d1a26c61ad6f59ac1ea54a422d55af912f94f120f7159479b25ec65fab617c45c4436fc395cd308f48d
-
Filesize
72KB
MD50afaeaf1da39b36cc585bbf9fae3b52d
SHA13dbc3376fcedd096b60274be8992fbd521a2b55f
SHA2561a2696d29d0df0155a9c940168e26218901cb0dcf74ee8e6c7548df3cbb0b00c
SHA512ca48679c981ad23d40386bebeab24e16706c77de8b660812a6c97895b1d87e1f80dbfdab1d6c7d89b92ae300bf04f01ec481f278a58b7c7645e98c740adb3874
-
Filesize
72KB
MD50afaeaf1da39b36cc585bbf9fae3b52d
SHA13dbc3376fcedd096b60274be8992fbd521a2b55f
SHA2561a2696d29d0df0155a9c940168e26218901cb0dcf74ee8e6c7548df3cbb0b00c
SHA512ca48679c981ad23d40386bebeab24e16706c77de8b660812a6c97895b1d87e1f80dbfdab1d6c7d89b92ae300bf04f01ec481f278a58b7c7645e98c740adb3874
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD59c11eb99d9b7a82cd21f70cdb9498d23
SHA1290628c3cd55872b8df0e2549bc9681f74887a51
SHA256791f559c01a0563a119643ff1c29bfc25744a886abf1530182afc8e1e435f32d
SHA512aaf46af69bab758e927d594652ae1616b5d96127837bd47ff414de4674433cc0d74ffc31c3e9da10e31ed75a9cf9221491ec927a5af5100daff14d222743b2ad
-
Filesize
72KB
MD59c11eb99d9b7a82cd21f70cdb9498d23
SHA1290628c3cd55872b8df0e2549bc9681f74887a51
SHA256791f559c01a0563a119643ff1c29bfc25744a886abf1530182afc8e1e435f32d
SHA512aaf46af69bab758e927d594652ae1616b5d96127837bd47ff414de4674433cc0d74ffc31c3e9da10e31ed75a9cf9221491ec927a5af5100daff14d222743b2ad
-
Filesize
72KB
MD50afaeaf1da39b36cc585bbf9fae3b52d
SHA13dbc3376fcedd096b60274be8992fbd521a2b55f
SHA2561a2696d29d0df0155a9c940168e26218901cb0dcf74ee8e6c7548df3cbb0b00c
SHA512ca48679c981ad23d40386bebeab24e16706c77de8b660812a6c97895b1d87e1f80dbfdab1d6c7d89b92ae300bf04f01ec481f278a58b7c7645e98c740adb3874
-
Filesize
72KB
MD50afaeaf1da39b36cc585bbf9fae3b52d
SHA13dbc3376fcedd096b60274be8992fbd521a2b55f
SHA2561a2696d29d0df0155a9c940168e26218901cb0dcf74ee8e6c7548df3cbb0b00c
SHA512ca48679c981ad23d40386bebeab24e16706c77de8b660812a6c97895b1d87e1f80dbfdab1d6c7d89b92ae300bf04f01ec481f278a58b7c7645e98c740adb3874
-
Filesize
72KB
MD5cd1a130d0e494b155344bb2ce508c36e
SHA1ad2d9f3f8be0e1b596096c7fa93d0441dabaec9a
SHA25610e8b7dd321d78c2a3b7582425b6c7edf9fd763657831e9b86b185f5449e9023
SHA512207de3c6c5a2b3f4cf661716dfe16dcab2b28f6d979b0bb0cfdfe1db0e599d5ffef1de27d4c4dbb83d34641e0e5c5346ff166898b49dd74ed2bec1b0e87897ce
-
Filesize
72KB
MD5cd1a130d0e494b155344bb2ce508c36e
SHA1ad2d9f3f8be0e1b596096c7fa93d0441dabaec9a
SHA25610e8b7dd321d78c2a3b7582425b6c7edf9fd763657831e9b86b185f5449e9023
SHA512207de3c6c5a2b3f4cf661716dfe16dcab2b28f6d979b0bb0cfdfe1db0e599d5ffef1de27d4c4dbb83d34641e0e5c5346ff166898b49dd74ed2bec1b0e87897ce
-
Filesize
72KB
MD59c11eb99d9b7a82cd21f70cdb9498d23
SHA1290628c3cd55872b8df0e2549bc9681f74887a51
SHA256791f559c01a0563a119643ff1c29bfc25744a886abf1530182afc8e1e435f32d
SHA512aaf46af69bab758e927d594652ae1616b5d96127837bd47ff414de4674433cc0d74ffc31c3e9da10e31ed75a9cf9221491ec927a5af5100daff14d222743b2ad
-
Filesize
72KB
MD59c11eb99d9b7a82cd21f70cdb9498d23
SHA1290628c3cd55872b8df0e2549bc9681f74887a51
SHA256791f559c01a0563a119643ff1c29bfc25744a886abf1530182afc8e1e435f32d
SHA512aaf46af69bab758e927d594652ae1616b5d96127837bd47ff414de4674433cc0d74ffc31c3e9da10e31ed75a9cf9221491ec927a5af5100daff14d222743b2ad
-
Filesize
72KB
MD5cd1a130d0e494b155344bb2ce508c36e
SHA1ad2d9f3f8be0e1b596096c7fa93d0441dabaec9a
SHA25610e8b7dd321d78c2a3b7582425b6c7edf9fd763657831e9b86b185f5449e9023
SHA512207de3c6c5a2b3f4cf661716dfe16dcab2b28f6d979b0bb0cfdfe1db0e599d5ffef1de27d4c4dbb83d34641e0e5c5346ff166898b49dd74ed2bec1b0e87897ce
-
Filesize
72KB
MD5cd1a130d0e494b155344bb2ce508c36e
SHA1ad2d9f3f8be0e1b596096c7fa93d0441dabaec9a
SHA25610e8b7dd321d78c2a3b7582425b6c7edf9fd763657831e9b86b185f5449e9023
SHA512207de3c6c5a2b3f4cf661716dfe16dcab2b28f6d979b0bb0cfdfe1db0e599d5ffef1de27d4c4dbb83d34641e0e5c5346ff166898b49dd74ed2bec1b0e87897ce
-
Filesize
72KB
MD5cd1a130d0e494b155344bb2ce508c36e
SHA1ad2d9f3f8be0e1b596096c7fa93d0441dabaec9a
SHA25610e8b7dd321d78c2a3b7582425b6c7edf9fd763657831e9b86b185f5449e9023
SHA512207de3c6c5a2b3f4cf661716dfe16dcab2b28f6d979b0bb0cfdfe1db0e599d5ffef1de27d4c4dbb83d34641e0e5c5346ff166898b49dd74ed2bec1b0e87897ce
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD5885078a4db7126ff837f962394e8e8b1
SHA1ab0ff334d4d3a49bb20613537452455fcacd9941
SHA256d767486391f7a797d995a624ede6a011b7948d60fe5b34034aae16925bbbc327
SHA512b9789dda18ccadfddb1bc3f21ad16a66fa7c71d6beac65765b1dc02acd1b1fc4e3bf5bdd499bedb976cd1e15a54309f7e5e327e08806126b921b13f0d16a6b61
-
Filesize
72KB
MD517526bbf97f61a5ae94a39d2b904125c
SHA1916c4e2a3453bddd455cdf05ceafd3a132d29941
SHA256ccdcd1200e397ac68700d80f385669922df4f0ecb51f3c9185db9f86da36a789
SHA512b4bb8410bbb0e4dd3c113b58a24bba1345702b7339663e1bef614d97883d70aa97657f5d678f985ec7f320785c6bd4fa209c9c9147ded01c086812bcd7274497
-
Filesize
72KB
MD517526bbf97f61a5ae94a39d2b904125c
SHA1916c4e2a3453bddd455cdf05ceafd3a132d29941
SHA256ccdcd1200e397ac68700d80f385669922df4f0ecb51f3c9185db9f86da36a789
SHA512b4bb8410bbb0e4dd3c113b58a24bba1345702b7339663e1bef614d97883d70aa97657f5d678f985ec7f320785c6bd4fa209c9c9147ded01c086812bcd7274497
-
Filesize
72KB
MD5ebb32810cdf4b9fcd1c2c8210260b51a
SHA18ac179fcdc6ccff6051017ddf0a7b3ec539ae735
SHA256e60089350115a1dd2ca725b6feec10b953c6878107818d3aad7baa155f261db5
SHA512eae3226d0032392c9a0d04ca5ab8b35c9150453b7ee9472d4b2c983eef1cd2ebf901c964f8903e85d05680318b205329433e10c85d28bed252a6b8f9ede867a1
-
Filesize
72KB
MD5ebb32810cdf4b9fcd1c2c8210260b51a
SHA18ac179fcdc6ccff6051017ddf0a7b3ec539ae735
SHA256e60089350115a1dd2ca725b6feec10b953c6878107818d3aad7baa155f261db5
SHA512eae3226d0032392c9a0d04ca5ab8b35c9150453b7ee9472d4b2c983eef1cd2ebf901c964f8903e85d05680318b205329433e10c85d28bed252a6b8f9ede867a1
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD55eb9e87bb170340afaff175e099dccba
SHA18952c9b020567309b7e5feb1e4a10a75fbe508bf
SHA256f50f446127698b6b16e3d5a06f9b0ec2edd397279b156281080d83e2d67496e8
SHA5126ee3f039b8acaf04812a84b8499776ca09313e897a2b694d760a4d2ee8795a81a7dc46c4d1e5438376eddcc8829816a2c6a4e0ebbe85ceff5ee1ed74e68605c5
-
Filesize
72KB
MD5b21d56370f6f8108a61b45f3a65df717
SHA1ea2ff222c281ad5c193a969e6c8d4e33f23dfc96
SHA256c9fcd527f1a721270df857c5284f5d9fcf1fd7c476f5eb048aea49d4702fe0c8
SHA5122aad74449a94fd700654578097bf23cecbb7b5821b24415a0ab6f97bb24669df6aba254c1f9d7f1cb4ba6b63747fbe3eb4257c8780285dd9f9060532eaed7212
-
Filesize
72KB
MD5b21d56370f6f8108a61b45f3a65df717
SHA1ea2ff222c281ad5c193a969e6c8d4e33f23dfc96
SHA256c9fcd527f1a721270df857c5284f5d9fcf1fd7c476f5eb048aea49d4702fe0c8
SHA5122aad74449a94fd700654578097bf23cecbb7b5821b24415a0ab6f97bb24669df6aba254c1f9d7f1cb4ba6b63747fbe3eb4257c8780285dd9f9060532eaed7212
-
Filesize
72KB
MD5ebb32810cdf4b9fcd1c2c8210260b51a
SHA18ac179fcdc6ccff6051017ddf0a7b3ec539ae735
SHA256e60089350115a1dd2ca725b6feec10b953c6878107818d3aad7baa155f261db5
SHA512eae3226d0032392c9a0d04ca5ab8b35c9150453b7ee9472d4b2c983eef1cd2ebf901c964f8903e85d05680318b205329433e10c85d28bed252a6b8f9ede867a1
-
Filesize
72KB
MD5ebb32810cdf4b9fcd1c2c8210260b51a
SHA18ac179fcdc6ccff6051017ddf0a7b3ec539ae735
SHA256e60089350115a1dd2ca725b6feec10b953c6878107818d3aad7baa155f261db5
SHA512eae3226d0032392c9a0d04ca5ab8b35c9150453b7ee9472d4b2c983eef1cd2ebf901c964f8903e85d05680318b205329433e10c85d28bed252a6b8f9ede867a1
-
Filesize
72KB
MD5462f9c1665755af56e27c368e04c610d
SHA1dc01367417c2be0f728961566c34ec1e121972d3
SHA256041469113b52fc7307b31e911efd95fcd45b6d26f6451a08ea9c5bcd36dea1cd
SHA512cf69f4a262c4bc91d975510a17b124b243c47295adae898f18990fdf051e972014f28af9a0a16fbcea20148495816e8457c3604f6417c78c20cf679243b3bbad
-
Filesize
72KB
MD5462f9c1665755af56e27c368e04c610d
SHA1dc01367417c2be0f728961566c34ec1e121972d3
SHA256041469113b52fc7307b31e911efd95fcd45b6d26f6451a08ea9c5bcd36dea1cd
SHA512cf69f4a262c4bc91d975510a17b124b243c47295adae898f18990fdf051e972014f28af9a0a16fbcea20148495816e8457c3604f6417c78c20cf679243b3bbad
-
Filesize
8KB
-
Filesize
8KB