Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe
Resource
win10v2004-20221111-en
General
-
Target
12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe
-
Size
72KB
-
MD5
248643b8f3d27c37ec8ea9f828fc817a
-
SHA1
0a52d024902e0c6c45f9fad2cb01d3ed56aedba2
-
SHA256
12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5
-
SHA512
41a52c3fded064eeddd5a215dbf6e692d6a53d05a56948f4fed172c301b4c0afdcc00d1b06b15a0d96d9b3f76240032cbe81a8f15122c12edc4d14d228be3e89
-
SSDEEP
384:N6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KgxWb/83BXR+oG6:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrn
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1524 backup.exe 864 backup.exe 1708 update.exe 1276 backup.exe 1904 backup.exe 436 backup.exe 1960 update.exe 1392 backup.exe 1516 backup.exe 1848 backup.exe 552 backup.exe 1372 backup.exe 972 backup.exe 1968 backup.exe 1252 backup.exe 1044 backup.exe 1436 backup.exe 1268 backup.exe 924 backup.exe 1712 System Restore.exe 1700 backup.exe 1276 backup.exe 1548 backup.exe 696 backup.exe 1300 backup.exe 516 backup.exe 1944 backup.exe 908 backup.exe 1596 backup.exe 1776 backup.exe 1620 backup.exe 820 data.exe 1768 backup.exe 332 backup.exe 800 backup.exe 1576 backup.exe 584 backup.exe 960 backup.exe 1064 backup.exe 1140 backup.exe 580 backup.exe 972 backup.exe 1336 backup.exe 1228 data.exe 1136 backup.exe 964 data.exe 1684 backup.exe 544 backup.exe 824 backup.exe 1376 backup.exe 1536 backup.exe 976 backup.exe 1924 data.exe 1104 backup.exe 1604 backup.exe 1420 backup.exe 436 backup.exe 1256 backup.exe 1568 backup.exe 316 backup.exe 748 backup.exe 1644 backup.exe 1680 backup.exe 284 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 1708 update.exe 1708 update.exe 1708 update.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 1904 backup.exe 1904 backup.exe 1960 update.exe 1960 update.exe 1960 update.exe 436 backup.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 436 backup.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 1904 backup.exe 1904 backup.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 1904 backup.exe 1904 backup.exe 552 backup.exe 552 backup.exe 1372 backup.exe 1372 backup.exe 972 backup.exe 972 backup.exe 1968 backup.exe 1968 backup.exe 552 backup.exe 552 backup.exe 1436 backup.exe 1436 backup.exe 1044 backup.exe 1044 backup.exe 1268 backup.exe 1268 backup.exe 1044 backup.exe 1044 backup.exe 1268 backup.exe 1268 backup.exe 1700 backup.exe 1700 backup.exe 1276 backup.exe 1276 backup.exe 1700 backup.exe 1700 backup.exe 1276 backup.exe 1276 backup.exe 1700 backup.exe 1700 backup.exe 1276 backup.exe 1276 backup.exe 1700 backup.exe 1700 backup.exe 1276 backup.exe 1276 backup.exe 1596 backup.exe 1596 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe update.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\backup.exe update.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\update.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe backup.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\Boot\backup.exe backup.exe File opened for modification C:\Windows\Branding\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 1524 backup.exe 864 backup.exe 1708 update.exe 1276 backup.exe 1904 backup.exe 1960 update.exe 436 backup.exe 1392 backup.exe 1516 backup.exe 1848 backup.exe 552 backup.exe 1372 backup.exe 972 backup.exe 1968 backup.exe 1252 backup.exe 1044 backup.exe 1436 backup.exe 1268 backup.exe 924 backup.exe 1712 System Restore.exe 1700 backup.exe 1276 backup.exe 1548 backup.exe 696 backup.exe 1300 backup.exe 516 backup.exe 1944 backup.exe 908 backup.exe 1596 backup.exe 1776 backup.exe 1620 backup.exe 820 data.exe 1768 backup.exe 332 backup.exe 800 backup.exe 1576 backup.exe 584 backup.exe 960 backup.exe 1064 backup.exe 1140 backup.exe 580 backup.exe 972 backup.exe 1336 backup.exe 1228 data.exe 1136 backup.exe 964 data.exe 1684 backup.exe 544 backup.exe 824 backup.exe 1376 backup.exe 1536 backup.exe 976 backup.exe 1924 data.exe 1104 backup.exe 1604 backup.exe 1420 backup.exe 1256 backup.exe 436 backup.exe 1568 backup.exe 316 backup.exe 748 backup.exe 1644 backup.exe 1680 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 1524 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 28 PID 844 wrote to memory of 1524 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 28 PID 844 wrote to memory of 1524 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 28 PID 844 wrote to memory of 1524 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 28 PID 844 wrote to memory of 864 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 29 PID 844 wrote to memory of 864 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 29 PID 844 wrote to memory of 864 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 29 PID 844 wrote to memory of 864 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 29 PID 844 wrote to memory of 1708 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 30 PID 844 wrote to memory of 1708 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 30 PID 844 wrote to memory of 1708 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 30 PID 844 wrote to memory of 1708 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 30 PID 844 wrote to memory of 1708 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 30 PID 844 wrote to memory of 1708 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 30 PID 844 wrote to memory of 1708 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 30 PID 844 wrote to memory of 1276 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 31 PID 844 wrote to memory of 1276 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 31 PID 844 wrote to memory of 1276 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 31 PID 844 wrote to memory of 1276 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 31 PID 1524 wrote to memory of 1904 1524 backup.exe 32 PID 1524 wrote to memory of 1904 1524 backup.exe 32 PID 1524 wrote to memory of 1904 1524 backup.exe 32 PID 1524 wrote to memory of 1904 1524 backup.exe 32 PID 1904 wrote to memory of 436 1904 backup.exe 34 PID 1904 wrote to memory of 436 1904 backup.exe 34 PID 1904 wrote to memory of 436 1904 backup.exe 34 PID 1904 wrote to memory of 436 1904 backup.exe 34 PID 844 wrote to memory of 1960 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 33 PID 844 wrote to memory of 1960 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 33 PID 844 wrote to memory of 1960 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 33 PID 844 wrote to memory of 1960 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 33 PID 844 wrote to memory of 1960 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 33 PID 844 wrote to memory of 1960 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 33 PID 844 wrote to memory of 1960 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 33 PID 436 wrote to memory of 1392 436 backup.exe 35 PID 844 wrote to memory of 1516 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 36 PID 436 wrote to memory of 1392 436 backup.exe 35 PID 436 wrote to memory of 1392 436 backup.exe 35 PID 436 wrote to memory of 1392 436 backup.exe 35 PID 844 wrote to memory of 1516 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 36 PID 844 wrote to memory of 1516 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 36 PID 844 wrote to memory of 1516 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 36 PID 1904 wrote to memory of 552 1904 backup.exe 37 PID 1904 wrote to memory of 552 1904 backup.exe 37 PID 1904 wrote to memory of 552 1904 backup.exe 37 PID 1904 wrote to memory of 552 1904 backup.exe 37 PID 844 wrote to memory of 1848 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 38 PID 844 wrote to memory of 1848 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 38 PID 844 wrote to memory of 1848 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 38 PID 844 wrote to memory of 1848 844 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe 38 PID 1904 wrote to memory of 1372 1904 backup.exe 39 PID 1904 wrote to memory of 1372 1904 backup.exe 39 PID 1904 wrote to memory of 1372 1904 backup.exe 39 PID 1904 wrote to memory of 1372 1904 backup.exe 39 PID 552 wrote to memory of 972 552 backup.exe 40 PID 552 wrote to memory of 972 552 backup.exe 40 PID 552 wrote to memory of 972 552 backup.exe 40 PID 552 wrote to memory of 972 552 backup.exe 40 PID 1372 wrote to memory of 1968 1372 backup.exe 41 PID 1372 wrote to memory of 1968 1372 backup.exe 41 PID 1372 wrote to memory of 1968 1372 backup.exe 41 PID 1372 wrote to memory of 1968 1372 backup.exe 41 PID 972 wrote to memory of 1252 972 backup.exe 42 PID 972 wrote to memory of 1252 972 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe"C:\Users\Admin\AppData\Local\Temp\12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:844 -
C:\Users\Admin\AppData\Local\Temp\466884760\backup.exeC:\Users\Admin\AppData\Local\Temp\466884760\backup.exe C:\Users\Admin\AppData\Local\Temp\466884760\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:436 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1392
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:972 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1252
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1436 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1268 -
C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1276 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:696
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:516
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1776
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1336
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:824
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1536
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1924 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1256
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
PID:1856
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
PID:756
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- System policy modification
PID:340
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1136
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:2008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵PID:1904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵PID:2104
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1776 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1652
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:544
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1228
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:2056
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
PID:1728 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- System policy modification
PID:1408
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:768
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:668
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1392
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2072
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- System policy modification
PID:1696
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
PID:1680 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
PID:1108
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵PID:568
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
PID:108 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1004
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:1720
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1336
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:2064
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵PID:316
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:696
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- System policy modification
PID:1692 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:2096
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1764
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1636
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1968 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1044 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:924
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1700 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1548
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1300
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1944
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1596 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:820
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:332 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:800
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:584 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1064 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1140
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:580 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:972 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1228
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1136 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1684
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1376 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:976
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1104 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1420
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:436
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:316
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:284 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1004
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
PID:1500
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Drops file in Program Files directory
PID:1616 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
- Modifies visibility of file extensions in Explorer
PID:580
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
- Drops file in Program Files directory
- System policy modification
PID:964 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵
- System policy modification
PID:1160 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵
- Modifies visibility of file extensions in Explorer
PID:692
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
- System policy modification
PID:1300
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
- Modifies visibility of file extensions in Explorer
PID:976 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵
- Drops file in Program Files directory
PID:800 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\10⤵
- Modifies visibility of file extensions in Explorer
PID:1548
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\10⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1496 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\11⤵PID:1748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵PID:1492
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:820 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1580
-
-
-
-
-
C:\Program Files (x86)\Common Files\update.exe"C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
PID:1744 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:868
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1668
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1784
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵PID:2080
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1568 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
PID:1740
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1616
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:944
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:340
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1724
-
-
-
C:\Users\data.exeC:\Users\data.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1020 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
PID:748 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- System policy modification
PID:972
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:828
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1712
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:1968
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:2112
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1932
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
- System policy modification
PID:848 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1804
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1556
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1152
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:1020
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵PID:2124
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:864
-
-
C:\Users\Admin\AppData\Local\Temp\Low\update.exeC:\Users\Admin\AppData\Local\Temp\Low\update.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1848
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD595458937f3e8345e3a9223c146bb9da9
SHA1d5da8b0834fd8b1002902fde9819063958a0f95b
SHA256980e931560ba7962103eb89de6ffb4aacdfc699dd424e9e9ae0954da0a01a5b9
SHA512b7fa24d446d8541585fdc57625086b59dcc5e9b50840f970bd7f955d79c619feb01d507746ca3b425f09226f97f53419697e34ffcc064fbe2da8e96653220fc4
-
Filesize
72KB
MD5f385d413aa9105424d0cee140ef02cbf
SHA113f90b4c833ca7b12471fcadb09854de91c5d19a
SHA256c47e3e384a3255d05a504c4ab7845b443ff1dcd0f2429d8678510b2a690fac6b
SHA51240a632d7d752f3a4ebbbcbf5eed6931dfab7b181ee00320a4c2cbac7e43116cd0381abb0f762440c84304feefaab9fd2007a83cfca93969ccc7f8f6e0f6d7d1a
-
Filesize
72KB
MD5f385d413aa9105424d0cee140ef02cbf
SHA113f90b4c833ca7b12471fcadb09854de91c5d19a
SHA256c47e3e384a3255d05a504c4ab7845b443ff1dcd0f2429d8678510b2a690fac6b
SHA51240a632d7d752f3a4ebbbcbf5eed6931dfab7b181ee00320a4c2cbac7e43116cd0381abb0f762440c84304feefaab9fd2007a83cfca93969ccc7f8f6e0f6d7d1a
-
Filesize
72KB
MD5f3d9e12975da22e167b58235721fb544
SHA17a1f739fc00fbbdb49ec13ea48a84db419fa6ea5
SHA25663fa2f9f10ce711baf936b7366f2454185074238057be95578fbc6833794aff5
SHA512cf1b8876720dccb6fbdd1197d07eda615b652024dcabd655c0f3f0a6272c981c26029672ac17ca74b026bc21fbbd674270565af21c0f70bb3b531e45244dc227
-
Filesize
72KB
MD539ba92bd2acde924fe87e268fc33bf07
SHA15898bacdf659bd1acfa642f8ebc381d2da6d4877
SHA25692516760c4213cb098908f2b10ebafd8d225b79a6f71bcc8433d0969f2226df2
SHA512b06566ea23489f831fb6f29d7bc8537e77a5f2ca83cabad595102e3ffb0818374325bd7819234cf05e798d866d36cabf8f3faac7eea3888ef940ba5edb27fd23
-
Filesize
72KB
MD539ba92bd2acde924fe87e268fc33bf07
SHA15898bacdf659bd1acfa642f8ebc381d2da6d4877
SHA25692516760c4213cb098908f2b10ebafd8d225b79a6f71bcc8433d0969f2226df2
SHA512b06566ea23489f831fb6f29d7bc8537e77a5f2ca83cabad595102e3ffb0818374325bd7819234cf05e798d866d36cabf8f3faac7eea3888ef940ba5edb27fd23
-
Filesize
72KB
MD5bddd62d6aa3504bd137d77604eaab50e
SHA1ca1d1fa3b77c272640f8fc7e10b946f5fc05d08c
SHA256beb8d78f3d7536bfb2cc8e44446691f0fa3af7a4759b9421df33ef817ebb8d1d
SHA5120887c054ab07a616c2eaf4960c9236c01d4d61d66031246959d48559e93611923fe010b81e42d3e7f4fa065324df0d559e10e46fb3698bb73acbbe4cf7347c0f
-
Filesize
72KB
MD5bddd62d6aa3504bd137d77604eaab50e
SHA1ca1d1fa3b77c272640f8fc7e10b946f5fc05d08c
SHA256beb8d78f3d7536bfb2cc8e44446691f0fa3af7a4759b9421df33ef817ebb8d1d
SHA5120887c054ab07a616c2eaf4960c9236c01d4d61d66031246959d48559e93611923fe010b81e42d3e7f4fa065324df0d559e10e46fb3698bb73acbbe4cf7347c0f
-
Filesize
72KB
MD525413853a16348cc2f90f258e2e247a4
SHA18221f7776d91080f00332aa2bd5d1de298edfa3b
SHA2561142b45e78afd4c954f0110d5801057f56290e83028a3a18b5e19fab38b3a0fc
SHA5129a9ffd9bc0e10a16668de1885d061b402d472fa3a8836a2c2aeb8c14aa4f2f2572271682143f1c01518937054d903d188157ff6116d4ac74235b99c7a5ce316f
-
Filesize
72KB
MD5c80291e29e4efc9ecaea82b20982c30d
SHA1ab88e1794d1dc1829a8ebbe528418ebad48e1b04
SHA256e6d9ca1b577e2c63490ee196e8de7d6d546356aacae1f577a7bb4b2512ded86f
SHA512d13c5f8406a1a8b5ef8ee20ba4e41b4bd4a9c39800b4b6ef9c0d4ef8b7e1ed762bfc79e89b7f21ee0da444b6eaa134795b37007909431ff6c32298eb3964794d
-
Filesize
72KB
MD5c80291e29e4efc9ecaea82b20982c30d
SHA1ab88e1794d1dc1829a8ebbe528418ebad48e1b04
SHA256e6d9ca1b577e2c63490ee196e8de7d6d546356aacae1f577a7bb4b2512ded86f
SHA512d13c5f8406a1a8b5ef8ee20ba4e41b4bd4a9c39800b4b6ef9c0d4ef8b7e1ed762bfc79e89b7f21ee0da444b6eaa134795b37007909431ff6c32298eb3964794d
-
Filesize
72KB
MD54dfdee578a86a4079fa9969b2276fcad
SHA197fe681ebdb6ac3f9fffd60c341ceb7056a038c1
SHA2562ee38a09708fcd42d1780db7ccb6e9f49994b6a509240b39fd286316cc9146e9
SHA512bf3e7d0a80d11c5da71e17f7f309d109799e0623768df7a4c976a69aa919f798978069093493ccd84a672eb5286c8627de884579c73fbe8274e0fd25648fee79
-
Filesize
72KB
MD54dfdee578a86a4079fa9969b2276fcad
SHA197fe681ebdb6ac3f9fffd60c341ceb7056a038c1
SHA2562ee38a09708fcd42d1780db7ccb6e9f49994b6a509240b39fd286316cc9146e9
SHA512bf3e7d0a80d11c5da71e17f7f309d109799e0623768df7a4c976a69aa919f798978069093493ccd84a672eb5286c8627de884579c73fbe8274e0fd25648fee79
-
Filesize
72KB
MD5f843c5beb8252b0d2787cad0cc19c2ca
SHA1bc818f490dd645c42570822cc6ace41e20f72adf
SHA256af2480794d6e2ecf07b2b42a253ceddf647b22508e36c54259c9623c707d9a54
SHA512b00d8f4ef81d6e5a31e27eafe062d2cf54ec0579df0d476aeb625ea39e2310f86f8f1967e7d57acb005fc867413534bdd4c33e342accb78974b720737bb86b11
-
Filesize
72KB
MD5f843c5beb8252b0d2787cad0cc19c2ca
SHA1bc818f490dd645c42570822cc6ace41e20f72adf
SHA256af2480794d6e2ecf07b2b42a253ceddf647b22508e36c54259c9623c707d9a54
SHA512b00d8f4ef81d6e5a31e27eafe062d2cf54ec0579df0d476aeb625ea39e2310f86f8f1967e7d57acb005fc867413534bdd4c33e342accb78974b720737bb86b11
-
Filesize
72KB
MD58b768254890f39eb49dcfd2514a65921
SHA178765f10bb0d19aa24eb3e4c6614a892ed130ab1
SHA256cb2b8c9f5c56b1c9cf5a9d8860190ae8a5ca32cf1d92fe403b4eb1202d41c3b7
SHA5121ccea2a6be23e1ce6fff2a0cfc2d515dbc9a1a5681f4aeb719620e49a2ebcc7e0c56c6e99466c3e7a7e5996a25e0b5594837c593a7b0b84e4e4eb2f54e89c741
-
Filesize
72KB
MD58b768254890f39eb49dcfd2514a65921
SHA178765f10bb0d19aa24eb3e4c6614a892ed130ab1
SHA256cb2b8c9f5c56b1c9cf5a9d8860190ae8a5ca32cf1d92fe403b4eb1202d41c3b7
SHA5121ccea2a6be23e1ce6fff2a0cfc2d515dbc9a1a5681f4aeb719620e49a2ebcc7e0c56c6e99466c3e7a7e5996a25e0b5594837c593a7b0b84e4e4eb2f54e89c741
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
Filesize
72KB
MD54d2e5b3c9206f7f8fe7b6e4b8d17c34a
SHA1633906bf90b9e113bfc875cb9816b5483760cf01
SHA256969bd17066ce49fed00ebb96ff9efbe5884e47d952366dcf6fd16b49dab37995
SHA5125f519b6bc00ccf8c56c08ae8620c07599df841be3bd0b20baab90ac95a1a989c40f51526a0bbf6bcfa9080f4715faaa837ef0a7f8a0dcf1160d70822acb93268
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
Filesize
72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
Filesize
72KB
MD584f35cd1ac7ed55a56ed9979b1c9d2b2
SHA1fabcb050c01ce60654653965fb8d28bbda02344f
SHA256f8e807efb09198de67e0c130dcf1eaf77be8c8b5031ea5aec715514e83186b9f
SHA5126ee5319240a9a4366d38935783ae6b57d8c94e10cc199f5c76a810c6cdc8375f99e14c9f7e650a875d1b8bfe4f4b85af193eeaa6ff500e1b0b3401a4e854d5bd
-
Filesize
72KB
MD584f35cd1ac7ed55a56ed9979b1c9d2b2
SHA1fabcb050c01ce60654653965fb8d28bbda02344f
SHA256f8e807efb09198de67e0c130dcf1eaf77be8c8b5031ea5aec715514e83186b9f
SHA5126ee5319240a9a4366d38935783ae6b57d8c94e10cc199f5c76a810c6cdc8375f99e14c9f7e650a875d1b8bfe4f4b85af193eeaa6ff500e1b0b3401a4e854d5bd
-
Filesize
72KB
MD595458937f3e8345e3a9223c146bb9da9
SHA1d5da8b0834fd8b1002902fde9819063958a0f95b
SHA256980e931560ba7962103eb89de6ffb4aacdfc699dd424e9e9ae0954da0a01a5b9
SHA512b7fa24d446d8541585fdc57625086b59dcc5e9b50840f970bd7f955d79c619feb01d507746ca3b425f09226f97f53419697e34ffcc064fbe2da8e96653220fc4
-
Filesize
72KB
MD595458937f3e8345e3a9223c146bb9da9
SHA1d5da8b0834fd8b1002902fde9819063958a0f95b
SHA256980e931560ba7962103eb89de6ffb4aacdfc699dd424e9e9ae0954da0a01a5b9
SHA512b7fa24d446d8541585fdc57625086b59dcc5e9b50840f970bd7f955d79c619feb01d507746ca3b425f09226f97f53419697e34ffcc064fbe2da8e96653220fc4
-
Filesize
72KB
MD5f385d413aa9105424d0cee140ef02cbf
SHA113f90b4c833ca7b12471fcadb09854de91c5d19a
SHA256c47e3e384a3255d05a504c4ab7845b443ff1dcd0f2429d8678510b2a690fac6b
SHA51240a632d7d752f3a4ebbbcbf5eed6931dfab7b181ee00320a4c2cbac7e43116cd0381abb0f762440c84304feefaab9fd2007a83cfca93969ccc7f8f6e0f6d7d1a
-
Filesize
72KB
MD5f385d413aa9105424d0cee140ef02cbf
SHA113f90b4c833ca7b12471fcadb09854de91c5d19a
SHA256c47e3e384a3255d05a504c4ab7845b443ff1dcd0f2429d8678510b2a690fac6b
SHA51240a632d7d752f3a4ebbbcbf5eed6931dfab7b181ee00320a4c2cbac7e43116cd0381abb0f762440c84304feefaab9fd2007a83cfca93969ccc7f8f6e0f6d7d1a
-
Filesize
72KB
MD5f3d9e12975da22e167b58235721fb544
SHA17a1f739fc00fbbdb49ec13ea48a84db419fa6ea5
SHA25663fa2f9f10ce711baf936b7366f2454185074238057be95578fbc6833794aff5
SHA512cf1b8876720dccb6fbdd1197d07eda615b652024dcabd655c0f3f0a6272c981c26029672ac17ca74b026bc21fbbd674270565af21c0f70bb3b531e45244dc227
-
Filesize
72KB
MD5f3d9e12975da22e167b58235721fb544
SHA17a1f739fc00fbbdb49ec13ea48a84db419fa6ea5
SHA25663fa2f9f10ce711baf936b7366f2454185074238057be95578fbc6833794aff5
SHA512cf1b8876720dccb6fbdd1197d07eda615b652024dcabd655c0f3f0a6272c981c26029672ac17ca74b026bc21fbbd674270565af21c0f70bb3b531e45244dc227
-
Filesize
72KB
MD539ba92bd2acde924fe87e268fc33bf07
SHA15898bacdf659bd1acfa642f8ebc381d2da6d4877
SHA25692516760c4213cb098908f2b10ebafd8d225b79a6f71bcc8433d0969f2226df2
SHA512b06566ea23489f831fb6f29d7bc8537e77a5f2ca83cabad595102e3ffb0818374325bd7819234cf05e798d866d36cabf8f3faac7eea3888ef940ba5edb27fd23
-
Filesize
72KB
MD539ba92bd2acde924fe87e268fc33bf07
SHA15898bacdf659bd1acfa642f8ebc381d2da6d4877
SHA25692516760c4213cb098908f2b10ebafd8d225b79a6f71bcc8433d0969f2226df2
SHA512b06566ea23489f831fb6f29d7bc8537e77a5f2ca83cabad595102e3ffb0818374325bd7819234cf05e798d866d36cabf8f3faac7eea3888ef940ba5edb27fd23
-
Filesize
72KB
MD5bddd62d6aa3504bd137d77604eaab50e
SHA1ca1d1fa3b77c272640f8fc7e10b946f5fc05d08c
SHA256beb8d78f3d7536bfb2cc8e44446691f0fa3af7a4759b9421df33ef817ebb8d1d
SHA5120887c054ab07a616c2eaf4960c9236c01d4d61d66031246959d48559e93611923fe010b81e42d3e7f4fa065324df0d559e10e46fb3698bb73acbbe4cf7347c0f
-
Filesize
72KB
MD5bddd62d6aa3504bd137d77604eaab50e
SHA1ca1d1fa3b77c272640f8fc7e10b946f5fc05d08c
SHA256beb8d78f3d7536bfb2cc8e44446691f0fa3af7a4759b9421df33ef817ebb8d1d
SHA5120887c054ab07a616c2eaf4960c9236c01d4d61d66031246959d48559e93611923fe010b81e42d3e7f4fa065324df0d559e10e46fb3698bb73acbbe4cf7347c0f
-
Filesize
72KB
MD525413853a16348cc2f90f258e2e247a4
SHA18221f7776d91080f00332aa2bd5d1de298edfa3b
SHA2561142b45e78afd4c954f0110d5801057f56290e83028a3a18b5e19fab38b3a0fc
SHA5129a9ffd9bc0e10a16668de1885d061b402d472fa3a8836a2c2aeb8c14aa4f2f2572271682143f1c01518937054d903d188157ff6116d4ac74235b99c7a5ce316f
-
Filesize
72KB
MD525413853a16348cc2f90f258e2e247a4
SHA18221f7776d91080f00332aa2bd5d1de298edfa3b
SHA2561142b45e78afd4c954f0110d5801057f56290e83028a3a18b5e19fab38b3a0fc
SHA5129a9ffd9bc0e10a16668de1885d061b402d472fa3a8836a2c2aeb8c14aa4f2f2572271682143f1c01518937054d903d188157ff6116d4ac74235b99c7a5ce316f
-
Filesize
72KB
MD5c80291e29e4efc9ecaea82b20982c30d
SHA1ab88e1794d1dc1829a8ebbe528418ebad48e1b04
SHA256e6d9ca1b577e2c63490ee196e8de7d6d546356aacae1f577a7bb4b2512ded86f
SHA512d13c5f8406a1a8b5ef8ee20ba4e41b4bd4a9c39800b4b6ef9c0d4ef8b7e1ed762bfc79e89b7f21ee0da444b6eaa134795b37007909431ff6c32298eb3964794d
-
Filesize
72KB
MD5c80291e29e4efc9ecaea82b20982c30d
SHA1ab88e1794d1dc1829a8ebbe528418ebad48e1b04
SHA256e6d9ca1b577e2c63490ee196e8de7d6d546356aacae1f577a7bb4b2512ded86f
SHA512d13c5f8406a1a8b5ef8ee20ba4e41b4bd4a9c39800b4b6ef9c0d4ef8b7e1ed762bfc79e89b7f21ee0da444b6eaa134795b37007909431ff6c32298eb3964794d
-
Filesize
72KB
MD52ac140bd828f19dd667d69a0a139cc79
SHA1796baa6d554dd1541844f3839a4e69a848464f97
SHA25604c57bc43319a3043d1a82416a0c7237ae5edb9c5b578744d4ad33f25428f0d7
SHA51274c0f799b6b5f1053152452a909d66f15d3545744826a023c11f6bcb9a6d479fb58f93ff3f75ed06dee8af8f5aab2080c283094b70c2fef8125760601e1da89b
-
Filesize
72KB
MD54dfdee578a86a4079fa9969b2276fcad
SHA197fe681ebdb6ac3f9fffd60c341ceb7056a038c1
SHA2562ee38a09708fcd42d1780db7ccb6e9f49994b6a509240b39fd286316cc9146e9
SHA512bf3e7d0a80d11c5da71e17f7f309d109799e0623768df7a4c976a69aa919f798978069093493ccd84a672eb5286c8627de884579c73fbe8274e0fd25648fee79
-
Filesize
72KB
MD54dfdee578a86a4079fa9969b2276fcad
SHA197fe681ebdb6ac3f9fffd60c341ceb7056a038c1
SHA2562ee38a09708fcd42d1780db7ccb6e9f49994b6a509240b39fd286316cc9146e9
SHA512bf3e7d0a80d11c5da71e17f7f309d109799e0623768df7a4c976a69aa919f798978069093493ccd84a672eb5286c8627de884579c73fbe8274e0fd25648fee79
-
Filesize
72KB
MD5f843c5beb8252b0d2787cad0cc19c2ca
SHA1bc818f490dd645c42570822cc6ace41e20f72adf
SHA256af2480794d6e2ecf07b2b42a253ceddf647b22508e36c54259c9623c707d9a54
SHA512b00d8f4ef81d6e5a31e27eafe062d2cf54ec0579df0d476aeb625ea39e2310f86f8f1967e7d57acb005fc867413534bdd4c33e342accb78974b720737bb86b11
-
Filesize
72KB
MD5f843c5beb8252b0d2787cad0cc19c2ca
SHA1bc818f490dd645c42570822cc6ace41e20f72adf
SHA256af2480794d6e2ecf07b2b42a253ceddf647b22508e36c54259c9623c707d9a54
SHA512b00d8f4ef81d6e5a31e27eafe062d2cf54ec0579df0d476aeb625ea39e2310f86f8f1967e7d57acb005fc867413534bdd4c33e342accb78974b720737bb86b11
-
Filesize
72KB
MD58b768254890f39eb49dcfd2514a65921
SHA178765f10bb0d19aa24eb3e4c6614a892ed130ab1
SHA256cb2b8c9f5c56b1c9cf5a9d8860190ae8a5ca32cf1d92fe403b4eb1202d41c3b7
SHA5121ccea2a6be23e1ce6fff2a0cfc2d515dbc9a1a5681f4aeb719620e49a2ebcc7e0c56c6e99466c3e7a7e5996a25e0b5594837c593a7b0b84e4e4eb2f54e89c741
-
Filesize
72KB
MD58b768254890f39eb49dcfd2514a65921
SHA178765f10bb0d19aa24eb3e4c6614a892ed130ab1
SHA256cb2b8c9f5c56b1c9cf5a9d8860190ae8a5ca32cf1d92fe403b4eb1202d41c3b7
SHA5121ccea2a6be23e1ce6fff2a0cfc2d515dbc9a1a5681f4aeb719620e49a2ebcc7e0c56c6e99466c3e7a7e5996a25e0b5594837c593a7b0b84e4e4eb2f54e89c741
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
Filesize
72KB
MD54d2e5b3c9206f7f8fe7b6e4b8d17c34a
SHA1633906bf90b9e113bfc875cb9816b5483760cf01
SHA256969bd17066ce49fed00ebb96ff9efbe5884e47d952366dcf6fd16b49dab37995
SHA5125f519b6bc00ccf8c56c08ae8620c07599df841be3bd0b20baab90ac95a1a989c40f51526a0bbf6bcfa9080f4715faaa837ef0a7f8a0dcf1160d70822acb93268
-
Filesize
72KB
MD54d2e5b3c9206f7f8fe7b6e4b8d17c34a
SHA1633906bf90b9e113bfc875cb9816b5483760cf01
SHA256969bd17066ce49fed00ebb96ff9efbe5884e47d952366dcf6fd16b49dab37995
SHA5125f519b6bc00ccf8c56c08ae8620c07599df841be3bd0b20baab90ac95a1a989c40f51526a0bbf6bcfa9080f4715faaa837ef0a7f8a0dcf1160d70822acb93268
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
Filesize
72KB
MD5661a0bf3bbe06767f293e0b6ba656acc
SHA132a0c4ae1089c718aa9c91446b4a9ed7847666b6
SHA256771b1a79e32cd23d3e0d4769fa5a404b68cd31a9e8274890466b26e501d11ce3
SHA5124be9e31ab304fc3163799205e3edea465dcc3519d47f1d4474c965826402c298f897633d22ca9ad2e701334973ffe916121200278568867e633c419a9e8fffb9
-
Filesize
72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6
-
Filesize
72KB
MD54842c2b9a7553dfa2a1f3d01dcf9ee78
SHA178b0ef56032a4fa30477448a3cd3033093be270d
SHA25609c2ec5fc62aa723c77a67fc4e76272350c4da7d50645c4f5da8ffc3b69898c0
SHA5127330fa336b486aee751d0f871ed358c109573a5a7168ebe50dd869779d31ef135ec05c1e182ff779bd8595c30e25f48604c3bf19087013aa5995767411b314d6