Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe
Resource
win10v2004-20221111-en
General
-
Target
425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe
-
Size
72KB
-
MD5
06f27d1180e12302fbd201da76ad7927
-
SHA1
f5acf0d2545606f9324184906221b59fe22cbdb5
-
SHA256
425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29
-
SHA512
3b267912df37c26ba290be9af357085b88e183da0eec8887adefa1987c6748e93466a9bd9d00f3bc8373c9339337911848a030aea180b37b3ae2d95a42e5bdef
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2H:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPz
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 3532 backup.exe 3816 backup.exe 5016 backup.exe 3720 backup.exe 1908 backup.exe 4544 backup.exe 2636 backup.exe 676 backup.exe 1324 backup.exe 4340 backup.exe 4400 backup.exe 3824 backup.exe 4152 backup.exe 3868 backup.exe 4548 backup.exe 1888 backup.exe 4284 backup.exe 4360 backup.exe 736 backup.exe 4584 backup.exe 1076 backup.exe 2208 backup.exe 3840 backup.exe 3416 backup.exe 1400 backup.exe 2656 backup.exe 3920 backup.exe 2344 backup.exe 1852 backup.exe 4768 backup.exe 2956 backup.exe 4676 backup.exe 4776 backup.exe 2328 backup.exe 2836 backup.exe 64 backup.exe 1560 backup.exe 4460 backup.exe 4312 backup.exe 3460 backup.exe 4612 backup.exe 4232 data.exe 3936 backup.exe 1428 backup.exe 4996 data.exe 368 backup.exe 2180 backup.exe 2040 backup.exe 2608 backup.exe 1324 backup.exe 2780 backup.exe 1472 backup.exe 3212 backup.exe 3456 backup.exe 4316 backup.exe 1984 backup.exe 3812 backup.exe 4152 backup.exe 2928 backup.exe 4964 backup.exe 2148 update.exe 3732 System Restore.exe 2004 backup.exe 4388 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe System Restore.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\data.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\images\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe update.exe File opened for modification C:\Program Files\Microsoft Office\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\data.exe backup.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe backup.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\encapsulation\backup.exe System Restore.exe File opened for modification C:\Windows\appcompat\Programs\backup.exe System Restore.exe File opened for modification C:\Windows\apppatch\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\appcompat\System Restore.exe backup.exe File opened for modification C:\Windows\appcompat\appraiser\backup.exe System Restore.exe File opened for modification C:\Windows\appcompat\appraiser\Telemetry\data.exe backup.exe File opened for modification C:\Windows\AppReadiness\data.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 3532 backup.exe 3816 backup.exe 5016 backup.exe 3720 backup.exe 1908 backup.exe 4544 backup.exe 2636 backup.exe 676 backup.exe 1324 backup.exe 4340 backup.exe 4400 backup.exe 3824 backup.exe 4152 backup.exe 3868 backup.exe 4548 backup.exe 1888 backup.exe 4284 backup.exe 4360 backup.exe 736 backup.exe 4584 backup.exe 2208 backup.exe 1076 backup.exe 3840 backup.exe 3416 backup.exe 1400 backup.exe 2656 backup.exe 3920 backup.exe 2344 backup.exe 1852 backup.exe 4768 backup.exe 4676 backup.exe 4776 backup.exe 2956 backup.exe 2328 backup.exe 2836 backup.exe 1560 backup.exe 4460 backup.exe 64 backup.exe 4312 backup.exe 3460 backup.exe 4612 backup.exe 3936 backup.exe 4996 data.exe 4232 data.exe 1428 backup.exe 368 backup.exe 2180 backup.exe 2040 backup.exe 2608 backup.exe 1324 backup.exe 2780 backup.exe 3456 backup.exe 3212 backup.exe 1472 backup.exe 4152 backup.exe 1984 backup.exe 4316 backup.exe 3812 backup.exe 2928 backup.exe 4964 backup.exe 3732 System Restore.exe 2148 update.exe 4572 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 3532 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 83 PID 1836 wrote to memory of 3532 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 83 PID 1836 wrote to memory of 3532 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 83 PID 1836 wrote to memory of 3816 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 84 PID 1836 wrote to memory of 3816 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 84 PID 1836 wrote to memory of 3816 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 84 PID 1836 wrote to memory of 5016 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 85 PID 1836 wrote to memory of 5016 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 85 PID 1836 wrote to memory of 5016 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 85 PID 1836 wrote to memory of 3720 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 86 PID 1836 wrote to memory of 3720 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 86 PID 1836 wrote to memory of 3720 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 86 PID 1836 wrote to memory of 1908 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 87 PID 1836 wrote to memory of 1908 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 87 PID 1836 wrote to memory of 1908 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 87 PID 1836 wrote to memory of 4544 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 88 PID 1836 wrote to memory of 4544 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 88 PID 1836 wrote to memory of 4544 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 88 PID 1836 wrote to memory of 2636 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 89 PID 1836 wrote to memory of 2636 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 89 PID 1836 wrote to memory of 2636 1836 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe 89 PID 3532 wrote to memory of 676 3532 backup.exe 90 PID 3532 wrote to memory of 676 3532 backup.exe 90 PID 3532 wrote to memory of 676 3532 backup.exe 90 PID 676 wrote to memory of 1324 676 backup.exe 91 PID 676 wrote to memory of 1324 676 backup.exe 91 PID 676 wrote to memory of 1324 676 backup.exe 91 PID 676 wrote to memory of 4340 676 backup.exe 92 PID 676 wrote to memory of 4340 676 backup.exe 92 PID 676 wrote to memory of 4340 676 backup.exe 92 PID 676 wrote to memory of 4400 676 backup.exe 93 PID 676 wrote to memory of 4400 676 backup.exe 93 PID 676 wrote to memory of 4400 676 backup.exe 93 PID 4400 wrote to memory of 3824 4400 backup.exe 94 PID 4400 wrote to memory of 3824 4400 backup.exe 94 PID 4400 wrote to memory of 3824 4400 backup.exe 94 PID 3824 wrote to memory of 4152 3824 backup.exe 95 PID 3824 wrote to memory of 4152 3824 backup.exe 95 PID 3824 wrote to memory of 4152 3824 backup.exe 95 PID 4400 wrote to memory of 3868 4400 backup.exe 96 PID 4400 wrote to memory of 3868 4400 backup.exe 96 PID 4400 wrote to memory of 3868 4400 backup.exe 96 PID 3868 wrote to memory of 4548 3868 backup.exe 97 PID 3868 wrote to memory of 4548 3868 backup.exe 97 PID 3868 wrote to memory of 4548 3868 backup.exe 97 PID 3868 wrote to memory of 1888 3868 backup.exe 98 PID 3868 wrote to memory of 1888 3868 backup.exe 98 PID 3868 wrote to memory of 1888 3868 backup.exe 98 PID 1888 wrote to memory of 4284 1888 backup.exe 99 PID 1888 wrote to memory of 4284 1888 backup.exe 99 PID 1888 wrote to memory of 4284 1888 backup.exe 99 PID 1888 wrote to memory of 4360 1888 backup.exe 100 PID 1888 wrote to memory of 4360 1888 backup.exe 100 PID 1888 wrote to memory of 4360 1888 backup.exe 100 PID 4360 wrote to memory of 736 4360 backup.exe 101 PID 4360 wrote to memory of 736 4360 backup.exe 101 PID 4360 wrote to memory of 736 4360 backup.exe 101 PID 4360 wrote to memory of 4584 4360 backup.exe 102 PID 4360 wrote to memory of 4584 4360 backup.exe 102 PID 4360 wrote to memory of 4584 4360 backup.exe 102 PID 4360 wrote to memory of 1076 4360 backup.exe 103 PID 4360 wrote to memory of 1076 4360 backup.exe 103 PID 4360 wrote to memory of 1076 4360 backup.exe 103 PID 676 wrote to memory of 2208 676 backup.exe 104 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe"C:\Users\Admin\AppData\Local\Temp\425973d0590642fb38c65060e4a969f7a7e7c322c56fd5b7148fa7303c997e29.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3317006981\backup.exeC:\Users\Admin\AppData\Local\Temp\3317006981\backup.exe C:\Users\Admin\AppData\Local\Temp\3317006981\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3532 -
C:\backup.exe\backup.exe \3⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:676 -
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1324
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4340
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4400 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4152
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3868 -
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4548
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1888 -
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4284
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4360 -
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:736
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4584
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1076
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4776
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:64
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
PID:752
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:916
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Disables RegEdit via registry modification
PID:1120
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵PID:2648
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3840 -
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2328
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:368
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4316
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2172
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:4684
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4768 -
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3460
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4312
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2780
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4152
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1548 -
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵
- System policy modification
PID:2364
-
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:3624 -
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵PID:1304
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1400
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2656 -
C:\Program Files\Common Files\System\ado\data.exe"C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4232 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Disables RegEdit via registry modification
PID:4252
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:4484
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
PID:2956
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- System policy modification
PID:2508
-
-
C:\Program Files\Common Files\System\ado\ja-JP\data.exe"C:\Program Files\Common Files\System\ado\ja-JP\data.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵PID:4340
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3416 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3920 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3936 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3812 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:4572
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4100
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Disables RegEdit via registry modification
PID:536
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵PID:3196
-
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1852 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2180
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3212
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
PID:1200
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:520
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4336
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1428 -
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4964 -
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵
- System policy modification
PID:4584
-
-
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2336 -
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\8⤵PID:1224
-
-
-
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2208 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4676 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4996 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3456
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2004 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:3220 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- System policy modification
PID:4528
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:2736
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4460 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2608 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2148
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:4560 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:4580
-
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:2856 -
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:5104
-
-
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2344 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560 -
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:3836
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4716
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4632
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:2496
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2836 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4612
-
-
C:\Windows\appcompat\System Restore.exe"C:\Windows\appcompat\System Restore.exe" C:\Windows\appcompat\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3732 -
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- System policy modification
PID:4388 -
C:\Windows\appcompat\appraiser\Telemetry\data.exeC:\Windows\appcompat\appraiser\Telemetry\data.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4196
-
-
-
C:\Windows\appcompat\encapsulation\backup.exeC:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\6⤵
- System policy modification
PID:3216
-
-
C:\Windows\appcompat\Programs\backup.exeC:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:2852
-
-
-
C:\Windows\apppatch\backup.exeC:\Windows\apppatch\backup.exe C:\Windows\apppatch\5⤵PID:4056
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3816
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5016
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3720
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4544
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2636
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD50012bd1c83a071880edd262d26384d21
SHA1c1267ee3c7cce58b03d0c12bcdcdc2053266b587
SHA25670562fb9b84487259f9dbbfc22500cfd90e2308202f209907f1adab873c1a853
SHA512fc312cd6f92c5d4d15b8f7acd0f9a152ac579a76c9b5cd60170024734825ba2dc8bd46d512dc05583183f895024825859b66bc1a3e175f8eef4820940b62d438
-
Filesize
72KB
MD50012bd1c83a071880edd262d26384d21
SHA1c1267ee3c7cce58b03d0c12bcdcdc2053266b587
SHA25670562fb9b84487259f9dbbfc22500cfd90e2308202f209907f1adab873c1a853
SHA512fc312cd6f92c5d4d15b8f7acd0f9a152ac579a76c9b5cd60170024734825ba2dc8bd46d512dc05583183f895024825859b66bc1a3e175f8eef4820940b62d438
-
Filesize
72KB
MD55d459e561ab572050bf27a850877a352
SHA157ef51d9e94a8f2fe7bc4b7c5cf16cdf37ed118e
SHA2564b7dc20a1ab1406337137db1010e5609aedb5bee5ed5f8aabc51babca00d6532
SHA512cfc1c2cb282cab3ec556848034c2728768aa6dc8483058c5c33b2f728458c6e8b197790cae5df9da5790e2654fe5d5b3cffa14ac749d0ae9e95586b8a77e1368
-
Filesize
72KB
MD55d459e561ab572050bf27a850877a352
SHA157ef51d9e94a8f2fe7bc4b7c5cf16cdf37ed118e
SHA2564b7dc20a1ab1406337137db1010e5609aedb5bee5ed5f8aabc51babca00d6532
SHA512cfc1c2cb282cab3ec556848034c2728768aa6dc8483058c5c33b2f728458c6e8b197790cae5df9da5790e2654fe5d5b3cffa14ac749d0ae9e95586b8a77e1368
-
Filesize
72KB
MD5129fd78a9ffe007e24130987a22a61f3
SHA149e19b7040e9ad1b1a7ff76be9ee5f0ab362c81e
SHA2562cbd69da191fe42a49cbdd3d1dc9d042b8203be5f1cd2ba412ecfd89fd66e6e8
SHA512c8744a6079b336052da7059e7c9ea0e59d95f48269e3ccaab83991b96bae23fbc2d5946475655cc78beb771ea2abd2b47f36c6dba19e85014c791c25bfb29b94
-
Filesize
72KB
MD5129fd78a9ffe007e24130987a22a61f3
SHA149e19b7040e9ad1b1a7ff76be9ee5f0ab362c81e
SHA2562cbd69da191fe42a49cbdd3d1dc9d042b8203be5f1cd2ba412ecfd89fd66e6e8
SHA512c8744a6079b336052da7059e7c9ea0e59d95f48269e3ccaab83991b96bae23fbc2d5946475655cc78beb771ea2abd2b47f36c6dba19e85014c791c25bfb29b94
-
Filesize
72KB
MD59c301e3e22ad7acf090e59fffd510d59
SHA16f67f34d9b4d23d6d86ab430b9f87742c023cb20
SHA256b34a895010af5ed198131039ea1c13aba324471c17fb406caeb0bb21b00a3d96
SHA51230802c5b53f51bf3833e561c732c325c4dfd336428855f746aa2c14826b4e0a33d7ead6eb48d9f7fbe2f483718fd6ec6052d948f4c06b8a6af2ab2bcc512c54d
-
Filesize
72KB
MD59c301e3e22ad7acf090e59fffd510d59
SHA16f67f34d9b4d23d6d86ab430b9f87742c023cb20
SHA256b34a895010af5ed198131039ea1c13aba324471c17fb406caeb0bb21b00a3d96
SHA51230802c5b53f51bf3833e561c732c325c4dfd336428855f746aa2c14826b4e0a33d7ead6eb48d9f7fbe2f483718fd6ec6052d948f4c06b8a6af2ab2bcc512c54d
-
Filesize
72KB
MD579727b97c28d67e8e66bc226025e2372
SHA1eaa05fb89ab2fde14e88932e79470a48f90b997e
SHA25681fb33d8c9ec5db7b7fd421724792fbae84254761148f17aa891276fcc3ea420
SHA5121ec2e09d4d3cd2301b53662e91a25db2e087bdd445ce93fb4fb4ef76eb3933828944858e1ed9e562c3a10e976273ed696df8fbf457233c9291cef12036f38a0e
-
Filesize
72KB
MD579727b97c28d67e8e66bc226025e2372
SHA1eaa05fb89ab2fde14e88932e79470a48f90b997e
SHA25681fb33d8c9ec5db7b7fd421724792fbae84254761148f17aa891276fcc3ea420
SHA5121ec2e09d4d3cd2301b53662e91a25db2e087bdd445ce93fb4fb4ef76eb3933828944858e1ed9e562c3a10e976273ed696df8fbf457233c9291cef12036f38a0e
-
Filesize
72KB
MD5f565bde9c3992ae599267eb0e1f6ea81
SHA1834ccb9bc63d30ef2a344b9b10ea1e2ce08ad3bd
SHA25613127f653b1b50b91b1ef6554ac527c7c7b4c9807856badc2836c1dc4d7a8852
SHA512d6407f96352274cc6e11e171220ac4a4521ff9403118770e4795a3eb3e28f87d7341516939a4c2e854e97198b0e1fb591280119c7f64de59f4bf6515482aec97
-
Filesize
72KB
MD5f565bde9c3992ae599267eb0e1f6ea81
SHA1834ccb9bc63d30ef2a344b9b10ea1e2ce08ad3bd
SHA25613127f653b1b50b91b1ef6554ac527c7c7b4c9807856badc2836c1dc4d7a8852
SHA512d6407f96352274cc6e11e171220ac4a4521ff9403118770e4795a3eb3e28f87d7341516939a4c2e854e97198b0e1fb591280119c7f64de59f4bf6515482aec97
-
Filesize
72KB
MD5fd972c9b8a3682efb46f7dd64b4d64ed
SHA1c5de79a60d863663d2b0d2b3fddf5034d756dcf8
SHA25697d578b94530caf04acea469d7b34a280fdd5cd758c5ce1a78ebc4f0f44d14c1
SHA5125563914a2cf808a796bba042378cfc7a5f1007c0266ea95d2c681fb5968fbb56301922ce6908f04c532f01c8ff0f14742dbaf20d1eec3bde5dde79ce33d260a1
-
Filesize
72KB
MD5fd972c9b8a3682efb46f7dd64b4d64ed
SHA1c5de79a60d863663d2b0d2b3fddf5034d756dcf8
SHA25697d578b94530caf04acea469d7b34a280fdd5cd758c5ce1a78ebc4f0f44d14c1
SHA5125563914a2cf808a796bba042378cfc7a5f1007c0266ea95d2c681fb5968fbb56301922ce6908f04c532f01c8ff0f14742dbaf20d1eec3bde5dde79ce33d260a1
-
Filesize
72KB
MD558e4aaa98a4485426d502ff4f8382fb9
SHA1424b337ed99ccbfbbffe35a4eb23c42916955c85
SHA2566fb6f37f205d93cf65390b55479d0d9640d145af8d3cae85e1bd030a74341d46
SHA512b85b825693bb4d6651dac418b0c47f6d0ed2730f3239172224f6be69f8add87e7fed5366ed5667705f7be4a25417e4a0194553321815d4383baee36cce415b4d
-
Filesize
72KB
MD558e4aaa98a4485426d502ff4f8382fb9
SHA1424b337ed99ccbfbbffe35a4eb23c42916955c85
SHA2566fb6f37f205d93cf65390b55479d0d9640d145af8d3cae85e1bd030a74341d46
SHA512b85b825693bb4d6651dac418b0c47f6d0ed2730f3239172224f6be69f8add87e7fed5366ed5667705f7be4a25417e4a0194553321815d4383baee36cce415b4d
-
Filesize
72KB
MD56d34766215596f9afe1ec08408370970
SHA1d31219e0f3d0c5722095ee7aedcdd2aaea5c6530
SHA256448ca2031a34d2902c6a1e08636a49bc1e75589fa90c3ffc6e7c18e46944ed88
SHA512a641e7acf7714bcce2032d2fd0540591785fcf12393ca847b08bb92be62d16c131b55f4dbb292cb8438e9c13da1337a9053f9ab11df41dd1be62374fda9fb658
-
Filesize
72KB
MD56d34766215596f9afe1ec08408370970
SHA1d31219e0f3d0c5722095ee7aedcdd2aaea5c6530
SHA256448ca2031a34d2902c6a1e08636a49bc1e75589fa90c3ffc6e7c18e46944ed88
SHA512a641e7acf7714bcce2032d2fd0540591785fcf12393ca847b08bb92be62d16c131b55f4dbb292cb8438e9c13da1337a9053f9ab11df41dd1be62374fda9fb658
-
Filesize
72KB
MD53466edca5bfafb8f22b8b813de618607
SHA1d115e650112a1a10fc4ee19465c96b175df134f7
SHA256ba03711af431a0c6cc0a9570bf46813f0de60da0a71571a99564858ebc861cab
SHA512efad0d5d3cb0ecc982a9301ebf6d9912479a4b8e30332001df727014759af8a817bfeb660b828baa9b1b390f65b95a81242f98fdfdc48b15207323101959568d
-
Filesize
72KB
MD53466edca5bfafb8f22b8b813de618607
SHA1d115e650112a1a10fc4ee19465c96b175df134f7
SHA256ba03711af431a0c6cc0a9570bf46813f0de60da0a71571a99564858ebc861cab
SHA512efad0d5d3cb0ecc982a9301ebf6d9912479a4b8e30332001df727014759af8a817bfeb660b828baa9b1b390f65b95a81242f98fdfdc48b15207323101959568d
-
Filesize
72KB
MD5339fc940d6a9f2b17a0436bfe66e5cb6
SHA1e49ac57f4f4b20c4b9eeacc3ab221d80bf40b7c0
SHA256b3dea8323050bb25b51b4536c132f34d4a96d7653f378fd50ea0e699d63657dd
SHA5122cb1a011985f5fa23d21fab3ce380b0b1acec0808dd9c66442a5702a467bd32302ab70263c28d699882c7ff822b88271ac53b9b172dccfe7aa7e27fe54333036
-
Filesize
72KB
MD5339fc940d6a9f2b17a0436bfe66e5cb6
SHA1e49ac57f4f4b20c4b9eeacc3ab221d80bf40b7c0
SHA256b3dea8323050bb25b51b4536c132f34d4a96d7653f378fd50ea0e699d63657dd
SHA5122cb1a011985f5fa23d21fab3ce380b0b1acec0808dd9c66442a5702a467bd32302ab70263c28d699882c7ff822b88271ac53b9b172dccfe7aa7e27fe54333036
-
Filesize
72KB
MD5b89a5a7ce35db564d9d2619e263d16bf
SHA138b7f88c7e8dad4397a2b0fbd22d699076b01145
SHA25630635e9971cdcf9214657a96fbc96fa941c5f5932e8c62388a9d0f273ceace96
SHA512ca2774293e6a6e5bad7cf20ca28db4b9560b99b2c8fe33a199463e69c809c92de042ebdd595e710dd35b81ceff4d294dd3e3475b80c0aae579efbc203afd18f1
-
Filesize
72KB
MD5b89a5a7ce35db564d9d2619e263d16bf
SHA138b7f88c7e8dad4397a2b0fbd22d699076b01145
SHA25630635e9971cdcf9214657a96fbc96fa941c5f5932e8c62388a9d0f273ceace96
SHA512ca2774293e6a6e5bad7cf20ca28db4b9560b99b2c8fe33a199463e69c809c92de042ebdd595e710dd35b81ceff4d294dd3e3475b80c0aae579efbc203afd18f1
-
Filesize
72KB
MD5683159773370098f38541284f7ba2d86
SHA13928f9f59e46b2f924b91b7156ea34f0fe4d9128
SHA256c09ea706a296839d863368419c47f123153a098ea04a8495c1e0a668bd1588df
SHA5122d44402da2d1eb136d02e20342029595f93da60573bab1f7c19a44360a7122e3315d2b1762ab0b0f9c25aa964db9d8aef67cfa26cb78dca1e2858de7868d3d77
-
Filesize
72KB
MD5683159773370098f38541284f7ba2d86
SHA13928f9f59e46b2f924b91b7156ea34f0fe4d9128
SHA256c09ea706a296839d863368419c47f123153a098ea04a8495c1e0a668bd1588df
SHA5122d44402da2d1eb136d02e20342029595f93da60573bab1f7c19a44360a7122e3315d2b1762ab0b0f9c25aa964db9d8aef67cfa26cb78dca1e2858de7868d3d77
-
Filesize
72KB
MD517f2e40dd9984e52d63f7719ff04da1e
SHA1145ad216b85014aeabffa0d969889b538f221ee1
SHA25668004b346113f8b2348f416be91ac180b0c0f9119cdc8a32c7887de4c2e74c54
SHA512cd1f3785d7760b1d1105585b3fa36e39fd958e85b82b878b203b96846346473baf4fa9f66a817c5d1ed4291a00916e61f50f9916377f14e59ce7194c8a3cfeb9
-
Filesize
72KB
MD517f2e40dd9984e52d63f7719ff04da1e
SHA1145ad216b85014aeabffa0d969889b538f221ee1
SHA25668004b346113f8b2348f416be91ac180b0c0f9119cdc8a32c7887de4c2e74c54
SHA512cd1f3785d7760b1d1105585b3fa36e39fd958e85b82b878b203b96846346473baf4fa9f66a817c5d1ed4291a00916e61f50f9916377f14e59ce7194c8a3cfeb9
-
Filesize
72KB
MD59ca11224147189142a6188cc9a339249
SHA1acdf92a8743be3880db697ce87763e6891825de6
SHA256b63b85542b0bf6605f1b371b50b939f6bf3908e47ae5c413fe1a75daf8d2c962
SHA5126de61b9a2209ed08d063d8933e76edba9f22a092cee55aac6f0bd6f0699e3247ac9d9a6cd47a1893887bde8127315d695849b4353084a16c9c02661338e0ec86
-
Filesize
72KB
MD59ca11224147189142a6188cc9a339249
SHA1acdf92a8743be3880db697ce87763e6891825de6
SHA256b63b85542b0bf6605f1b371b50b939f6bf3908e47ae5c413fe1a75daf8d2c962
SHA5126de61b9a2209ed08d063d8933e76edba9f22a092cee55aac6f0bd6f0699e3247ac9d9a6cd47a1893887bde8127315d695849b4353084a16c9c02661338e0ec86
-
Filesize
72KB
MD53466edca5bfafb8f22b8b813de618607
SHA1d115e650112a1a10fc4ee19465c96b175df134f7
SHA256ba03711af431a0c6cc0a9570bf46813f0de60da0a71571a99564858ebc861cab
SHA512efad0d5d3cb0ecc982a9301ebf6d9912479a4b8e30332001df727014759af8a817bfeb660b828baa9b1b390f65b95a81242f98fdfdc48b15207323101959568d
-
Filesize
72KB
MD53466edca5bfafb8f22b8b813de618607
SHA1d115e650112a1a10fc4ee19465c96b175df134f7
SHA256ba03711af431a0c6cc0a9570bf46813f0de60da0a71571a99564858ebc861cab
SHA512efad0d5d3cb0ecc982a9301ebf6d9912479a4b8e30332001df727014759af8a817bfeb660b828baa9b1b390f65b95a81242f98fdfdc48b15207323101959568d
-
Filesize
72KB
MD59ca11224147189142a6188cc9a339249
SHA1acdf92a8743be3880db697ce87763e6891825de6
SHA256b63b85542b0bf6605f1b371b50b939f6bf3908e47ae5c413fe1a75daf8d2c962
SHA5126de61b9a2209ed08d063d8933e76edba9f22a092cee55aac6f0bd6f0699e3247ac9d9a6cd47a1893887bde8127315d695849b4353084a16c9c02661338e0ec86
-
Filesize
72KB
MD59ca11224147189142a6188cc9a339249
SHA1acdf92a8743be3880db697ce87763e6891825de6
SHA256b63b85542b0bf6605f1b371b50b939f6bf3908e47ae5c413fe1a75daf8d2c962
SHA5126de61b9a2209ed08d063d8933e76edba9f22a092cee55aac6f0bd6f0699e3247ac9d9a6cd47a1893887bde8127315d695849b4353084a16c9c02661338e0ec86
-
Filesize
72KB
MD500042aca26f66db5b474634c3e10d55a
SHA1cca9d47830dacc435380edfce858ae1f27d7360e
SHA256551b8ec41f0c1b9478d5acc824d40e6109e01b538d9d1ef0c44e25447d3016f4
SHA5123bbcf536e8568e4e1e048c1f9463ec7945d1fa8222fdd9202ac2a06de5092a17426384c73949f90e4392d7e73398496235649965ec50e5e87eb53de93352a65e
-
Filesize
72KB
MD500042aca26f66db5b474634c3e10d55a
SHA1cca9d47830dacc435380edfce858ae1f27d7360e
SHA256551b8ec41f0c1b9478d5acc824d40e6109e01b538d9d1ef0c44e25447d3016f4
SHA5123bbcf536e8568e4e1e048c1f9463ec7945d1fa8222fdd9202ac2a06de5092a17426384c73949f90e4392d7e73398496235649965ec50e5e87eb53de93352a65e
-
Filesize
72KB
MD561c0c3968964e43f758e68203e16f63d
SHA12ae4fe8367c5d32d3d9a187e72d0bc005cd6fcfe
SHA25610173fa13f7c86437e8d87d2e9a8b4059e36e0d3af11e2016cd6ea89b895f36d
SHA512699f85e742f8dcde62c66f1ad46d973e4684a08d72b3ef72b795670cdfa5516e8dc846f1f28af72d69f8e2b9db35439613ba73230fcd6921df01160df7715712
-
Filesize
72KB
MD561c0c3968964e43f758e68203e16f63d
SHA12ae4fe8367c5d32d3d9a187e72d0bc005cd6fcfe
SHA25610173fa13f7c86437e8d87d2e9a8b4059e36e0d3af11e2016cd6ea89b895f36d
SHA512699f85e742f8dcde62c66f1ad46d973e4684a08d72b3ef72b795670cdfa5516e8dc846f1f28af72d69f8e2b9db35439613ba73230fcd6921df01160df7715712
-
Filesize
72KB
MD50d01821dffb75e539c7bb304bdbcf53c
SHA14a387625dad661a54987945dff7c237cdfd58704
SHA256f05208c4d4d7a984d10bf9bed07b61eed834ad4b7ab60bcfcfbd3e593e99c511
SHA5120503ebf6b275efb8775e4ccd7abaff5e1c95303e8979c4aed01f09ea5cffd4fa72c6d5466f7fd5be79e8cd2d4a53fe5dc572724318f5d1c0230c0aa6d52dd7d1
-
Filesize
72KB
MD50d01821dffb75e539c7bb304bdbcf53c
SHA14a387625dad661a54987945dff7c237cdfd58704
SHA256f05208c4d4d7a984d10bf9bed07b61eed834ad4b7ab60bcfcfbd3e593e99c511
SHA5120503ebf6b275efb8775e4ccd7abaff5e1c95303e8979c4aed01f09ea5cffd4fa72c6d5466f7fd5be79e8cd2d4a53fe5dc572724318f5d1c0230c0aa6d52dd7d1
-
Filesize
72KB
MD5c4d22958d0f6d154eafed02132006a6e
SHA1350be34586b857ab3bae3214f20fe9453e35388c
SHA256c0a9c68d2e9a46ea387b2308ad1ffb2aaf182686c04ddae8b1d931311ac1da77
SHA5127af958ed371ac126444c0e205caebd2a356d2f56e0baa23d107d0410b6afa7ee0ef8e873cd70faeb4b8197a2bc81e4044ee204f29449da0d442d6eecde8f8476
-
Filesize
72KB
MD5c4d22958d0f6d154eafed02132006a6e
SHA1350be34586b857ab3bae3214f20fe9453e35388c
SHA256c0a9c68d2e9a46ea387b2308ad1ffb2aaf182686c04ddae8b1d931311ac1da77
SHA5127af958ed371ac126444c0e205caebd2a356d2f56e0baa23d107d0410b6afa7ee0ef8e873cd70faeb4b8197a2bc81e4044ee204f29449da0d442d6eecde8f8476
-
Filesize
72KB
MD5fc9685ef5629f513e91335784f5d9efa
SHA14c8b228e592e6839c33191ea007ae83e226abb14
SHA256ecbd3a509b22666e1ca5147de659c65ddfe0cf37e4821dc5f1eb351c1b3e4983
SHA512241dd061cc8c8ce8cb8fc5e39c1ec15f133d64dd58359c15e479c66a612359de03dc30cde2867472bb92f04a7517bb3d76a9b0ed9e9d5d2d243a635257c0f0ee
-
Filesize
72KB
MD5fc9685ef5629f513e91335784f5d9efa
SHA14c8b228e592e6839c33191ea007ae83e226abb14
SHA256ecbd3a509b22666e1ca5147de659c65ddfe0cf37e4821dc5f1eb351c1b3e4983
SHA512241dd061cc8c8ce8cb8fc5e39c1ec15f133d64dd58359c15e479c66a612359de03dc30cde2867472bb92f04a7517bb3d76a9b0ed9e9d5d2d243a635257c0f0ee
-
Filesize
72KB
MD523ddcc40684cb2571d63a4b0a55cc0c6
SHA1101873f1906f231609489886712f67532a48b1cc
SHA2566ff673a38af21ab6074dbb80db28ae9ae59e7973ca3608fc0821e52436ea4a91
SHA5120bd0c16bf1f599dee930f023bcdeb7ad770c46f507e47b82d14eb4fc32c940d4bc10fc17bdb6d175df71af8015b2f9dfbef24087d277b11b10187fe900ab70f2
-
Filesize
72KB
MD523ddcc40684cb2571d63a4b0a55cc0c6
SHA1101873f1906f231609489886712f67532a48b1cc
SHA2566ff673a38af21ab6074dbb80db28ae9ae59e7973ca3608fc0821e52436ea4a91
SHA5120bd0c16bf1f599dee930f023bcdeb7ad770c46f507e47b82d14eb4fc32c940d4bc10fc17bdb6d175df71af8015b2f9dfbef24087d277b11b10187fe900ab70f2
-
Filesize
72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
Filesize
72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
Filesize
72KB
MD55f0b1c709d1d4ffe05f5eec7d9ab42f5
SHA193a6b68d795a77e81779842637480385a1093633
SHA2567615c9e06071e54fc8a6854ad8b640f70424377e13a0ed8f278cfe8c487b24c5
SHA512ca1f67582cee5f874bda952013a7770238944a5c304b1669cb7399e0a7b334089ae09fe1aa1adba48a08d66a9fc4d981500df3b8ec6647a3eb2ef21a5ed0d67d
-
Filesize
72KB
MD55f0b1c709d1d4ffe05f5eec7d9ab42f5
SHA193a6b68d795a77e81779842637480385a1093633
SHA2567615c9e06071e54fc8a6854ad8b640f70424377e13a0ed8f278cfe8c487b24c5
SHA512ca1f67582cee5f874bda952013a7770238944a5c304b1669cb7399e0a7b334089ae09fe1aa1adba48a08d66a9fc4d981500df3b8ec6647a3eb2ef21a5ed0d67d
-
Filesize
72KB
MD55f0b1c709d1d4ffe05f5eec7d9ab42f5
SHA193a6b68d795a77e81779842637480385a1093633
SHA2567615c9e06071e54fc8a6854ad8b640f70424377e13a0ed8f278cfe8c487b24c5
SHA512ca1f67582cee5f874bda952013a7770238944a5c304b1669cb7399e0a7b334089ae09fe1aa1adba48a08d66a9fc4d981500df3b8ec6647a3eb2ef21a5ed0d67d
-
Filesize
72KB
MD55f0b1c709d1d4ffe05f5eec7d9ab42f5
SHA193a6b68d795a77e81779842637480385a1093633
SHA2567615c9e06071e54fc8a6854ad8b640f70424377e13a0ed8f278cfe8c487b24c5
SHA512ca1f67582cee5f874bda952013a7770238944a5c304b1669cb7399e0a7b334089ae09fe1aa1adba48a08d66a9fc4d981500df3b8ec6647a3eb2ef21a5ed0d67d
-
Filesize
72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
Filesize
72KB
MD5f3bb05a0a439e20b39c7be218f5e5383
SHA1226ddf1d8617304c558598863c4d56032cb98840
SHA2563c801db9bcaa0d18598e79d9811eaad9c2fbd9c429ac0607e6cab943a2a87c99
SHA512c68bcd1500750b6d978cd04a2b09c4ceb1962464d3183a49ea78827ed501b28e068ce0e27621b951d15f24fb3db62967e7528f453fe044c55b0233b638213b5f
-
Filesize
72KB
MD518b6058a3bec11f30693f5251d2aa198
SHA18a8d0670d026079414cc7e4738e20e7b3128a48b
SHA2565cab1125b472136d1c2b73485513d674a4de0636c6df93aaca63f6cc1842f2a8
SHA512dfae2a51cda95f9902ccf050d4707b4b9b1dc09c4db7423f0579e65e6edc2c799e09ac2018664d470e4e0b163aa0da2460889a91b9c04e8152b80df585e14102
-
Filesize
72KB
MD518b6058a3bec11f30693f5251d2aa198
SHA18a8d0670d026079414cc7e4738e20e7b3128a48b
SHA2565cab1125b472136d1c2b73485513d674a4de0636c6df93aaca63f6cc1842f2a8
SHA512dfae2a51cda95f9902ccf050d4707b4b9b1dc09c4db7423f0579e65e6edc2c799e09ac2018664d470e4e0b163aa0da2460889a91b9c04e8152b80df585e14102
-
Filesize
72KB
MD53632134bb489b227945871160b7e4d1f
SHA1a5f3599b5f3060614ea09de830402cf99765b452
SHA25691af7e7ec88dc04f61aa0c8e7978fa0577d10ca3d04795949bd3be1c2d7da39e
SHA5124a38ef7b3a84e182a85ab52712635cc33465c394d01c668420996ae3b3a5af9fcc8b1e5b9b4220e4eb2ec9fe03a0b89bdcc1dc40cefd0105b3d6fdc038742c4a
-
Filesize
72KB
MD53632134bb489b227945871160b7e4d1f
SHA1a5f3599b5f3060614ea09de830402cf99765b452
SHA25691af7e7ec88dc04f61aa0c8e7978fa0577d10ca3d04795949bd3be1c2d7da39e
SHA5124a38ef7b3a84e182a85ab52712635cc33465c394d01c668420996ae3b3a5af9fcc8b1e5b9b4220e4eb2ec9fe03a0b89bdcc1dc40cefd0105b3d6fdc038742c4a
-
Filesize
72KB
MD50cec02e81e740a3ddd5917048fce225a
SHA11f1774207a86e07e4a6c425b3f88c3817ce48557
SHA2569a16e800cb8cd8344bef142138456bda599edd9bfb18b797c019acc71b9805d0
SHA512cc3e7000391049a1bae55060cb46b1626c84eaa43ebfcdda72b98e3aaac09295dfcf54150e44e3c0eec11dc9ae9be3e7bbf40128835ad36ffbe453be23c154f2
-
Filesize
72KB
MD50cec02e81e740a3ddd5917048fce225a
SHA11f1774207a86e07e4a6c425b3f88c3817ce48557
SHA2569a16e800cb8cd8344bef142138456bda599edd9bfb18b797c019acc71b9805d0
SHA512cc3e7000391049a1bae55060cb46b1626c84eaa43ebfcdda72b98e3aaac09295dfcf54150e44e3c0eec11dc9ae9be3e7bbf40128835ad36ffbe453be23c154f2