Analysis
-
max time kernel
173s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11-10-2023 16:24
General
-
Target
NEAS.07f00d3cdf1719b3b12c6cc33de69ea0_JC.exe
-
Size
72KB
-
MD5
07f00d3cdf1719b3b12c6cc33de69ea0
-
SHA1
de6342c8a9347d985f26009a459c99a35a5d301a
-
SHA256
d174449b3ecc2bf75ad9aac6888549dadc76a0f8026d32cd660e410f1e2e1ce9
-
SHA512
17bc0d9d555a1364ec3574ecbfb91de845969d81622031e7d527551544ae3becbf90fc889c88a85388f64a7a7e0ca19719b4e124a65b62dc24972b69c9842dc9
-
SSDEEP
768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyv5:HeT7BVwxfvqguKRFA0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.07f00d3cdf1719b3b12c6cc33de69ea0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.07f00d3cdf1719b3b12c6cc33de69ea0_JC.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2626857801\backup.exeC:\Users\Admin\AppData\Local\Temp\2626857801\backup.exe C:\Users\Admin\AppData\Local\Temp\2626857801\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\Admin\data.exeC:\PerfLogs\Admin\data.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\en-US\System Restore.exe"C:\Program Files\Common Files\System\ado\en-US\System Restore.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\System\de-DE\update.exe"C:\Program Files\Common Files\System\de-DE\update.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- System policy modification
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\8⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\9⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\9⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\9⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\9⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\9⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\9⤵
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
-
-
C:\Program Files\Internet Explorer\fr-FR\update.exe"C:\Program Files\Internet Explorer\fr-FR\update.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
-
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
-
-
C:\Program Files\Java\jre7\data.exe"C:\Program Files\Java\jre7\data.exe" C:\Program Files\Java\jre7\6⤵
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
-
-
C:\Program Files\Microsoft Office\update.exe"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\5⤵
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵
-
-
-
C:\Program Files (x86)\update.exe"C:\Program Files (x86)\update.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- System policy modification
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Drops file in Program Files directory
- System policy modification
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵
-
-
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
-
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
-
-
C:\Program Files (x86)\Common Files\Services\System Restore.exe"C:\Program Files (x86)\Common Files\Services\System Restore.exe" C:\Program Files (x86)\Common Files\Services\6⤵
-
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵
-
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
-
C:\Users\Admin\Music\data.exeC:\Users\Admin\Music\data.exe C:\Users\Admin\Music\6⤵
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- System policy modification
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵
-
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
-
C:\Windows\addins\System Restore.exe"C:\Windows\addins\System Restore.exe" C:\Windows\addins\5⤵
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵
-
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵
-
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Low\update.exeC:\Users\Admin\AppData\Local\Temp\Low\update.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD512b9a98ad9bc8fcb4c9e50b6ce0821f0
SHA138638282fac91bf6f6035c97cca9baba29a6c557
SHA256408bddea0470b5ede22844cd18235d1157c430acf042e25113035252efa121db
SHA5126e155855eac29c16bba35d42921627d0fb33f70546ba9f3c974bbc6822b5cb6ae7e93b1333c3bedb474887b80e2381c3d342c415791c015d06e051bf76abd963
-
Filesize
72KB
MD59c6cd2d9cf5fb52cf370a9ed992608a8
SHA19de5b8d363399a3a130451a3a910abfc84aca6f7
SHA256ce0de3e7164851c4a3569089b86e8e64cd494b8dd4c9d08906bede074bdb9e7f
SHA512281eeeef51e019801a2fe9e6cddc9b184ac1197976213e56c62b0e6ca460a38ddea6112a4036325e3999bc13ae58edc5405aa0a61a71b5df8b6566d05a41f534
-
Filesize
72KB
MD59c6cd2d9cf5fb52cf370a9ed992608a8
SHA19de5b8d363399a3a130451a3a910abfc84aca6f7
SHA256ce0de3e7164851c4a3569089b86e8e64cd494b8dd4c9d08906bede074bdb9e7f
SHA512281eeeef51e019801a2fe9e6cddc9b184ac1197976213e56c62b0e6ca460a38ddea6112a4036325e3999bc13ae58edc5405aa0a61a71b5df8b6566d05a41f534
-
Filesize
72KB
MD5e6ad39e39f9ed84bec95350851db7cd8
SHA11bcbd5044c50b60e2fa113d8486f867f49da6005
SHA256a6731c17b4782e2b180658fa0b6ee32129951761b7692495b1eeead226089750
SHA5122859bbd7a0027b48a2d87111a35166cee44e34c54012fde2f069a599306bf9d675f4aaf968216cc88beaed424f853e951245ae9c7472a750068616f7cc5cf13e
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD5eba462654a3d3b8800d1c1bb88f5f345
SHA155b9d43e75f46e104d93710b8d7f220f61ee493b
SHA25691dc8eec9f932f17492e1befec9ba1060ad648e203eba16bf1f0d075d554f400
SHA512ffed4cf5c117411dd918f292024b4d626fc241197f8d9229c77723090b489f719f61c39df71577118cf726b0dadc7c9f9858b832de95156e5fb41703564e26f9
-
Filesize
72KB
MD5e6ad39e39f9ed84bec95350851db7cd8
SHA11bcbd5044c50b60e2fa113d8486f867f49da6005
SHA256a6731c17b4782e2b180658fa0b6ee32129951761b7692495b1eeead226089750
SHA5122859bbd7a0027b48a2d87111a35166cee44e34c54012fde2f069a599306bf9d675f4aaf968216cc88beaed424f853e951245ae9c7472a750068616f7cc5cf13e
-
Filesize
72KB
MD5e6ad39e39f9ed84bec95350851db7cd8
SHA11bcbd5044c50b60e2fa113d8486f867f49da6005
SHA256a6731c17b4782e2b180658fa0b6ee32129951761b7692495b1eeead226089750
SHA5122859bbd7a0027b48a2d87111a35166cee44e34c54012fde2f069a599306bf9d675f4aaf968216cc88beaed424f853e951245ae9c7472a750068616f7cc5cf13e
-
Filesize
72KB
MD55b29d7320ed08cfc30574894c926f442
SHA156c6d0fa3bbc33eeaad58e76ff90f572b87de302
SHA25603608739b1eaa9daaf3b9742398d9abbe95c099cd7c5c7fa7cbb9303ea325fac
SHA512696c9f069aeecd7824527cb83bf4dbb7af4d05e3848681fa48a579d4fc9361faa44da13bad967a3a0fa692053b8b5d9a32487d553fad75ae047618e10fa92d7f
-
Filesize
72KB
MD5eba462654a3d3b8800d1c1bb88f5f345
SHA155b9d43e75f46e104d93710b8d7f220f61ee493b
SHA25691dc8eec9f932f17492e1befec9ba1060ad648e203eba16bf1f0d075d554f400
SHA512ffed4cf5c117411dd918f292024b4d626fc241197f8d9229c77723090b489f719f61c39df71577118cf726b0dadc7c9f9858b832de95156e5fb41703564e26f9
-
Filesize
72KB
MD5eba462654a3d3b8800d1c1bb88f5f345
SHA155b9d43e75f46e104d93710b8d7f220f61ee493b
SHA25691dc8eec9f932f17492e1befec9ba1060ad648e203eba16bf1f0d075d554f400
SHA512ffed4cf5c117411dd918f292024b4d626fc241197f8d9229c77723090b489f719f61c39df71577118cf726b0dadc7c9f9858b832de95156e5fb41703564e26f9
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD53cf0e52d804a1066e99fbd2e765dc3d4
SHA16ce726760090d9ca132d3179b181b0b08ac0037d
SHA256cccf75d78d0bdbd4a9dd0216edf7c5fd8d5a19a363943dcd75cc2247397aa2e0
SHA5122db46a57d9cc83db9130b84c445b89ac4f8ba8b7bde532081c5f41166cfe9a463c05c751fba375457e10285190a3ce5bab2e595ed4d196302a340f2f461fc330
-
Filesize
72KB
MD53cf0e52d804a1066e99fbd2e765dc3d4
SHA16ce726760090d9ca132d3179b181b0b08ac0037d
SHA256cccf75d78d0bdbd4a9dd0216edf7c5fd8d5a19a363943dcd75cc2247397aa2e0
SHA5122db46a57d9cc83db9130b84c445b89ac4f8ba8b7bde532081c5f41166cfe9a463c05c751fba375457e10285190a3ce5bab2e595ed4d196302a340f2f461fc330
-
Filesize
72KB
MD555dc7c2505d04e76de46a2b2664a9932
SHA13d6f5893f81f9a69d931a120aa35f08bab959b02
SHA25624986796ee7609c87f0a86523f64174dba9836176e3268c2793c614902213d6f
SHA51262c8cc8607531d12523825d4f4de240472e8aa40ae4bc93c5fc67b815f5b183becf0dba813d6daaa005ab21a2e5477baaf694cc0dbac16d0d01ac9cf847d68a8
-
Filesize
72KB
MD555dc7c2505d04e76de46a2b2664a9932
SHA13d6f5893f81f9a69d931a120aa35f08bab959b02
SHA25624986796ee7609c87f0a86523f64174dba9836176e3268c2793c614902213d6f
SHA51262c8cc8607531d12523825d4f4de240472e8aa40ae4bc93c5fc67b815f5b183becf0dba813d6daaa005ab21a2e5477baaf694cc0dbac16d0d01ac9cf847d68a8
-
Filesize
72KB
MD555dc7c2505d04e76de46a2b2664a9932
SHA13d6f5893f81f9a69d931a120aa35f08bab959b02
SHA25624986796ee7609c87f0a86523f64174dba9836176e3268c2793c614902213d6f
SHA51262c8cc8607531d12523825d4f4de240472e8aa40ae4bc93c5fc67b815f5b183becf0dba813d6daaa005ab21a2e5477baaf694cc0dbac16d0d01ac9cf847d68a8
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD50bc35d185ad24ec1a9b543ac6704b17a
SHA1bd9c50b9e7c6c55589d885771226fce040132570
SHA25645687a710f5fc2f018ecb4cd420537ea2e379ba3048cd688615fbe268e2d46b3
SHA5125da0c5b4c9e8be3130712d320d8fa8be86ec245105df740d6bb7b835d38859221b9722b3737cb4641d89a9f40c16bc1debbdaa0b862368f3db21d402ad2a54ed
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD50bc35d185ad24ec1a9b543ac6704b17a
SHA1bd9c50b9e7c6c55589d885771226fce040132570
SHA25645687a710f5fc2f018ecb4cd420537ea2e379ba3048cd688615fbe268e2d46b3
SHA5125da0c5b4c9e8be3130712d320d8fa8be86ec245105df740d6bb7b835d38859221b9722b3737cb4641d89a9f40c16bc1debbdaa0b862368f3db21d402ad2a54ed
-
Filesize
21KB
MD54f4844c0109ea25c01edc9784d85c793
SHA1b19d33bef94a4d1cee3aa5bda7f2b97f9e2de089
SHA256843953d04b1254246b19d141a74379b2d2384a362044d2282f00c00655ef2c36
SHA51206375a3b20b57de09d8906bae36d70a9465c2a6c8ceadc1b69f93fae6bb926d0a4ed12f03c15fbed894d880164a95459c86f5260cbff638a1b8765aeea235147
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
72KB
MD52be33d63ba97cd2f8962c0153eb316d8
SHA163c1b034024ac328bb6d6a605d97c26dcf5abdb7
SHA256933790628e012fe052eacb38c29e0c3fa34b84395e5c944658bdf665c59eac1f
SHA512a933ab7f5f0e0ce12461617ab145a6091419e059bd45fd6ac6fb26eed88b382db3e67715be8720c2b71014279026c7bc13fa15cd0e87124529bfb5cc1ba0fa3d
-
Filesize
72KB
MD52be33d63ba97cd2f8962c0153eb316d8
SHA163c1b034024ac328bb6d6a605d97c26dcf5abdb7
SHA256933790628e012fe052eacb38c29e0c3fa34b84395e5c944658bdf665c59eac1f
SHA512a933ab7f5f0e0ce12461617ab145a6091419e059bd45fd6ac6fb26eed88b382db3e67715be8720c2b71014279026c7bc13fa15cd0e87124529bfb5cc1ba0fa3d
-
Filesize
72KB
MD512b9a98ad9bc8fcb4c9e50b6ce0821f0
SHA138638282fac91bf6f6035c97cca9baba29a6c557
SHA256408bddea0470b5ede22844cd18235d1157c430acf042e25113035252efa121db
SHA5126e155855eac29c16bba35d42921627d0fb33f70546ba9f3c974bbc6822b5cb6ae7e93b1333c3bedb474887b80e2381c3d342c415791c015d06e051bf76abd963
-
Filesize
72KB
MD512b9a98ad9bc8fcb4c9e50b6ce0821f0
SHA138638282fac91bf6f6035c97cca9baba29a6c557
SHA256408bddea0470b5ede22844cd18235d1157c430acf042e25113035252efa121db
SHA5126e155855eac29c16bba35d42921627d0fb33f70546ba9f3c974bbc6822b5cb6ae7e93b1333c3bedb474887b80e2381c3d342c415791c015d06e051bf76abd963
-
Filesize
72KB
MD59c6cd2d9cf5fb52cf370a9ed992608a8
SHA19de5b8d363399a3a130451a3a910abfc84aca6f7
SHA256ce0de3e7164851c4a3569089b86e8e64cd494b8dd4c9d08906bede074bdb9e7f
SHA512281eeeef51e019801a2fe9e6cddc9b184ac1197976213e56c62b0e6ca460a38ddea6112a4036325e3999bc13ae58edc5405aa0a61a71b5df8b6566d05a41f534
-
Filesize
72KB
MD59c6cd2d9cf5fb52cf370a9ed992608a8
SHA19de5b8d363399a3a130451a3a910abfc84aca6f7
SHA256ce0de3e7164851c4a3569089b86e8e64cd494b8dd4c9d08906bede074bdb9e7f
SHA512281eeeef51e019801a2fe9e6cddc9b184ac1197976213e56c62b0e6ca460a38ddea6112a4036325e3999bc13ae58edc5405aa0a61a71b5df8b6566d05a41f534
-
Filesize
72KB
MD5e6ad39e39f9ed84bec95350851db7cd8
SHA11bcbd5044c50b60e2fa113d8486f867f49da6005
SHA256a6731c17b4782e2b180658fa0b6ee32129951761b7692495b1eeead226089750
SHA5122859bbd7a0027b48a2d87111a35166cee44e34c54012fde2f069a599306bf9d675f4aaf968216cc88beaed424f853e951245ae9c7472a750068616f7cc5cf13e
-
Filesize
72KB
MD5e6ad39e39f9ed84bec95350851db7cd8
SHA11bcbd5044c50b60e2fa113d8486f867f49da6005
SHA256a6731c17b4782e2b180658fa0b6ee32129951761b7692495b1eeead226089750
SHA5122859bbd7a0027b48a2d87111a35166cee44e34c54012fde2f069a599306bf9d675f4aaf968216cc88beaed424f853e951245ae9c7472a750068616f7cc5cf13e
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD5eba462654a3d3b8800d1c1bb88f5f345
SHA155b9d43e75f46e104d93710b8d7f220f61ee493b
SHA25691dc8eec9f932f17492e1befec9ba1060ad648e203eba16bf1f0d075d554f400
SHA512ffed4cf5c117411dd918f292024b4d626fc241197f8d9229c77723090b489f719f61c39df71577118cf726b0dadc7c9f9858b832de95156e5fb41703564e26f9
-
Filesize
72KB
MD5eba462654a3d3b8800d1c1bb88f5f345
SHA155b9d43e75f46e104d93710b8d7f220f61ee493b
SHA25691dc8eec9f932f17492e1befec9ba1060ad648e203eba16bf1f0d075d554f400
SHA512ffed4cf5c117411dd918f292024b4d626fc241197f8d9229c77723090b489f719f61c39df71577118cf726b0dadc7c9f9858b832de95156e5fb41703564e26f9
-
Filesize
72KB
MD5e6ad39e39f9ed84bec95350851db7cd8
SHA11bcbd5044c50b60e2fa113d8486f867f49da6005
SHA256a6731c17b4782e2b180658fa0b6ee32129951761b7692495b1eeead226089750
SHA5122859bbd7a0027b48a2d87111a35166cee44e34c54012fde2f069a599306bf9d675f4aaf968216cc88beaed424f853e951245ae9c7472a750068616f7cc5cf13e
-
Filesize
72KB
MD5e6ad39e39f9ed84bec95350851db7cd8
SHA11bcbd5044c50b60e2fa113d8486f867f49da6005
SHA256a6731c17b4782e2b180658fa0b6ee32129951761b7692495b1eeead226089750
SHA5122859bbd7a0027b48a2d87111a35166cee44e34c54012fde2f069a599306bf9d675f4aaf968216cc88beaed424f853e951245ae9c7472a750068616f7cc5cf13e
-
Filesize
72KB
MD55b29d7320ed08cfc30574894c926f442
SHA156c6d0fa3bbc33eeaad58e76ff90f572b87de302
SHA25603608739b1eaa9daaf3b9742398d9abbe95c099cd7c5c7fa7cbb9303ea325fac
SHA512696c9f069aeecd7824527cb83bf4dbb7af4d05e3848681fa48a579d4fc9361faa44da13bad967a3a0fa692053b8b5d9a32487d553fad75ae047618e10fa92d7f
-
Filesize
72KB
MD55b29d7320ed08cfc30574894c926f442
SHA156c6d0fa3bbc33eeaad58e76ff90f572b87de302
SHA25603608739b1eaa9daaf3b9742398d9abbe95c099cd7c5c7fa7cbb9303ea325fac
SHA512696c9f069aeecd7824527cb83bf4dbb7af4d05e3848681fa48a579d4fc9361faa44da13bad967a3a0fa692053b8b5d9a32487d553fad75ae047618e10fa92d7f
-
Filesize
72KB
MD5eba462654a3d3b8800d1c1bb88f5f345
SHA155b9d43e75f46e104d93710b8d7f220f61ee493b
SHA25691dc8eec9f932f17492e1befec9ba1060ad648e203eba16bf1f0d075d554f400
SHA512ffed4cf5c117411dd918f292024b4d626fc241197f8d9229c77723090b489f719f61c39df71577118cf726b0dadc7c9f9858b832de95156e5fb41703564e26f9
-
Filesize
72KB
MD5eba462654a3d3b8800d1c1bb88f5f345
SHA155b9d43e75f46e104d93710b8d7f220f61ee493b
SHA25691dc8eec9f932f17492e1befec9ba1060ad648e203eba16bf1f0d075d554f400
SHA512ffed4cf5c117411dd918f292024b4d626fc241197f8d9229c77723090b489f719f61c39df71577118cf726b0dadc7c9f9858b832de95156e5fb41703564e26f9
-
Filesize
72KB
MD55b29d7320ed08cfc30574894c926f442
SHA156c6d0fa3bbc33eeaad58e76ff90f572b87de302
SHA25603608739b1eaa9daaf3b9742398d9abbe95c099cd7c5c7fa7cbb9303ea325fac
SHA512696c9f069aeecd7824527cb83bf4dbb7af4d05e3848681fa48a579d4fc9361faa44da13bad967a3a0fa692053b8b5d9a32487d553fad75ae047618e10fa92d7f
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD55cfd808c2eb3ec57639c70e49fe754a7
SHA132d292c69b4f6b5015c87d5121a454843fbd4a90
SHA2565bb2175c0b320730dfa9f96e8452b1548a25d8623de5902245c136404e55f4c5
SHA512a80090d52890c8f95d9e4cf202802371376862664068158f7729c8dcce3d6967ac2e537be9c5b205b2e3038480a6ce3afdf4519984108086db11a5f31e8b3cbd
-
Filesize
72KB
MD53cf0e52d804a1066e99fbd2e765dc3d4
SHA16ce726760090d9ca132d3179b181b0b08ac0037d
SHA256cccf75d78d0bdbd4a9dd0216edf7c5fd8d5a19a363943dcd75cc2247397aa2e0
SHA5122db46a57d9cc83db9130b84c445b89ac4f8ba8b7bde532081c5f41166cfe9a463c05c751fba375457e10285190a3ce5bab2e595ed4d196302a340f2f461fc330
-
Filesize
72KB
MD53cf0e52d804a1066e99fbd2e765dc3d4
SHA16ce726760090d9ca132d3179b181b0b08ac0037d
SHA256cccf75d78d0bdbd4a9dd0216edf7c5fd8d5a19a363943dcd75cc2247397aa2e0
SHA5122db46a57d9cc83db9130b84c445b89ac4f8ba8b7bde532081c5f41166cfe9a463c05c751fba375457e10285190a3ce5bab2e595ed4d196302a340f2f461fc330
-
Filesize
72KB
MD555dc7c2505d04e76de46a2b2664a9932
SHA13d6f5893f81f9a69d931a120aa35f08bab959b02
SHA25624986796ee7609c87f0a86523f64174dba9836176e3268c2793c614902213d6f
SHA51262c8cc8607531d12523825d4f4de240472e8aa40ae4bc93c5fc67b815f5b183becf0dba813d6daaa005ab21a2e5477baaf694cc0dbac16d0d01ac9cf847d68a8
-
Filesize
72KB
MD555dc7c2505d04e76de46a2b2664a9932
SHA13d6f5893f81f9a69d931a120aa35f08bab959b02
SHA25624986796ee7609c87f0a86523f64174dba9836176e3268c2793c614902213d6f
SHA51262c8cc8607531d12523825d4f4de240472e8aa40ae4bc93c5fc67b815f5b183becf0dba813d6daaa005ab21a2e5477baaf694cc0dbac16d0d01ac9cf847d68a8
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD50bc35d185ad24ec1a9b543ac6704b17a
SHA1bd9c50b9e7c6c55589d885771226fce040132570
SHA25645687a710f5fc2f018ecb4cd420537ea2e379ba3048cd688615fbe268e2d46b3
SHA5125da0c5b4c9e8be3130712d320d8fa8be86ec245105df740d6bb7b835d38859221b9722b3737cb4641d89a9f40c16bc1debbdaa0b862368f3db21d402ad2a54ed
-
Filesize
72KB
MD50bc35d185ad24ec1a9b543ac6704b17a
SHA1bd9c50b9e7c6c55589d885771226fce040132570
SHA25645687a710f5fc2f018ecb4cd420537ea2e379ba3048cd688615fbe268e2d46b3
SHA5125da0c5b4c9e8be3130712d320d8fa8be86ec245105df740d6bb7b835d38859221b9722b3737cb4641d89a9f40c16bc1debbdaa0b862368f3db21d402ad2a54ed
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD5ce621ba16ba03e4c246a678a309ca141
SHA1d12da35ada2c28409419d093f9907be66ce7455b
SHA2560d77dde4d6c074df583b02b3f5b19675213b1fc00d37ad5a6cbfa694837a4a18
SHA5124c9986cdec9b279b2de97c93a405e75555b7f574747ba39d049f1d31b1c00ec54502f17112f2636cd0417fc41e583735dcaedaed87717debbd47092006225dc6
-
Filesize
72KB
MD50bc35d185ad24ec1a9b543ac6704b17a
SHA1bd9c50b9e7c6c55589d885771226fce040132570
SHA25645687a710f5fc2f018ecb4cd420537ea2e379ba3048cd688615fbe268e2d46b3
SHA5125da0c5b4c9e8be3130712d320d8fa8be86ec245105df740d6bb7b835d38859221b9722b3737cb4641d89a9f40c16bc1debbdaa0b862368f3db21d402ad2a54ed
-
Filesize
72KB
MD50bc35d185ad24ec1a9b543ac6704b17a
SHA1bd9c50b9e7c6c55589d885771226fce040132570
SHA25645687a710f5fc2f018ecb4cd420537ea2e379ba3048cd688615fbe268e2d46b3
SHA5125da0c5b4c9e8be3130712d320d8fa8be86ec245105df740d6bb7b835d38859221b9722b3737cb4641d89a9f40c16bc1debbdaa0b862368f3db21d402ad2a54ed
-
Filesize
4KB