Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 02:40
Behavioral task
behavioral1
Sample
NEAS.77633383823b8b0d5af0297c96ffd680.exe
Resource
win7-20231020-en
General
-
Target
NEAS.77633383823b8b0d5af0297c96ffd680.exe
-
Size
176KB
-
MD5
77633383823b8b0d5af0297c96ffd680
-
SHA1
6a62e4b8e040e702f310c2096c6175654488c1c1
-
SHA256
2d4770d305c429b4fb3a870f6521d5e2a4aaca3deb57df2b03f709f1dacd943d
-
SHA512
b725dd6c3a04d360283c11adcc42bc60a2846d65c3733f7daf92d2b569c1bcd9b60cd767ff37843f4c4e82ecaeee00aff1bd0c8d62f0894caa89f7516e1a85c7
-
SSDEEP
768:Ac/TbblFpQNwC3BEc4QEfu0Ei8XxNDI/vFaaz6JZ1Ssw63BEf7:x7bbl/eThavEjDUvFaaAXZL07
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 2912 backup.exe 2412 backup.exe 2752 backup.exe 2348 backup.exe 3028 backup.exe 2536 backup.exe 3008 backup.exe 2528 backup.exe 2888 backup.exe 612 backup.exe 1628 backup.exe 580 backup.exe 1408 backup.exe 1752 backup.exe 564 backup.exe 2324 backup.exe 1768 backup.exe 308 backup.exe 680 backup.exe 732 backup.exe 816 backup.exe 2952 backup.exe 1592 backup.exe 3048 backup.exe 2132 backup.exe 1612 backup.exe 2104 backup.exe 2688 backup.exe 2664 backup.exe 2844 backup.exe 2720 backup.exe 2652 backup.exe 1736 backup.exe 2292 System Restore.exe 3008 backup.exe 2640 backup.exe 2864 backup.exe 1552 backup.exe 3064 backup.exe 1944 backup.exe 320 update.exe 1480 backup.exe 1896 backup.exe 1524 backup.exe 2272 backup.exe 2044 backup.exe 2636 backup.exe 2284 data.exe 2232 backup.exe 1816 backup.exe 804 backup.exe 1544 backup.exe 364 backup.exe 1808 backup.exe 2852 backup.exe 1620 backup.exe 884 data.exe 736 backup.exe 3044 backup.exe 2060 backup.exe 868 backup.exe 2968 backup.exe 2512 backup.exe 1608 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2528 backup.exe 2528 backup.exe 2888 backup.exe 2888 backup.exe 2528 backup.exe 2528 backup.exe 1628 backup.exe 1628 backup.exe 580 backup.exe 580 backup.exe 1628 backup.exe 1628 backup.exe 1752 backup.exe 1752 backup.exe 564 backup.exe 564 backup.exe 564 backup.exe 564 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 1768 backup.exe 2664 backup.exe 2664 backup.exe 2664 backup.exe 2664 backup.exe 2664 backup.exe 2664 backup.exe 2664 backup.exe 2664 backup.exe -
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0031000000015c8f-5.dat upx behavioral1/files/0x0031000000015c8f-7.dat upx behavioral1/files/0x0031000000015c8f-9.dat upx behavioral1/files/0x0031000000015c8f-11.dat upx behavioral1/files/0x0007000000015deb-15.dat upx behavioral1/memory/2412-23-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0007000000015deb-22.dat upx behavioral1/files/0x0007000000015deb-17.dat upx behavioral1/memory/2412-27-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x000a000000015ecd-34.dat upx behavioral1/files/0x000a000000015ecd-30.dat upx behavioral1/files/0x000a000000015ecd-28.dat upx behavioral1/files/0x0008000000015e3e-39.dat upx behavioral1/memory/2916-45-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0008000000015e3e-46.dat upx behavioral1/files/0x0008000000015e3e-41.dat upx behavioral1/memory/2348-50-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016455-51.dat upx behavioral1/files/0x0006000000016455-53.dat upx behavioral1/memory/2912-57-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016455-58.dat upx behavioral1/memory/3028-62-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x000600000001658b-63.dat upx behavioral1/files/0x000600000001658b-69.dat upx behavioral1/files/0x000600000001658b-65.dat upx behavioral1/memory/2536-75-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x000c00000001626b-76.dat upx behavioral1/files/0x000c00000001626b-81.dat upx behavioral1/memory/2752-80-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x000c00000001626b-73.dat upx behavioral1/memory/2916-84-0x0000000002A00000-0x0000000002A2C000-memory.dmp upx behavioral1/memory/3008-86-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0031000000015c8f-89.dat upx behavioral1/files/0x00060000000165f8-96.dat upx behavioral1/files/0x00060000000165f8-100.dat upx behavioral1/files/0x0006000000016ad4-102.dat upx behavioral1/files/0x0006000000016ad4-104.dat upx behavioral1/files/0x0006000000016ad4-108.dat upx behavioral1/files/0x0006000000016ad4-111.dat upx behavioral1/files/0x0006000000016c25-115.dat upx behavioral1/files/0x0006000000016c25-119.dat upx behavioral1/files/0x0006000000016c25-113.dat upx behavioral1/files/0x0007000000016c2b-130.dat upx behavioral1/files/0x0007000000016c2b-134.dat upx behavioral1/files/0x0007000000016c2b-128.dat upx behavioral1/memory/2888-127-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/612-125-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0007000000016c2b-150.dat upx behavioral1/files/0x0034000000015c99-154.dat upx behavioral1/memory/2528-160-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0034000000015c99-159.dat upx behavioral1/files/0x0034000000015c99-152.dat upx behavioral1/files/0x0006000000016cbe-165.dat upx behavioral1/files/0x0034000000015c99-163.dat upx behavioral1/files/0x0006000000016cbe-168.dat upx behavioral1/files/0x0006000000016cbe-172.dat upx behavioral1/memory/580-176-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016ce7-184.dat upx behavioral1/memory/1408-183-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/files/0x0006000000016ce7-179.dat upx behavioral1/files/0x0006000000016ce7-177.dat upx behavioral1/files/0x0006000000016ce7-189.dat upx behavioral1/files/0x0007000000016cdf-193.dat upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\en-US\System Restore.exe data.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\MSBuild\Microsoft\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\Office14\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe System Restore.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\update.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\Temp\backup.exe backup.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\data.exe backup.exe File opened for modification C:\Program Files\DVD Maker\ja-JP\backup.exe data.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 2912 backup.exe 2412 backup.exe 2752 backup.exe 2348 backup.exe 3028 backup.exe 2536 backup.exe 3008 backup.exe 2528 backup.exe 2888 backup.exe 612 backup.exe 1628 backup.exe 580 backup.exe 1408 backup.exe 1752 backup.exe 564 backup.exe 2324 backup.exe 1768 backup.exe 308 backup.exe 680 backup.exe 732 backup.exe 816 backup.exe 2952 backup.exe 1592 backup.exe 3048 backup.exe 2132 backup.exe 1612 backup.exe 2104 backup.exe 2688 backup.exe 2664 backup.exe 2844 backup.exe 2720 backup.exe 2652 backup.exe 1736 backup.exe 2292 System Restore.exe 3008 backup.exe 2640 backup.exe 2864 backup.exe 1552 backup.exe 3064 backup.exe 1944 backup.exe 320 update.exe 1480 backup.exe 1896 backup.exe 1524 backup.exe 2272 backup.exe 2044 backup.exe 2636 backup.exe 2284 data.exe 2232 backup.exe 1816 backup.exe 804 backup.exe 1544 backup.exe 364 backup.exe 1808 backup.exe 2852 backup.exe 1620 backup.exe 884 data.exe 736 backup.exe 3044 backup.exe 2060 backup.exe 868 backup.exe 2968 backup.exe 2512 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2912 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 28 PID 2916 wrote to memory of 2912 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 28 PID 2916 wrote to memory of 2912 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 28 PID 2916 wrote to memory of 2912 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 28 PID 2916 wrote to memory of 2412 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 29 PID 2916 wrote to memory of 2412 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 29 PID 2916 wrote to memory of 2412 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 29 PID 2916 wrote to memory of 2412 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 29 PID 2916 wrote to memory of 2752 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 30 PID 2916 wrote to memory of 2752 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 30 PID 2916 wrote to memory of 2752 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 30 PID 2916 wrote to memory of 2752 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 30 PID 2916 wrote to memory of 2348 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 31 PID 2916 wrote to memory of 2348 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 31 PID 2916 wrote to memory of 2348 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 31 PID 2916 wrote to memory of 2348 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 31 PID 2916 wrote to memory of 3028 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 32 PID 2916 wrote to memory of 3028 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 32 PID 2916 wrote to memory of 3028 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 32 PID 2916 wrote to memory of 3028 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 32 PID 2916 wrote to memory of 2536 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 33 PID 2916 wrote to memory of 2536 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 33 PID 2916 wrote to memory of 2536 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 33 PID 2916 wrote to memory of 2536 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 33 PID 2916 wrote to memory of 3008 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 34 PID 2916 wrote to memory of 3008 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 34 PID 2916 wrote to memory of 3008 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 34 PID 2916 wrote to memory of 3008 2916 NEAS.77633383823b8b0d5af0297c96ffd680.exe 34 PID 2912 wrote to memory of 2528 2912 backup.exe 35 PID 2912 wrote to memory of 2528 2912 backup.exe 35 PID 2912 wrote to memory of 2528 2912 backup.exe 35 PID 2912 wrote to memory of 2528 2912 backup.exe 35 PID 2528 wrote to memory of 2888 2528 backup.exe 36 PID 2528 wrote to memory of 2888 2528 backup.exe 36 PID 2528 wrote to memory of 2888 2528 backup.exe 36 PID 2528 wrote to memory of 2888 2528 backup.exe 36 PID 2888 wrote to memory of 612 2888 backup.exe 37 PID 2888 wrote to memory of 612 2888 backup.exe 37 PID 2888 wrote to memory of 612 2888 backup.exe 37 PID 2888 wrote to memory of 612 2888 backup.exe 37 PID 2528 wrote to memory of 1628 2528 backup.exe 38 PID 2528 wrote to memory of 1628 2528 backup.exe 38 PID 2528 wrote to memory of 1628 2528 backup.exe 38 PID 2528 wrote to memory of 1628 2528 backup.exe 38 PID 1628 wrote to memory of 580 1628 backup.exe 39 PID 1628 wrote to memory of 580 1628 backup.exe 39 PID 1628 wrote to memory of 580 1628 backup.exe 39 PID 1628 wrote to memory of 580 1628 backup.exe 39 PID 580 wrote to memory of 1408 580 backup.exe 40 PID 580 wrote to memory of 1408 580 backup.exe 40 PID 580 wrote to memory of 1408 580 backup.exe 40 PID 580 wrote to memory of 1408 580 backup.exe 40 PID 1628 wrote to memory of 1752 1628 backup.exe 41 PID 1628 wrote to memory of 1752 1628 backup.exe 41 PID 1628 wrote to memory of 1752 1628 backup.exe 41 PID 1628 wrote to memory of 1752 1628 backup.exe 41 PID 1752 wrote to memory of 564 1752 backup.exe 42 PID 1752 wrote to memory of 564 1752 backup.exe 42 PID 1752 wrote to memory of 564 1752 backup.exe 42 PID 1752 wrote to memory of 564 1752 backup.exe 42 PID 564 wrote to memory of 2324 564 backup.exe 43 PID 564 wrote to memory of 2324 564 backup.exe 43 PID 564 wrote to memory of 2324 564 backup.exe 43 PID 564 wrote to memory of 2324 564 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.77633383823b8b0d5af0297c96ffd680.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.77633383823b8b0d5af0297c96ffd680.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1285925658\backup.exeC:\Users\Admin\AppData\Local\Temp\1285925658\backup.exe C:\Users\Admin\AppData\Local\Temp\1285925658\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2912 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:612
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1768 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:308
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:732
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3048
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2132
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2104
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2688
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2720
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2652
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2640
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2864
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3064
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:320
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1524
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2272
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2284
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2232
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:804
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:364
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1808
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2852
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:884
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:736
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3044
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2512
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵PID:2748
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2688 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- System policy modification
PID:2600
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:2520
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1064
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:1832
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:1308
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2328
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1292 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
PID:484
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:884
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2096
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- System policy modification
PID:2816 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- System policy modification
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵PID:1596
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2160
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:1540
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\data.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:780
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵PID:1160
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
PID:876
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\update.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Modifies visibility of file extensions in Explorer
PID:2320
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- System policy modification
PID:2368 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵PID:2712
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:848
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵PID:2608
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Drops file in Program Files directory
- System policy modification
PID:364 -
C:\Program Files\Common Files\System\ado\update.exe"C:\Program Files\Common Files\System\ado\update.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
PID:2424 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1060
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:2028
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:272
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:3000
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:2652
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:2052
-
-
-
-
C:\Program Files\DVD Maker\data.exe"C:\Program Files\DVD Maker\data.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1848 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
PID:2580
-
-
C:\Program Files\DVD Maker\en-US\System Restore.exe"C:\Program Files\DVD Maker\en-US\System Restore.exe" C:\Program Files\DVD Maker\en-US\6⤵PID:1616
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1484
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:580
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- System policy modification
PID:2120
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵PID:516
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2164 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
PID:2872 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:2484
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:904
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:484
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:3012
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1704 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Drops file in Program Files directory
PID:3032 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:612
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Drops file in Program Files directory
PID:3052 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:2596
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:2108
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2780
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- System policy modification
PID:1632
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵PID:2588
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵PID:2060
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Drops file in Program Files directory
PID:2756 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
- Modifies visibility of file extensions in Explorer
PID:2080 -
C:\Program Files\Java\jdk1.7.0_80\bin\System Restore.exe"C:\Program Files\Java\jdk1.7.0_80\bin\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵PID:680
-
-
C:\Program Files\Java\jdk1.7.0_80\db\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\7⤵PID:1920
-
-
C:\Program Files\Java\jdk1.7.0_80\include\data.exe"C:\Program Files\Java\jdk1.7.0_80\include\data.exe" C:\Program Files\Java\jdk1.7.0_80\include\7⤵PID:2700
-
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:2728
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- System policy modification
PID:2720 -
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵PID:1284
-
C:\Program Files\Microsoft Games\Chess\de-DE\data.exe"C:\Program Files\Microsoft Games\Chess\de-DE\data.exe" C:\Program Files\Microsoft Games\Chess\de-DE\7⤵PID:2120
-
-
C:\Program Files\Microsoft Games\Chess\en-US\update.exe"C:\Program Files\Microsoft Games\Chess\en-US\update.exe" C:\Program Files\Microsoft Games\Chess\en-US\7⤵PID:2896
-
-
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵PID:1992
-
-
C:\Program Files\Microsoft Games\Hearts\backup.exe"C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\6⤵PID:1196
-
-
-
C:\Program Files\Microsoft Office\data.exe"C:\Program Files\Microsoft Office\data.exe" C:\Program Files\Microsoft Office\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2560 -
C:\Program Files\Microsoft Office\Office14\backup.exe"C:\Program Files\Microsoft Office\Office14\backup.exe" C:\Program Files\Microsoft Office\Office14\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:1808 -
C:\Program Files\Microsoft Office\Office14\1033\System Restore.exe"C:\Program Files\Microsoft Office\Office14\1033\System Restore.exe" C:\Program Files\Microsoft Office\Office14\1033\7⤵PID:2628
-
-
-
-
C:\Program Files\Mozilla Firefox\System Restore.exe"C:\Program Files\Mozilla Firefox\System Restore.exe" C:\Program Files\Mozilla Firefox\5⤵
- System policy modification
PID:1520 -
C:\Program Files\Mozilla Firefox\browser\System Restore.exe"C:\Program Files\Mozilla Firefox\browser\System Restore.exe" C:\Program Files\Mozilla Firefox\browser\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2220 -
C:\Program Files\Mozilla Firefox\browser\features\backup.exe"C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\7⤵PID:1448
-
-
-
C:\Program Files\Mozilla Firefox\defaults\backup.exe"C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\6⤵PID:1740
-
-
C:\Program Files\Mozilla Firefox\fonts\update.exe"C:\Program Files\Mozilla Firefox\fonts\update.exe" C:\Program Files\Mozilla Firefox\fonts\6⤵PID:1972
-
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
- Drops file in Program Files directory
PID:1832 -
C:\Program Files\MSBuild\Microsoft\update.exe"C:\Program Files\MSBuild\Microsoft\update.exe" C:\Program Files\MSBuild\Microsoft\6⤵
- Modifies visibility of file extensions in Explorer
PID:1084 -
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\backup.exe" C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\7⤵PID:536
-
-
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵
- Modifies visibility of file extensions in Explorer
PID:2496 -
C:\Program Files\Reference Assemblies\Microsoft\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2844 -
C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\backup.exe" C:\Program Files\Reference Assemblies\Microsoft\Framework\7⤵PID:2672
-
-
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:2512
-
-
C:\Program Files\Windows Defender\backup.exe"C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\5⤵PID:660
-
-
C:\Program Files\Windows Journal\backup.exe"C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\5⤵PID:2936
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
PID:1608 -
C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Drops file in Program Files directory
PID:2820 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵PID:2564
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
PID:3000 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- System policy modification
PID:1996
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- System policy modification
PID:2880
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵PID:660
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Drops file in Program Files directory
PID:2948 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2544
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:2860
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:3040 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- System policy modification
PID:1100
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Modifies visibility of file extensions in Explorer
PID:2748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2592 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵PID:2732
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵PID:1492
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵PID:2868
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵PID:1948
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Drops file in Program Files directory
- System policy modification
PID:832 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵PID:2884
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
- System policy modification
PID:1748
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
- Modifies visibility of file extensions in Explorer
PID:1960
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
PID:1760 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1236 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
PID:1644
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:2632
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵PID:1408
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵PID:1324
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- System policy modification
PID:592 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:1508
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:2404
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
PID:2788 -
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵PID:1996
-
-
C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵PID:596
-
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵PID:1680
-
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:2100
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:2708
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Drops file in Program Files directory
- System policy modification
PID:2888 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:1040
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:556
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵PID:2932
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1720
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:3064
-
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵PID:2308
-
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵PID:816
-
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵PID:1476
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
- System policy modification
PID:1044 -
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\6⤵
- System policy modification
PID:1308 -
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\7⤵PID:1940
-
-
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1928
-
C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe"C:\Program Files (x86)\Microsoft Office\CLIPART\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\6⤵
- Drops file in Program Files directory
PID:1544 -
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe"C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\7⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe"C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\backup.exe" C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\7⤵PID:2804
-
-
-
C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe"C:\Program Files (x86)\Microsoft Office\Document Themes 14\backup.exe" C:\Program Files (x86)\Microsoft Office\Document Themes 14\6⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe"C:\Program Files (x86)\Microsoft Office\MEDIA\backup.exe" C:\Program Files (x86)\Microsoft Office\MEDIA\6⤵PID:2956
-
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1952 -
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\6⤵
- Modifies visibility of file extensions in Explorer
PID:2068 -
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\7⤵PID:2944
-
-
-
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵
- System policy modification
PID:1484 -
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\6⤵PID:3056
-
C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\7⤵PID:2840
-
-
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:2360 -
C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:572 -
C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\update.exe"C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\update.exe" C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\7⤵PID:2960
-
-
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵
- System policy modification
PID:1988 -
C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\6⤵PID:516
-
-
-
C:\Program Files (x86)\Microsoft.NET\backup.exe"C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\5⤵PID:884
-
-
C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe"C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\5⤵PID:2640
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:2372
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- System policy modification
PID:896 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵PID:2268
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1480
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:2664
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1776
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:2232
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵PID:1144
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵PID:1676
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵PID:1100
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
PID:108 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
PID:2200
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:2916
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:2104
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2752
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2412
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2348
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD56ea6bb186f2b2f54de5f4b6b734648b8
SHA13193a36c0e789abf6987957f7e6092e1d2cbad41
SHA2569ba05fb7df02847df4f57e1a8c7a8dd29996af8a42ddafe61ceaacf757e25864
SHA512a303474463e896df1e25196e1357b418377a4d33d34b6f043206b29f34e3dc57737fd0061359ade0ce7de0f885a9fa41b13ba9c96952eac65594cbce31e47bbb
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD5f2953ba5099214a376da9699d4029b36
SHA189a488dd0a6c3684410fef83d9e0528071036311
SHA256ff428d9a9b71b2b3bf957d9ffa2e8675e025af59493bfc8160b1775c90e300c7
SHA512828d74b204e9f46196236fe2da8ff02265c193884fdc2769c3aac24938d3cb3e78721e423984d10abbe2f9e34f0b98eeae67a3a5883bbe7a116f1688b82c9b56
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD576614e07d2da70c1c3b87d832aba7fea
SHA1b7ade75bbeaa5a813e85fa126bdbf72e83852b2c
SHA2563911467540703c7be1b542b93df2ee19abeb7b33303d5cb6ce8d344b61efc705
SHA5123f847dd0821d51c5216097ed819bb7cf951770ace1c1cf3c20f55961cca58f39f4dd0da8766e07b783dfaeca7599f3758c19c32753a495ebec3062df9126434d
-
Filesize
176KB
MD54087adb823d2dc87415b657ee0e1aad0
SHA1e40bbe06eb87b70a4f738503c47dc06f64da9548
SHA256007ba1edc3b6d442ad1ca19666fcdfa99f9c177c857bfc333a70ebe13eb7f048
SHA5121ac72e07330bb250a9870e2adc12f26b7ca38302962040322b33b4f51c864b1c08f3df351864d7b6226a0bf702b1a55b4abaf247a4cc3fe504b7d6f0ae769b4d
-
Filesize
176KB
MD54087adb823d2dc87415b657ee0e1aad0
SHA1e40bbe06eb87b70a4f738503c47dc06f64da9548
SHA256007ba1edc3b6d442ad1ca19666fcdfa99f9c177c857bfc333a70ebe13eb7f048
SHA5121ac72e07330bb250a9870e2adc12f26b7ca38302962040322b33b4f51c864b1c08f3df351864d7b6226a0bf702b1a55b4abaf247a4cc3fe504b7d6f0ae769b4d
-
Filesize
176KB
MD5096a595cc23ad4445e1b8265a7e5cfa5
SHA1cd6481e0d17ed7362641e1dde905255dcc1da765
SHA256a504e89b7407c00b0e51bf183e9d0dd0e05f244911f891949e2c6cabfb57e5fb
SHA5125d29426c0d4eaaa9f978ea58f5205d36cd711ce12202da82c98dc1ff26ef51fab4e35e6e77a47d7256a22fc8b7936b54df3d80fe527d970540c170900bfa2cea
-
Filesize
176KB
MD576614e07d2da70c1c3b87d832aba7fea
SHA1b7ade75bbeaa5a813e85fa126bdbf72e83852b2c
SHA2563911467540703c7be1b542b93df2ee19abeb7b33303d5cb6ce8d344b61efc705
SHA5123f847dd0821d51c5216097ed819bb7cf951770ace1c1cf3c20f55961cca58f39f4dd0da8766e07b783dfaeca7599f3758c19c32753a495ebec3062df9126434d
-
Filesize
176KB
MD576614e07d2da70c1c3b87d832aba7fea
SHA1b7ade75bbeaa5a813e85fa126bdbf72e83852b2c
SHA2563911467540703c7be1b542b93df2ee19abeb7b33303d5cb6ce8d344b61efc705
SHA5123f847dd0821d51c5216097ed819bb7cf951770ace1c1cf3c20f55961cca58f39f4dd0da8766e07b783dfaeca7599f3758c19c32753a495ebec3062df9126434d
-
Filesize
176KB
MD5356fcf17ac59b566aa685487ecaeea3a
SHA1c77d236c4eb48163dd245ae442174b4737455aaf
SHA256659428ffad3df480a05afb51d7d2ecc4ae8f9710d0d68af7e9dabecee8f706ce
SHA512410dfbab2f6e60b4a7429fd8d5402ae6f6060383c8344ee966f5d57dc253160ae54823958e8f5a92725e782b725f04e6516c45f15b055a55584450b33942ccf5
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD50d00948cffdcb465545ca454bbbbd232
SHA1a5865f43a2fe96116e3f2ef68e50c0fd178d35b1
SHA2561d189f2c987bac05ee3f7c3e8c5cad8879ab1055138c568cbbb75185966f908a
SHA5124074762ba495943bf127760e1dbc5a4af3eb66ac86bab96c8d632e9a1b65142228d351b31d043cb2a3ffb55ad0eefc6018e40306ecfab7c957d60492b088768a
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD50d00948cffdcb465545ca454bbbbd232
SHA1a5865f43a2fe96116e3f2ef68e50c0fd178d35b1
SHA2561d189f2c987bac05ee3f7c3e8c5cad8879ab1055138c568cbbb75185966f908a
SHA5124074762ba495943bf127760e1dbc5a4af3eb66ac86bab96c8d632e9a1b65142228d351b31d043cb2a3ffb55ad0eefc6018e40306ecfab7c957d60492b088768a
-
Filesize
33KB
MD5b8fe00e4e81c71f516597ac4a9e1d4c1
SHA19322e44d9bb21b41410c5e97ec651d79d3334e36
SHA256004e0273614b2fe6d4a6fa1b08ef548ecbdb64efd51144220b8883fe36f65c9b
SHA512d76b15a3bb8a95799182142c4fe0e973c95023ac8de18c3cc42e63fcc0fe1bfb8ae27f555604771800be9aaf790699acdc3df571336c4feee40acebd53544ef7
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
176KB
MD59bd20b2d8e210ed4fdbe9732e21369d0
SHA151047d169cc756b976e7a6df39878b34461b1641
SHA256900fe54c96ca6745f62e06d2c6dd2ef3911507b2164e9daf77ac0bee962bcf6d
SHA512d6ebd2f4abac27e204ec3b80f66622a7122104886396110472843aa688f869405b8ccad9c1dbdcd2f18f1a95d67a7d1e4f86c76788cc5f3144485f4d40de477c
-
Filesize
176KB
MD59bd20b2d8e210ed4fdbe9732e21369d0
SHA151047d169cc756b976e7a6df39878b34461b1641
SHA256900fe54c96ca6745f62e06d2c6dd2ef3911507b2164e9daf77ac0bee962bcf6d
SHA512d6ebd2f4abac27e204ec3b80f66622a7122104886396110472843aa688f869405b8ccad9c1dbdcd2f18f1a95d67a7d1e4f86c76788cc5f3144485f4d40de477c
-
Filesize
176KB
MD56ea6bb186f2b2f54de5f4b6b734648b8
SHA13193a36c0e789abf6987957f7e6092e1d2cbad41
SHA2569ba05fb7df02847df4f57e1a8c7a8dd29996af8a42ddafe61ceaacf757e25864
SHA512a303474463e896df1e25196e1357b418377a4d33d34b6f043206b29f34e3dc57737fd0061359ade0ce7de0f885a9fa41b13ba9c96952eac65594cbce31e47bbb
-
Filesize
176KB
MD56ea6bb186f2b2f54de5f4b6b734648b8
SHA13193a36c0e789abf6987957f7e6092e1d2cbad41
SHA2569ba05fb7df02847df4f57e1a8c7a8dd29996af8a42ddafe61ceaacf757e25864
SHA512a303474463e896df1e25196e1357b418377a4d33d34b6f043206b29f34e3dc57737fd0061359ade0ce7de0f885a9fa41b13ba9c96952eac65594cbce31e47bbb
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD5f2953ba5099214a376da9699d4029b36
SHA189a488dd0a6c3684410fef83d9e0528071036311
SHA256ff428d9a9b71b2b3bf957d9ffa2e8675e025af59493bfc8160b1775c90e300c7
SHA512828d74b204e9f46196236fe2da8ff02265c193884fdc2769c3aac24938d3cb3e78721e423984d10abbe2f9e34f0b98eeae67a3a5883bbe7a116f1688b82c9b56
-
Filesize
176KB
MD5f2953ba5099214a376da9699d4029b36
SHA189a488dd0a6c3684410fef83d9e0528071036311
SHA256ff428d9a9b71b2b3bf957d9ffa2e8675e025af59493bfc8160b1775c90e300c7
SHA512828d74b204e9f46196236fe2da8ff02265c193884fdc2769c3aac24938d3cb3e78721e423984d10abbe2f9e34f0b98eeae67a3a5883bbe7a116f1688b82c9b56
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD576614e07d2da70c1c3b87d832aba7fea
SHA1b7ade75bbeaa5a813e85fa126bdbf72e83852b2c
SHA2563911467540703c7be1b542b93df2ee19abeb7b33303d5cb6ce8d344b61efc705
SHA5123f847dd0821d51c5216097ed819bb7cf951770ace1c1cf3c20f55961cca58f39f4dd0da8766e07b783dfaeca7599f3758c19c32753a495ebec3062df9126434d
-
Filesize
176KB
MD576614e07d2da70c1c3b87d832aba7fea
SHA1b7ade75bbeaa5a813e85fa126bdbf72e83852b2c
SHA2563911467540703c7be1b542b93df2ee19abeb7b33303d5cb6ce8d344b61efc705
SHA5123f847dd0821d51c5216097ed819bb7cf951770ace1c1cf3c20f55961cca58f39f4dd0da8766e07b783dfaeca7599f3758c19c32753a495ebec3062df9126434d
-
Filesize
176KB
MD54087adb823d2dc87415b657ee0e1aad0
SHA1e40bbe06eb87b70a4f738503c47dc06f64da9548
SHA256007ba1edc3b6d442ad1ca19666fcdfa99f9c177c857bfc333a70ebe13eb7f048
SHA5121ac72e07330bb250a9870e2adc12f26b7ca38302962040322b33b4f51c864b1c08f3df351864d7b6226a0bf702b1a55b4abaf247a4cc3fe504b7d6f0ae769b4d
-
Filesize
176KB
MD54087adb823d2dc87415b657ee0e1aad0
SHA1e40bbe06eb87b70a4f738503c47dc06f64da9548
SHA256007ba1edc3b6d442ad1ca19666fcdfa99f9c177c857bfc333a70ebe13eb7f048
SHA5121ac72e07330bb250a9870e2adc12f26b7ca38302962040322b33b4f51c864b1c08f3df351864d7b6226a0bf702b1a55b4abaf247a4cc3fe504b7d6f0ae769b4d
-
Filesize
176KB
MD5096a595cc23ad4445e1b8265a7e5cfa5
SHA1cd6481e0d17ed7362641e1dde905255dcc1da765
SHA256a504e89b7407c00b0e51bf183e9d0dd0e05f244911f891949e2c6cabfb57e5fb
SHA5125d29426c0d4eaaa9f978ea58f5205d36cd711ce12202da82c98dc1ff26ef51fab4e35e6e77a47d7256a22fc8b7936b54df3d80fe527d970540c170900bfa2cea
-
Filesize
176KB
MD5096a595cc23ad4445e1b8265a7e5cfa5
SHA1cd6481e0d17ed7362641e1dde905255dcc1da765
SHA256a504e89b7407c00b0e51bf183e9d0dd0e05f244911f891949e2c6cabfb57e5fb
SHA5125d29426c0d4eaaa9f978ea58f5205d36cd711ce12202da82c98dc1ff26ef51fab4e35e6e77a47d7256a22fc8b7936b54df3d80fe527d970540c170900bfa2cea
-
Filesize
176KB
MD576614e07d2da70c1c3b87d832aba7fea
SHA1b7ade75bbeaa5a813e85fa126bdbf72e83852b2c
SHA2563911467540703c7be1b542b93df2ee19abeb7b33303d5cb6ce8d344b61efc705
SHA5123f847dd0821d51c5216097ed819bb7cf951770ace1c1cf3c20f55961cca58f39f4dd0da8766e07b783dfaeca7599f3758c19c32753a495ebec3062df9126434d
-
Filesize
176KB
MD576614e07d2da70c1c3b87d832aba7fea
SHA1b7ade75bbeaa5a813e85fa126bdbf72e83852b2c
SHA2563911467540703c7be1b542b93df2ee19abeb7b33303d5cb6ce8d344b61efc705
SHA5123f847dd0821d51c5216097ed819bb7cf951770ace1c1cf3c20f55961cca58f39f4dd0da8766e07b783dfaeca7599f3758c19c32753a495ebec3062df9126434d
-
Filesize
176KB
MD5356fcf17ac59b566aa685487ecaeea3a
SHA1c77d236c4eb48163dd245ae442174b4737455aaf
SHA256659428ffad3df480a05afb51d7d2ecc4ae8f9710d0d68af7e9dabecee8f706ce
SHA512410dfbab2f6e60b4a7429fd8d5402ae6f6060383c8344ee966f5d57dc253160ae54823958e8f5a92725e782b725f04e6516c45f15b055a55584450b33942ccf5
-
Filesize
176KB
MD5356fcf17ac59b566aa685487ecaeea3a
SHA1c77d236c4eb48163dd245ae442174b4737455aaf
SHA256659428ffad3df480a05afb51d7d2ecc4ae8f9710d0d68af7e9dabecee8f706ce
SHA512410dfbab2f6e60b4a7429fd8d5402ae6f6060383c8344ee966f5d57dc253160ae54823958e8f5a92725e782b725f04e6516c45f15b055a55584450b33942ccf5
-
Filesize
176KB
MD515264c6e24871af68962523a2f1f74e8
SHA1f058a71d6fe0e51d84f7b1cac25455c669b2d313
SHA2563da326f029e249cf47b8a06f943a33beaf41bb5c6d371f5a8e3dbb901a1819fa
SHA5129043ddae54d2b7e3c6958a6eb3b545583cb01ccc3f58b894098780f366e8aca79d5ad511ab1da978d949e3e57a3eed360e2af1cc2935ed23f9c55634a47e3773
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD5f27d38a8150d0c65dcfd3e7904b7062b
SHA1d91ed39f877cb2f47df866089a4858f6a6822bae
SHA256f820db2d8296a9c67576a387cf6ddd1113e33cc9dae6c92dc773fdcfaae4c7a4
SHA5124252fb224a4a4ad7ed68fa4f7fbcc460cc8328cbe5b5c7ad80f0d1bf168b5550459de2c85860c0f34734050b0167ce3ad0c0a980fc82b55e78a266a86dcfdaa6
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD566f585016e94cde1933d3827cdee4153
SHA1e2fed5c6bedc1f65003e2fadd25b27a06d6b93c5
SHA256c726146defb3e2f7446b52474abeeec1770c9a98c4bea6e143449f89b51a4377
SHA512c854b514d812147561e458e34e2146a64e35cf585be5a5123794a3f84a5376640afb038e497ee9d7a44700b41e7805e9a8f9c009774f5647d399e7edab42b9ee
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD50d00948cffdcb465545ca454bbbbd232
SHA1a5865f43a2fe96116e3f2ef68e50c0fd178d35b1
SHA2561d189f2c987bac05ee3f7c3e8c5cad8879ab1055138c568cbbb75185966f908a
SHA5124074762ba495943bf127760e1dbc5a4af3eb66ac86bab96c8d632e9a1b65142228d351b31d043cb2a3ffb55ad0eefc6018e40306ecfab7c957d60492b088768a
-
Filesize
176KB
MD50d00948cffdcb465545ca454bbbbd232
SHA1a5865f43a2fe96116e3f2ef68e50c0fd178d35b1
SHA2561d189f2c987bac05ee3f7c3e8c5cad8879ab1055138c568cbbb75185966f908a
SHA5124074762ba495943bf127760e1dbc5a4af3eb66ac86bab96c8d632e9a1b65142228d351b31d043cb2a3ffb55ad0eefc6018e40306ecfab7c957d60492b088768a
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD5b995ad573a222991804272e7e4e308d9
SHA18ca7ca2aa7c152efcaded3d1b7f58800596a7153
SHA2562fe3d09029ab738a93dd24c602264bc80076221c89a50e8eb1a3336e2a8e5366
SHA512d03868462956c7d2cacfc629fad74386f8d07faefb484c86fc452e33b0305a1867f655afc4ddf06135ee6cf5dc91ea5b6f9ca056186127acba2b2f65426484f6
-
Filesize
176KB
MD50d00948cffdcb465545ca454bbbbd232
SHA1a5865f43a2fe96116e3f2ef68e50c0fd178d35b1
SHA2561d189f2c987bac05ee3f7c3e8c5cad8879ab1055138c568cbbb75185966f908a
SHA5124074762ba495943bf127760e1dbc5a4af3eb66ac86bab96c8d632e9a1b65142228d351b31d043cb2a3ffb55ad0eefc6018e40306ecfab7c957d60492b088768a
-
Filesize
176KB
MD50d00948cffdcb465545ca454bbbbd232
SHA1a5865f43a2fe96116e3f2ef68e50c0fd178d35b1
SHA2561d189f2c987bac05ee3f7c3e8c5cad8879ab1055138c568cbbb75185966f908a
SHA5124074762ba495943bf127760e1dbc5a4af3eb66ac86bab96c8d632e9a1b65142228d351b31d043cb2a3ffb55ad0eefc6018e40306ecfab7c957d60492b088768a