Analysis
-
max time kernel
190s -
max time network
226s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29/11/2022, 14:10
General
-
Target
65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe
-
Size
72KB
-
MD5
0a1fa8f639125448774cb1ba2cfdf870
-
SHA1
921f41a6155c36564b581e640d8aac8dcbd6e8ba
-
SHA256
65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8
-
SHA512
0baec6df52c5498b6f4645e9f837c4a9460425594ae0a8a5e79bb45a188f4225056d8d4795aeb7aecd4c781988f9a662a7eac84dc0f90f283454e98f9e432f5d
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2v:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrj
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Disables RegEdit via registry modification 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe"C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1420136871\backup.exeC:\Users\Admin\AppData\Local\Temp\1420136871\backup.exe C:\Users\Admin\AppData\Local\Temp\1420136871\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵
-
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\10⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\9⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\9⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\9⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\9⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\9⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\9⤵
-
-
-
C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe"C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\8⤵
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵
-
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files\Common Files\microsoft shared\VC\data.exe"C:\Program Files\Common Files\microsoft shared\VC\data.exe" C:\Program Files\Common Files\microsoft shared\VC\7⤵
-
-
C:\Program Files\Common Files\microsoft shared\VGX\backup.exe"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\7⤵
-
-
C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\8⤵
-
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\data.exe"C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\data.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\9⤵
- Disables RegEdit via registry modification
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\it-IT\data.exe"C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
-
C:\Program Files\Common Files\System\es-ES\System Restore.exe"C:\Program Files\Common Files\System\es-ES\System Restore.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
-
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵
-
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
-
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- System policy modification
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\update.exe"C:\Program Files\Google\Chrome\Application\update.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\10⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\11⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Disables RegEdit via registry modification
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
-
-
C:\Program Files\Internet Explorer\ja-JP\update.exe"C:\Program Files\Internet Explorer\ja-JP\update.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵
- System policy modification
-
-
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\8⤵
-
-
-
C:\Program Files\Java\jdk1.8.0_66\include\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\8⤵
-
C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\9⤵
-
-
-
-
C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe"C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\7⤵
-
-
-
C:\Program Files\Java\jre1.8.0_66\update.exe"C:\Program Files\Java\jre1.8.0_66\update.exe" C:\Program Files\Java\jre1.8.0_66\6⤵
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Drops file in Program Files directory
-
C:\Program Files\Microsoft Office\Office16\backup.exe"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Microsoft Office\PackageManifests\backup.exe"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Program Files\Microsoft Office\root\backup.exe"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files\Microsoft Office\root\Client\backup.exe"C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\7⤵
- Disables RegEdit via registry modification
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\8⤵
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe"C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\8⤵
-
-
-
C:\Program Files\Microsoft Office\root\fre\backup.exe"C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\7⤵
-
-
-
C:\Program Files\Microsoft Office\Updates\backup.exe"C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\6⤵
-
-
-
C:\Program Files\Microsoft Office 15\backup.exe"C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\5⤵
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
- Disables RegEdit via registry modification
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Disables RegEdit via registry modification
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵
- System policy modification
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\8⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\8⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\10⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\10⤵
-
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\8⤵
- System policy modification
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
- Disables RegEdit via registry modification
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\7⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\8⤵
-
-
-
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- System policy modification
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
-
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe"C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\7⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
C:\Program Files (x86)\Google\Update\Download\backup.exe"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\8⤵
-
-
-
C:\Program Files (x86)\Google\Update\Install\backup.exe"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\7⤵
-
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\data.exeC:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\6⤵
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\OneDrive\backup.exeC:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\6⤵
- System policy modification
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Disables RegEdit via registry modification
-
C:\Users\Admin\Pictures\Camera Roll\backup.exe"C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Users\Admin\Pictures\Saved Pictures\backup.exe"C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\7⤵
- System policy modification
-
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
-
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
- Disables RegEdit via registry modification
- System policy modification
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
- Disables RegEdit via registry modification
-
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵
- System policy modification
-
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵
- System policy modification
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
-
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
-
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
-
C:\Windows\appcompat\appraiser\Telemetry\data.exeC:\Windows\appcompat\appraiser\Telemetry\data.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵
-
-
-
C:\Windows\appcompat\encapsulation\backup.exeC:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Windows\appcompat\Programs\backup.exeC:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\6⤵
-
-
-
C:\Windows\apppatch\backup.exeC:\Windows\apppatch\backup.exe C:\Windows\apppatch\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Windows directory
-
C:\Windows\apppatch\AppPatch64\backup.exeC:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Windows\apppatch\Custom\backup.exeC:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\6⤵
- Disables RegEdit via registry modification
- Drops file in Windows directory
- System policy modification
-
-
C:\Windows\apppatch\CustomSDB\backup.exeC:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\6⤵
-
-
-
C:\Windows\AppReadiness\backup.exeC:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\1⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\1⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\1⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6
-
Filesize
72KB
MD55cfd1a12a70648208fda400fad9160d8
SHA13b29a55bfdc8c235954e8f51a23a7e6f9bf3a4ed
SHA2567ca95fb165cf0a16b1a734f212c5bfb995b748fd19da5ba0e6ae0002ba35f6a3
SHA512c0e736ff84e48284c68a5a3e4448cbcbcbf625aac5a64bee5535eca0938757ad1a5586f9eb66adc9fd9b1c9324ee2c118bbfbffe4dae94179401e50c160f4f16
-
Filesize
72KB
MD55cfd1a12a70648208fda400fad9160d8
SHA13b29a55bfdc8c235954e8f51a23a7e6f9bf3a4ed
SHA2567ca95fb165cf0a16b1a734f212c5bfb995b748fd19da5ba0e6ae0002ba35f6a3
SHA512c0e736ff84e48284c68a5a3e4448cbcbcbf625aac5a64bee5535eca0938757ad1a5586f9eb66adc9fd9b1c9324ee2c118bbfbffe4dae94179401e50c160f4f16
-
Filesize
72KB
MD5978bdac788ef8905bb544a1bd2cbf802
SHA127c9be7aa8c754d80fd3153a1cb4f0289c815144
SHA256fe5ef0ab4f864ac4dbd6560e96bb7f4a00cf34942a875e113277f8fdc9c37d13
SHA5128bd3d59c1f0e52ebcc60e49d51997f7b2b00ea41e6b244ab8dafaa0d97cabea878c574687479f282d6f6918752fd17c67715ec3b34a6b27159e83a4e893a5d59
-
Filesize
72KB
MD5978bdac788ef8905bb544a1bd2cbf802
SHA127c9be7aa8c754d80fd3153a1cb4f0289c815144
SHA256fe5ef0ab4f864ac4dbd6560e96bb7f4a00cf34942a875e113277f8fdc9c37d13
SHA5128bd3d59c1f0e52ebcc60e49d51997f7b2b00ea41e6b244ab8dafaa0d97cabea878c574687479f282d6f6918752fd17c67715ec3b34a6b27159e83a4e893a5d59
-
Filesize
72KB
MD58fbb71dc7039a3a8a8e8c288ec48db63
SHA1e811022408805a82e6a43310fe82039683f7c51c
SHA2565b569c20cc0aac3dab0b10cb3926c0c5d4fdb9e0a7649aa87fff6e41ab08787b
SHA512d09431c7becd367d0bfc64827c027ea55f7e832b50a6feae7f098dc0bd71c5c889f58420e8dfe4eb07cda6b565f1f66783bb5fa33b97600abacf09fdb92c575e
-
Filesize
72KB
MD58fbb71dc7039a3a8a8e8c288ec48db63
SHA1e811022408805a82e6a43310fe82039683f7c51c
SHA2565b569c20cc0aac3dab0b10cb3926c0c5d4fdb9e0a7649aa87fff6e41ab08787b
SHA512d09431c7becd367d0bfc64827c027ea55f7e832b50a6feae7f098dc0bd71c5c889f58420e8dfe4eb07cda6b565f1f66783bb5fa33b97600abacf09fdb92c575e
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD56273261120069d812e669aabe091b64f
SHA12b7e93dd950bdb951197dee7d631db7ccb0b5b76
SHA256dcc07a441b45b131ae545f31512327e8f0e79957eeaa2807beb6f6299fc0af39
SHA512fdf0f70cd3a379b175c3afba171555c237691c90daa58d63fc6b97fcfdd4e9cd49edf5e1161954cb8cd89b12908dd6c57f7f24cf5efcfc2caf05cd2126341ad1
-
Filesize
72KB
MD56273261120069d812e669aabe091b64f
SHA12b7e93dd950bdb951197dee7d631db7ccb0b5b76
SHA256dcc07a441b45b131ae545f31512327e8f0e79957eeaa2807beb6f6299fc0af39
SHA512fdf0f70cd3a379b175c3afba171555c237691c90daa58d63fc6b97fcfdd4e9cd49edf5e1161954cb8cd89b12908dd6c57f7f24cf5efcfc2caf05cd2126341ad1
-
Filesize
72KB
MD5d14daca447cdb85cc4fb5b5bc2e2045b
SHA18b4f94e22597b6f4c8f7c9aff4c61e1a5763e170
SHA25698fd822bd04e6e4f9aba84dbfbbd81a155da2775779ffc71594849ec18d860f7
SHA512422fd29fa23ab4d0b850526bf92351a612618c7d92d8d05540b7d29f11f096784448e91fdde8a8d779394a4bdff20f3a56b8cf91febfdcd2578d58dbf62e3dcf
-
Filesize
72KB
MD5d14daca447cdb85cc4fb5b5bc2e2045b
SHA18b4f94e22597b6f4c8f7c9aff4c61e1a5763e170
SHA25698fd822bd04e6e4f9aba84dbfbbd81a155da2775779ffc71594849ec18d860f7
SHA512422fd29fa23ab4d0b850526bf92351a612618c7d92d8d05540b7d29f11f096784448e91fdde8a8d779394a4bdff20f3a56b8cf91febfdcd2578d58dbf62e3dcf
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD55e0d47d232280bb51f6bc2668e8d1836
SHA11e394848fa08fcc4c0bab8cd1e57608eea0d77cb
SHA25696f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d
SHA5120e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD50237f639256247217c6bfdac70841768
SHA17d0e8ffd67c6dcdc5e32c5ff27534c4a423d4de2
SHA256ad88df92015f48e6474c0c5b2f6d89c7cc7a49a9b0b4d41bda2453986315fea2
SHA512cce8612ada08b10d8f30e5ed9f7287fcff818bcf7dc5a5ec1e2c62a20ab790b6a630eebec39c18051bfabd61e7e93dbf5217779f8d10315cc26aef3a05c730a4
-
Filesize
72KB
MD50237f639256247217c6bfdac70841768
SHA17d0e8ffd67c6dcdc5e32c5ff27534c4a423d4de2
SHA256ad88df92015f48e6474c0c5b2f6d89c7cc7a49a9b0b4d41bda2453986315fea2
SHA512cce8612ada08b10d8f30e5ed9f7287fcff818bcf7dc5a5ec1e2c62a20ab790b6a630eebec39c18051bfabd61e7e93dbf5217779f8d10315cc26aef3a05c730a4
-
Filesize
72KB
MD5ca091200e66ed448c9b09e165cb1f758
SHA143c03277524acc16d3cef60534a11bd4937fa932
SHA2565da6713e0630b936fb521f191a8b400dea872aa80bf93db41a04afd6a2f37131
SHA51258010b3c40c9470579cdc63aee869d74a629aaf16cdeaef31f40814940d9d0adc6f041fbe2c8fe6445edc93df5ef10beec3ae03f5363a9394c46e95d4e168339
-
Filesize
72KB
MD5ca091200e66ed448c9b09e165cb1f758
SHA143c03277524acc16d3cef60534a11bd4937fa932
SHA2565da6713e0630b936fb521f191a8b400dea872aa80bf93db41a04afd6a2f37131
SHA51258010b3c40c9470579cdc63aee869d74a629aaf16cdeaef31f40814940d9d0adc6f041fbe2c8fe6445edc93df5ef10beec3ae03f5363a9394c46e95d4e168339
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD5753c57c71f0e161df707de77fa660571
SHA1267df3f31a061e14807f33cb627d2f5b34716b79
SHA2564b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130
SHA512e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD58be7835c59bfb327100f0c4baefa5100
SHA18cd6540a35ef853e66db27205fab2bac3d8d69f1
SHA256ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b
SHA5126ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD54f13e146d19d30133477d7077652a591
SHA16d1efcf838c894f067e3f5c26202762957bd458b
SHA256392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd
SHA512277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD530c87f3e353c338cd8d7d7004d89a75e
SHA1caa1661a7e244549ace0697cb1594c4abc974db9
SHA2565adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5
SHA512afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d
-
Filesize
72KB
MD5a95db4d2b940df2a9035b52ed2b9c286
SHA109c1728911614d511f4e175d8c4e6ace922c3456
SHA2564ac95bb08e46c8a2500e283396b6ae05f545224a3e024f4440b859eade4f9193
SHA5128b2919aef9b52aeb859c8fa90b764e54f6581148ee4a7e31ac71b271a88f1d63f41e04941251300548647c5cbac1e640da7e49e13fd46a79034d21c7fac1d1ed
-
Filesize
72KB
MD5a95db4d2b940df2a9035b52ed2b9c286
SHA109c1728911614d511f4e175d8c4e6ace922c3456
SHA2564ac95bb08e46c8a2500e283396b6ae05f545224a3e024f4440b859eade4f9193
SHA5128b2919aef9b52aeb859c8fa90b764e54f6581148ee4a7e31ac71b271a88f1d63f41e04941251300548647c5cbac1e640da7e49e13fd46a79034d21c7fac1d1ed
-
Filesize
72KB
MD54aefdcfe21bb4fee2a98e3e9f18fe967
SHA13d4cb0646f6901d80564b3f6784cf5b6b8fc0a7f
SHA25650d19bb7f01b6c4465d3b6836afde146191745ed4c113eb1ce914e9522d005b5
SHA51252821970450912e88ef2f0da8e6db1573a419bac0843d90403b4af747cded6307831d0f59bf09f77da69c62337a18e87a57b6a28130e92ccb0eba45b0064b834
-
Filesize
72KB
MD54aefdcfe21bb4fee2a98e3e9f18fe967
SHA13d4cb0646f6901d80564b3f6784cf5b6b8fc0a7f
SHA25650d19bb7f01b6c4465d3b6836afde146191745ed4c113eb1ce914e9522d005b5
SHA51252821970450912e88ef2f0da8e6db1573a419bac0843d90403b4af747cded6307831d0f59bf09f77da69c62337a18e87a57b6a28130e92ccb0eba45b0064b834
-
Filesize
72KB
MD532db1f2df5a3025afc8488fb27033a14
SHA1a1b5f39cc9f59424438f41b3f293a9ec7acf1564
SHA2567c0a5420a4847b0be66ae0f0f0277d0deb43b98fd286ba9188af1df9bbce8b19
SHA512b3dc516ec32fa5f0fa05cc1154dcb19ef2b8621302bf031aa6cabcf3732111c2a00f3896f6425f3fb3183f6a433a5b8071e48a660674c06a91c3ed55ec480652
-
Filesize
72KB
MD532db1f2df5a3025afc8488fb27033a14
SHA1a1b5f39cc9f59424438f41b3f293a9ec7acf1564
SHA2567c0a5420a4847b0be66ae0f0f0277d0deb43b98fd286ba9188af1df9bbce8b19
SHA512b3dc516ec32fa5f0fa05cc1154dcb19ef2b8621302bf031aa6cabcf3732111c2a00f3896f6425f3fb3183f6a433a5b8071e48a660674c06a91c3ed55ec480652
-
Filesize
72KB
MD59ed80023db3285af912d99a10e5a334e
SHA12a139484d4cbc92e704b6edd0ca0ff4cd6a6267a
SHA25660822e03d673a9c09c796c6ca9aa5dd5d62a12bc819a8e3dbe3429780d721d62
SHA5121c9c3608285659881ebbe068be58db3b75e46710f6259b0ae7a4f11821ca105c5d2bfbf6b5968b1dcb1b19a3894d06b4b3d6f77755bc865e78c823f4db1c1f45
-
Filesize
72KB
MD59ed80023db3285af912d99a10e5a334e
SHA12a139484d4cbc92e704b6edd0ca0ff4cd6a6267a
SHA25660822e03d673a9c09c796c6ca9aa5dd5d62a12bc819a8e3dbe3429780d721d62
SHA5121c9c3608285659881ebbe068be58db3b75e46710f6259b0ae7a4f11821ca105c5d2bfbf6b5968b1dcb1b19a3894d06b4b3d6f77755bc865e78c823f4db1c1f45
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
Filesize
72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD53fc71dcb25a3fdc886dfc1872adf8d8a
SHA11d184f0c0c042c6735f45e9c28371a9315b97327
SHA256b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f
SHA512d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1
-
Filesize
72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
Filesize
72KB
MD55346f66835ee7b10f7fb071ba21d8751
SHA1d1d68c28ccfd3d8653b5124eea4182542641f3cd
SHA2565148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113
SHA5125795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003
-
Filesize
72KB
MD5d60ade52b457c5c3f7c9e240f76ed4bd
SHA1d157b8ba971c4f118ee543e76d60b12757ba4f0d
SHA25648b074eddac5c3648bc85e5091c40f4573c0fee812781dbdd6b0d1b4758c85e5
SHA512f0f8aa7d231d837bbfef4a678ad12c8762ec361f120305d23b0309383f6d951bac74aec13b8dfe519ab281c2b0084683221b481346b7f783e39774d8d6fce9d1
-
Filesize
72KB
MD5d60ade52b457c5c3f7c9e240f76ed4bd
SHA1d157b8ba971c4f118ee543e76d60b12757ba4f0d
SHA25648b074eddac5c3648bc85e5091c40f4573c0fee812781dbdd6b0d1b4758c85e5
SHA512f0f8aa7d231d837bbfef4a678ad12c8762ec361f120305d23b0309383f6d951bac74aec13b8dfe519ab281c2b0084683221b481346b7f783e39774d8d6fce9d1
-
Filesize
72KB
MD55e16005b16eb143942210b9485832aea
SHA15f764626a16e006f5978ffd3284cf4c0275ac03b
SHA256f67a5c882c4d69764a701322970dec872e7b7f7497567a509e36a5a4f4ca9226
SHA512675df684f66ccd2085d52c5c2c87c467eb58798797cce2481b330bc2cbc757e510ed590919dbe69a7c2524f8857f1599d991f515ba5e58c54a1d6360e4a3913a
-
Filesize
72KB
MD55e16005b16eb143942210b9485832aea
SHA15f764626a16e006f5978ffd3284cf4c0275ac03b
SHA256f67a5c882c4d69764a701322970dec872e7b7f7497567a509e36a5a4f4ca9226
SHA512675df684f66ccd2085d52c5c2c87c467eb58798797cce2481b330bc2cbc757e510ed590919dbe69a7c2524f8857f1599d991f515ba5e58c54a1d6360e4a3913a
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6
-
Filesize
72KB
MD5f8cf8e1433e035c2277b8989ab42e70d
SHA1f2e1a989c5a4f0277e50036791df82a83ba5e2fd
SHA2564c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500
SHA512cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6