Analysis
-
max time kernel
191s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
02-12-2022 19:45
General
-
Target
12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe
-
Size
72KB
-
MD5
248643b8f3d27c37ec8ea9f828fc817a
-
SHA1
0a52d024902e0c6c45f9fad2cb01d3ed56aedba2
-
SHA256
12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5
-
SHA512
41a52c3fded064eeddd5a215dbf6e692d6a53d05a56948f4fed172c301b4c0afdcc00d1b06b15a0d96d9b3f76240032cbe81a8f15122c12edc4d14d228be3e89
-
SSDEEP
384:N6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KgxWb/83BXR+oG6:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrn
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe"C:\Users\Admin\AppData\Local\Temp\12b90be58b21ad68d015784d1bf97acd6fbdd40491b94033096c35c935d075f5.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\3249709040\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\3249709040\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\3249709040\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\odt\update.exeC:\odt\update.exe C:\odt\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\PerfLogs\update.exeC:\PerfLogs\update.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\update.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\update.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\update.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\ado\it-IT\update.exe"C:\Program Files\Common Files\System\ado\it-IT\update.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\ado\ja-JP\update.exe"C:\Program Files\Common Files\System\ado\ja-JP\update.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
-
-
-
C:\Program Files\Common Files\System\de-DE\data.exe"C:\Program Files\Common Files\System\de-DE\data.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\update.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
-
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Java\jdk1.8.0_66\include\backup.exe"C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\7⤵
-
-
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
- Drops file in Program Files directory
-
C:\Program Files\Microsoft Office\Office16\backup.exe"C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\6⤵
-
-
C:\Program Files\Microsoft Office\PackageManifests\backup.exe"C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files\Microsoft Office\root\backup.exe"C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\6⤵
-
-
-
C:\Program Files\Microsoft Office 15\backup.exe"C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\5⤵
-
-
-
C:\Program Files (x86)\data.exe"C:\Program Files (x86)\data.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\8⤵
- Modifies visibility of file extensions in Explorer
-
-
-
-
-
C:\Program Files (x86)\Common Files\data.exe"C:\Program Files (x86)\Common Files\data.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Drops file in Program Files directory
- System policy modification
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
-
-
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\7⤵
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\6⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
- System policy modification
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
-
-
C:\Users\data.exeC:\Users\data.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
-
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
-
-
-
C:\Windows\apppatch\backup.exeC:\Windows\apppatch\backup.exe C:\Windows\apppatch\5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5de408f437917e48d881441811298c56f
SHA110e51e83e25cb259512fe8152ed83e1969850242
SHA256cbb91ac651c3d9ad64ba0de2ef11ee52bade8533f698bd9fdf971946539a4525
SHA51299182908bdcf53161f401ea3beb63d7c5615741e198dc3a08badada3b4326837a95072f30b6d0b29622f0527ad9631ddb757f2d8d89d8b58d58cc93ac14b30ee
-
Filesize
72KB
MD5de408f437917e48d881441811298c56f
SHA110e51e83e25cb259512fe8152ed83e1969850242
SHA256cbb91ac651c3d9ad64ba0de2ef11ee52bade8533f698bd9fdf971946539a4525
SHA51299182908bdcf53161f401ea3beb63d7c5615741e198dc3a08badada3b4326837a95072f30b6d0b29622f0527ad9631ddb757f2d8d89d8b58d58cc93ac14b30ee
-
Filesize
72KB
MD5e85215886d2caf2bea8750cde1ca3d6e
SHA19d69a0b83628c2ad067df606f1773613861275e4
SHA2561a1c02db06b4ffe2dda17414a0dbbfbd1a2ad6227b8a23f2d81d3404491095a6
SHA512c3954533795619534df652040c95f7c60908dd0679844128dcf3b09accfa761ebdc6c56d8146147baa463aaf9877af1c869b692788b94ccc2ed0172f266f95c0
-
Filesize
72KB
MD5e85215886d2caf2bea8750cde1ca3d6e
SHA19d69a0b83628c2ad067df606f1773613861275e4
SHA2561a1c02db06b4ffe2dda17414a0dbbfbd1a2ad6227b8a23f2d81d3404491095a6
SHA512c3954533795619534df652040c95f7c60908dd0679844128dcf3b09accfa761ebdc6c56d8146147baa463aaf9877af1c869b692788b94ccc2ed0172f266f95c0
-
Filesize
72KB
MD5751e23fb8def2da02243c5c8c1623e7d
SHA163b6945b96679e3bf603bb25ac366604a8f612ba
SHA256f1a2f45cdf5a1327fc6ff20e5ccdaf7bc11d37e70b9ed72f92a7626808d7c32b
SHA5121f8c16dc45eb0473f86e48e8307399e5762a97c7f8c354b3767b263e2566bbf39c3bd864a13d6fa37e5e6933d75ed3114d720b91626d89741be3ab94ed517d7e
-
Filesize
72KB
MD5751e23fb8def2da02243c5c8c1623e7d
SHA163b6945b96679e3bf603bb25ac366604a8f612ba
SHA256f1a2f45cdf5a1327fc6ff20e5ccdaf7bc11d37e70b9ed72f92a7626808d7c32b
SHA5121f8c16dc45eb0473f86e48e8307399e5762a97c7f8c354b3767b263e2566bbf39c3bd864a13d6fa37e5e6933d75ed3114d720b91626d89741be3ab94ed517d7e
-
Filesize
72KB
MD5780765fd98eb7bd60cb8997a8ec80fb8
SHA14e166ad874d1efbc20226bdc3f73f222f4d3e193
SHA25664c6e06d3ba8f2f13f5142e84fd32915513cd4422c9e355dad424dc47dee5164
SHA512c044d9f95315ffb113559c6897d18835ca9429e71953b16874a6eab8a9286dd4bbccc9931ef2145f8c67e866c17eb9dd959adde9419c29104d604e0a258f304b
-
Filesize
72KB
MD5780765fd98eb7bd60cb8997a8ec80fb8
SHA14e166ad874d1efbc20226bdc3f73f222f4d3e193
SHA25664c6e06d3ba8f2f13f5142e84fd32915513cd4422c9e355dad424dc47dee5164
SHA512c044d9f95315ffb113559c6897d18835ca9429e71953b16874a6eab8a9286dd4bbccc9931ef2145f8c67e866c17eb9dd959adde9419c29104d604e0a258f304b
-
Filesize
72KB
MD5b1b18a6a16f4e80ce37f37c798146497
SHA11c0b0d9f6309be49ff43f9e3e7face9fb07522d0
SHA256912d3bddb59ab7f503a4533ce0cb149d25984e63d129e06c019aecc79940c7be
SHA5121290bbbde2987f348db04a5da088ec74fcaef75a6ad0bd88094ce605e620cf7ca00d28ea3875397b001f1b1b40f4aa146df18d88fe2120ed281c4bfb2aac54db
-
Filesize
72KB
MD5b1b18a6a16f4e80ce37f37c798146497
SHA11c0b0d9f6309be49ff43f9e3e7face9fb07522d0
SHA256912d3bddb59ab7f503a4533ce0cb149d25984e63d129e06c019aecc79940c7be
SHA5121290bbbde2987f348db04a5da088ec74fcaef75a6ad0bd88094ce605e620cf7ca00d28ea3875397b001f1b1b40f4aa146df18d88fe2120ed281c4bfb2aac54db
-
Filesize
72KB
MD5ba61cb442c0d1dc12cc62b8a7a33a3a9
SHA19aa2562cc11e908cfaff3fffd68b9a146af60947
SHA256bea9b4495c9cf040e76768e2a1ca26e9619a7aa06b345b994053014c0d8583c5
SHA512e3a64ab0ab11a5b0fb7363c85cf659e9e12cc55aa69bb8a96322f0797bd958a0e39b95c93da6b51c8d55cac7125f5e7f2322bae6a49438aacec291d95a4c8745
-
Filesize
72KB
MD5ba61cb442c0d1dc12cc62b8a7a33a3a9
SHA19aa2562cc11e908cfaff3fffd68b9a146af60947
SHA256bea9b4495c9cf040e76768e2a1ca26e9619a7aa06b345b994053014c0d8583c5
SHA512e3a64ab0ab11a5b0fb7363c85cf659e9e12cc55aa69bb8a96322f0797bd958a0e39b95c93da6b51c8d55cac7125f5e7f2322bae6a49438aacec291d95a4c8745
-
Filesize
72KB
MD5b1b18a6a16f4e80ce37f37c798146497
SHA11c0b0d9f6309be49ff43f9e3e7face9fb07522d0
SHA256912d3bddb59ab7f503a4533ce0cb149d25984e63d129e06c019aecc79940c7be
SHA5121290bbbde2987f348db04a5da088ec74fcaef75a6ad0bd88094ce605e620cf7ca00d28ea3875397b001f1b1b40f4aa146df18d88fe2120ed281c4bfb2aac54db
-
Filesize
72KB
MD5b1b18a6a16f4e80ce37f37c798146497
SHA11c0b0d9f6309be49ff43f9e3e7face9fb07522d0
SHA256912d3bddb59ab7f503a4533ce0cb149d25984e63d129e06c019aecc79940c7be
SHA5121290bbbde2987f348db04a5da088ec74fcaef75a6ad0bd88094ce605e620cf7ca00d28ea3875397b001f1b1b40f4aa146df18d88fe2120ed281c4bfb2aac54db
-
Filesize
72KB
MD5f857da6cc367b28f08fd4a8ec623376b
SHA1d065ac7a69ed8c3bbdec0631d679556de570fad5
SHA256ebd0953d2992b956ed23925e2893b6322ce7cb49c5a78612bb6d8e86359807b4
SHA512b50a4122831f5c0e68ca79df693bdb71eaf7991fbff26114fa775338f679fbcd5d637656cc10cfc545e55c987ed35ac6aab07c7d7eaaf82a3f40bff8e1ab878f
-
Filesize
72KB
MD5f857da6cc367b28f08fd4a8ec623376b
SHA1d065ac7a69ed8c3bbdec0631d679556de570fad5
SHA256ebd0953d2992b956ed23925e2893b6322ce7cb49c5a78612bb6d8e86359807b4
SHA512b50a4122831f5c0e68ca79df693bdb71eaf7991fbff26114fa775338f679fbcd5d637656cc10cfc545e55c987ed35ac6aab07c7d7eaaf82a3f40bff8e1ab878f
-
Filesize
72KB
MD5451116b5c518637b6bf44be65b9d3835
SHA19df30fc89c288e9f6094789b3fada5172c08e775
SHA256a8df0dbcf5aa659e62b0636d9ad50ef4c3547df68faa4eac55f0df7780459c00
SHA512c2282d4b23aa0796bcfbdc0867989db8e3dcfc978c9bb7c0f3e9014e665184185e291f78c20c82c5b02678f5e31006434a4e94bee44907a67d4c484eb4f8d6e7
-
Filesize
72KB
MD5451116b5c518637b6bf44be65b9d3835
SHA19df30fc89c288e9f6094789b3fada5172c08e775
SHA256a8df0dbcf5aa659e62b0636d9ad50ef4c3547df68faa4eac55f0df7780459c00
SHA512c2282d4b23aa0796bcfbdc0867989db8e3dcfc978c9bb7c0f3e9014e665184185e291f78c20c82c5b02678f5e31006434a4e94bee44907a67d4c484eb4f8d6e7
-
Filesize
72KB
MD5ba61cb442c0d1dc12cc62b8a7a33a3a9
SHA19aa2562cc11e908cfaff3fffd68b9a146af60947
SHA256bea9b4495c9cf040e76768e2a1ca26e9619a7aa06b345b994053014c0d8583c5
SHA512e3a64ab0ab11a5b0fb7363c85cf659e9e12cc55aa69bb8a96322f0797bd958a0e39b95c93da6b51c8d55cac7125f5e7f2322bae6a49438aacec291d95a4c8745
-
Filesize
72KB
MD5ba61cb442c0d1dc12cc62b8a7a33a3a9
SHA19aa2562cc11e908cfaff3fffd68b9a146af60947
SHA256bea9b4495c9cf040e76768e2a1ca26e9619a7aa06b345b994053014c0d8583c5
SHA512e3a64ab0ab11a5b0fb7363c85cf659e9e12cc55aa69bb8a96322f0797bd958a0e39b95c93da6b51c8d55cac7125f5e7f2322bae6a49438aacec291d95a4c8745
-
Filesize
72KB
MD524033e5514a5b2cd3738683b6459fd9f
SHA15e5ab5823e73d132f5a912b35296bd082f28cfa1
SHA256b66fa351c0be2975f407ca8facf5bf29c09cccf2c1e62e08e98543952d35bc1e
SHA51237a38a7fcdc96877547e735415eb71c13ba08d3efb82dd1514398ab38d53938440f1401233bf5e7a572f259277b7d460c86109af1a40cd376f7ff91a9c59206a
-
Filesize
72KB
MD524033e5514a5b2cd3738683b6459fd9f
SHA15e5ab5823e73d132f5a912b35296bd082f28cfa1
SHA256b66fa351c0be2975f407ca8facf5bf29c09cccf2c1e62e08e98543952d35bc1e
SHA51237a38a7fcdc96877547e735415eb71c13ba08d3efb82dd1514398ab38d53938440f1401233bf5e7a572f259277b7d460c86109af1a40cd376f7ff91a9c59206a
-
Filesize
72KB
MD56ecff3f7b88aec0fdbbb2b44b12fadc2
SHA1255b9e43fe13c6f7503a6e027656a3cc6712d623
SHA256bf751f29c6a1f91993bedb089c2d11826948eea6f8c7fe4fb8b5f6fc004bda57
SHA512a716591a07629f76289a0bfb8191d132bd9667cafe71a2dd05dc3f5c41055d86a21d88e631c4dec9f56eea50e192b6bc39e37941c7194a65c29a86c7afcb18c1
-
Filesize
72KB
MD56ecff3f7b88aec0fdbbb2b44b12fadc2
SHA1255b9e43fe13c6f7503a6e027656a3cc6712d623
SHA256bf751f29c6a1f91993bedb089c2d11826948eea6f8c7fe4fb8b5f6fc004bda57
SHA512a716591a07629f76289a0bfb8191d132bd9667cafe71a2dd05dc3f5c41055d86a21d88e631c4dec9f56eea50e192b6bc39e37941c7194a65c29a86c7afcb18c1
-
Filesize
72KB
MD56ecff3f7b88aec0fdbbb2b44b12fadc2
SHA1255b9e43fe13c6f7503a6e027656a3cc6712d623
SHA256bf751f29c6a1f91993bedb089c2d11826948eea6f8c7fe4fb8b5f6fc004bda57
SHA512a716591a07629f76289a0bfb8191d132bd9667cafe71a2dd05dc3f5c41055d86a21d88e631c4dec9f56eea50e192b6bc39e37941c7194a65c29a86c7afcb18c1
-
Filesize
72KB
MD56ecff3f7b88aec0fdbbb2b44b12fadc2
SHA1255b9e43fe13c6f7503a6e027656a3cc6712d623
SHA256bf751f29c6a1f91993bedb089c2d11826948eea6f8c7fe4fb8b5f6fc004bda57
SHA512a716591a07629f76289a0bfb8191d132bd9667cafe71a2dd05dc3f5c41055d86a21d88e631c4dec9f56eea50e192b6bc39e37941c7194a65c29a86c7afcb18c1
-
Filesize
72KB
MD5e9ca8cc7c7a0b38030a2a1752dd41566
SHA1f0ae4892db691bf3ff8abfbebb9bf73edb9390d2
SHA25665bd28df62f63933f92bd731894ddf6342129292f32b061ec05151ddbefd8373
SHA5127cab2b36ffa68829c36fb2177a69a244fc25a6a749f68777ff4114b274a50263dbdef6ba59a160a9cc2cffd01fb6ae7224c8c9c47748e283098941a307bee4bf
-
Filesize
72KB
MD5e9ca8cc7c7a0b38030a2a1752dd41566
SHA1f0ae4892db691bf3ff8abfbebb9bf73edb9390d2
SHA25665bd28df62f63933f92bd731894ddf6342129292f32b061ec05151ddbefd8373
SHA5127cab2b36ffa68829c36fb2177a69a244fc25a6a749f68777ff4114b274a50263dbdef6ba59a160a9cc2cffd01fb6ae7224c8c9c47748e283098941a307bee4bf
-
Filesize
72KB
MD5b1b18a6a16f4e80ce37f37c798146497
SHA11c0b0d9f6309be49ff43f9e3e7face9fb07522d0
SHA256912d3bddb59ab7f503a4533ce0cb149d25984e63d129e06c019aecc79940c7be
SHA5121290bbbde2987f348db04a5da088ec74fcaef75a6ad0bd88094ce605e620cf7ca00d28ea3875397b001f1b1b40f4aa146df18d88fe2120ed281c4bfb2aac54db
-
Filesize
72KB
MD5b1b18a6a16f4e80ce37f37c798146497
SHA11c0b0d9f6309be49ff43f9e3e7face9fb07522d0
SHA256912d3bddb59ab7f503a4533ce0cb149d25984e63d129e06c019aecc79940c7be
SHA5121290bbbde2987f348db04a5da088ec74fcaef75a6ad0bd88094ce605e620cf7ca00d28ea3875397b001f1b1b40f4aa146df18d88fe2120ed281c4bfb2aac54db
-
Filesize
72KB
MD5482384d07094ab54ae7da217ac95ae49
SHA11ebf43e166096b1348a4fa1fd0ff9aa7d9137970
SHA256d33a705cf007c7793ae14460828f484b8b3f4a72916fe52845b053f497d07aa4
SHA512dd1906246667360be33d5d28b6f9b133d8d2ad321eeddaa2326e415137a3e1edc1a20279a24033456ccbfe85d367336755048f9af3702cac61d937592b1b3fbd
-
Filesize
72KB
MD5482384d07094ab54ae7da217ac95ae49
SHA11ebf43e166096b1348a4fa1fd0ff9aa7d9137970
SHA256d33a705cf007c7793ae14460828f484b8b3f4a72916fe52845b053f497d07aa4
SHA512dd1906246667360be33d5d28b6f9b133d8d2ad321eeddaa2326e415137a3e1edc1a20279a24033456ccbfe85d367336755048f9af3702cac61d937592b1b3fbd
-
Filesize
72KB
MD524033e5514a5b2cd3738683b6459fd9f
SHA15e5ab5823e73d132f5a912b35296bd082f28cfa1
SHA256b66fa351c0be2975f407ca8facf5bf29c09cccf2c1e62e08e98543952d35bc1e
SHA51237a38a7fcdc96877547e735415eb71c13ba08d3efb82dd1514398ab38d53938440f1401233bf5e7a572f259277b7d460c86109af1a40cd376f7ff91a9c59206a
-
Filesize
72KB
MD524033e5514a5b2cd3738683b6459fd9f
SHA15e5ab5823e73d132f5a912b35296bd082f28cfa1
SHA256b66fa351c0be2975f407ca8facf5bf29c09cccf2c1e62e08e98543952d35bc1e
SHA51237a38a7fcdc96877547e735415eb71c13ba08d3efb82dd1514398ab38d53938440f1401233bf5e7a572f259277b7d460c86109af1a40cd376f7ff91a9c59206a
-
Filesize
72KB
MD52b0826a2dc54e6cbada4d8f92207b3dd
SHA19ae88ad1f283fcff53ed91423f0879a5a20408c1
SHA256724c88b8d2fb331c86daaf5605f2384693144743eb650144291bac2182d41814
SHA5129381cd3c8a9e65bd5d56495619ae0228df5c16e65df71a1e887cc9f596808b92d990e141261c04293e34874655993d65e46e79cc30ab3c19e27c35c67af5d1fb
-
Filesize
72KB
MD52b0826a2dc54e6cbada4d8f92207b3dd
SHA19ae88ad1f283fcff53ed91423f0879a5a20408c1
SHA256724c88b8d2fb331c86daaf5605f2384693144743eb650144291bac2182d41814
SHA5129381cd3c8a9e65bd5d56495619ae0228df5c16e65df71a1e887cc9f596808b92d990e141261c04293e34874655993d65e46e79cc30ab3c19e27c35c67af5d1fb
-
Filesize
72KB
MD52b0826a2dc54e6cbada4d8f92207b3dd
SHA19ae88ad1f283fcff53ed91423f0879a5a20408c1
SHA256724c88b8d2fb331c86daaf5605f2384693144743eb650144291bac2182d41814
SHA5129381cd3c8a9e65bd5d56495619ae0228df5c16e65df71a1e887cc9f596808b92d990e141261c04293e34874655993d65e46e79cc30ab3c19e27c35c67af5d1fb
-
Filesize
72KB
MD52b0826a2dc54e6cbada4d8f92207b3dd
SHA19ae88ad1f283fcff53ed91423f0879a5a20408c1
SHA256724c88b8d2fb331c86daaf5605f2384693144743eb650144291bac2182d41814
SHA5129381cd3c8a9e65bd5d56495619ae0228df5c16e65df71a1e887cc9f596808b92d990e141261c04293e34874655993d65e46e79cc30ab3c19e27c35c67af5d1fb
-
Filesize
72KB
MD56c28961a1274bd25703074462bccc15b
SHA1bc7153f23a3248cc2e94e9c8b684989c9c45ea7d
SHA256973660a3a1e933654f1af4ee8c56da329aea9311e4e228a70830040bc8117ab8
SHA5128e999b1255337ec57e1f43adec21ab79abeace9d4bf2f84eaa1b8673d7ac933347c52af866e726e2ed1aad9bc215c1a6b9b6f7169b1a88f6d6e51e110e9fc051
-
Filesize
72KB
MD56c28961a1274bd25703074462bccc15b
SHA1bc7153f23a3248cc2e94e9c8b684989c9c45ea7d
SHA256973660a3a1e933654f1af4ee8c56da329aea9311e4e228a70830040bc8117ab8
SHA5128e999b1255337ec57e1f43adec21ab79abeace9d4bf2f84eaa1b8673d7ac933347c52af866e726e2ed1aad9bc215c1a6b9b6f7169b1a88f6d6e51e110e9fc051
-
Filesize
72KB
MD57bd7494466ad4f15bf0aa1494666921a
SHA1d83e2ccc2f0a9cf65b9c7dcf78680935b5385491
SHA2563593815f162e25a74673a6d94b18a234f0fb9c879f08b6f5d66931de5fd8a71a
SHA512f73ab5ce78d7a0acee89dfa3bee6fcf8b722e1eb8d8dcd75cb9db794856e2c580537726570b7079ddd97e599f41e75c80bacb9a5f4e99ba3b8202349ef62cbe9
-
Filesize
72KB
MD54264b9bc01be87029e79d5c5fa7180fa
SHA1e2a2e48f66dfbb5072eb1be4a1d525fb63e2b3e4
SHA256b02170cdd2211e407eb718a84b9ac881df4cf0f3ebedf6b1577668acb80f6836
SHA5125a582e425dd29f486664c5d2773522426ffc339ef5157760a70b1904d102f3fabadc48a1b3d0f412928c0b5cb4217ebf91109448f582e4103ffc07df6afc7fe7
-
Filesize
72KB
MD5dd94aa27b70e223061a1b52a7b5a28e4
SHA164ccad1bab0ea3dae483218ae9295e4d68fbd462
SHA2566be439a261c0943da5a5f5ef1e990824ce910a5eedb5bc195549023fb6d81e43
SHA51239cc3f10d0728c306614acdbdc5b76cfd226dbfda9278928dc4bfd8fe61a6aa08aa964aaffd85486a04b73d2e36ab53b5181225ef6e1375664ee7c1aceef881e
-
Filesize
72KB
MD5dd94aa27b70e223061a1b52a7b5a28e4
SHA164ccad1bab0ea3dae483218ae9295e4d68fbd462
SHA2566be439a261c0943da5a5f5ef1e990824ce910a5eedb5bc195549023fb6d81e43
SHA51239cc3f10d0728c306614acdbdc5b76cfd226dbfda9278928dc4bfd8fe61a6aa08aa964aaffd85486a04b73d2e36ab53b5181225ef6e1375664ee7c1aceef881e
-
Filesize
72KB
MD5319af7764f8d5854335013663439d64f
SHA17f8e4d493083a5594d943fb44bfce51cd0b25acf
SHA2563b205cfbef971e279ad634220a64b6d5135223457908c782724c9222eda7762e
SHA512c876b55402e70e0bd41e6121b120205c442f8bb5f5ceec0b6f5343d1d683aa134d60e3c1e1b527def791d7d8418a6261dae07a835ab99b8ca09e635c4e13f92c
-
Filesize
72KB
MD5319af7764f8d5854335013663439d64f
SHA17f8e4d493083a5594d943fb44bfce51cd0b25acf
SHA2563b205cfbef971e279ad634220a64b6d5135223457908c782724c9222eda7762e
SHA512c876b55402e70e0bd41e6121b120205c442f8bb5f5ceec0b6f5343d1d683aa134d60e3c1e1b527def791d7d8418a6261dae07a835ab99b8ca09e635c4e13f92c
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a99452d3440d757ee8d7e876885e44b0
SHA12a348661c9d7d2da24bdc6e700b1ba88bb33f301
SHA2562817eb12949d4877433f21d9486d3c1757bbc67cbbf1a9d13e8a80a2740acaeb
SHA512f56495135b77fa14eadf49976eaa1ecffb0c6b6c35af0d92131ea1b3190f6f54df0cf6b1c403a4d72755924f2259af05e434cb795b38d85c6fc177498580e68e
-
Filesize
72KB
MD5a99452d3440d757ee8d7e876885e44b0
SHA12a348661c9d7d2da24bdc6e700b1ba88bb33f301
SHA2562817eb12949d4877433f21d9486d3c1757bbc67cbbf1a9d13e8a80a2740acaeb
SHA512f56495135b77fa14eadf49976eaa1ecffb0c6b6c35af0d92131ea1b3190f6f54df0cf6b1c403a4d72755924f2259af05e434cb795b38d85c6fc177498580e68e
-
Filesize
72KB
MD5a99452d3440d757ee8d7e876885e44b0
SHA12a348661c9d7d2da24bdc6e700b1ba88bb33f301
SHA2562817eb12949d4877433f21d9486d3c1757bbc67cbbf1a9d13e8a80a2740acaeb
SHA512f56495135b77fa14eadf49976eaa1ecffb0c6b6c35af0d92131ea1b3190f6f54df0cf6b1c403a4d72755924f2259af05e434cb795b38d85c6fc177498580e68e
-
Filesize
72KB
MD5a99452d3440d757ee8d7e876885e44b0
SHA12a348661c9d7d2da24bdc6e700b1ba88bb33f301
SHA2562817eb12949d4877433f21d9486d3c1757bbc67cbbf1a9d13e8a80a2740acaeb
SHA512f56495135b77fa14eadf49976eaa1ecffb0c6b6c35af0d92131ea1b3190f6f54df0cf6b1c403a4d72755924f2259af05e434cb795b38d85c6fc177498580e68e
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a38139ace84c30bf60ffe8771e08251f
SHA113f88842d0fc25812acb639b96c5b731f20f43f9
SHA2560c1e3dd98cec74239dd4b2c7f011b6e52408aa81741f276b658ee512713eada4
SHA5123b185be1f07f4d138d59ae6bf1bf5892eaa5444649c2ea065285e30654b6b66c300c41c6bc5f85c40751a9497a201b2e6332e21fb36f855a3cb3fda8ab4e07ee
-
Filesize
72KB
MD5a99452d3440d757ee8d7e876885e44b0
SHA12a348661c9d7d2da24bdc6e700b1ba88bb33f301
SHA2562817eb12949d4877433f21d9486d3c1757bbc67cbbf1a9d13e8a80a2740acaeb
SHA512f56495135b77fa14eadf49976eaa1ecffb0c6b6c35af0d92131ea1b3190f6f54df0cf6b1c403a4d72755924f2259af05e434cb795b38d85c6fc177498580e68e
-
Filesize
72KB
MD5a99452d3440d757ee8d7e876885e44b0
SHA12a348661c9d7d2da24bdc6e700b1ba88bb33f301
SHA2562817eb12949d4877433f21d9486d3c1757bbc67cbbf1a9d13e8a80a2740acaeb
SHA512f56495135b77fa14eadf49976eaa1ecffb0c6b6c35af0d92131ea1b3190f6f54df0cf6b1c403a4d72755924f2259af05e434cb795b38d85c6fc177498580e68e
-
Filesize
72KB
MD567c31b9d9322e14a25d23f77c1ed011c
SHA1eb350332a75fa00d6b1d23de867356b2a6f017cd
SHA25668a77ae7e9bd6c5fc628241f55bde1cb2e702dd6c76abfdb22418d9b6e02b571
SHA512039e6ca8badcfd7d30dc099a3ce0362fb902b72e1cfeb978929ee2399bf147a44b2c02d95b43e79584afacb014c2bf196e25345cf9ec986a5128d7116211aa4a
-
Filesize
72KB
MD567c31b9d9322e14a25d23f77c1ed011c
SHA1eb350332a75fa00d6b1d23de867356b2a6f017cd
SHA25668a77ae7e9bd6c5fc628241f55bde1cb2e702dd6c76abfdb22418d9b6e02b571
SHA512039e6ca8badcfd7d30dc099a3ce0362fb902b72e1cfeb978929ee2399bf147a44b2c02d95b43e79584afacb014c2bf196e25345cf9ec986a5128d7116211aa4a
-
Filesize
72KB
MD5adcd1a2f9379ebf91ae743343458efd3
SHA1a8cd41d33c0c6e80997f7eb1bb2dab0855ded066
SHA25698fd7afdc6447ffdb6f105480bcb3666cd10fabb6999056cfd29c85d2e824316
SHA512ee7bb6b70ae5d090a2eeacafcc9ca799416e20bdf7b2d2dd3a674d2f06f4678f516202252df611b2698794a09264fff0e3c43eb239a6952ae50b12a763375663
-
Filesize
72KB
MD5adcd1a2f9379ebf91ae743343458efd3
SHA1a8cd41d33c0c6e80997f7eb1bb2dab0855ded066
SHA25698fd7afdc6447ffdb6f105480bcb3666cd10fabb6999056cfd29c85d2e824316
SHA512ee7bb6b70ae5d090a2eeacafcc9ca799416e20bdf7b2d2dd3a674d2f06f4678f516202252df611b2698794a09264fff0e3c43eb239a6952ae50b12a763375663
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-