Overview

overview

10

Static

static

137f9afb7c...6a.exe

windows7-x64

10

137f9afb7c...6a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    292s
  • max time network
    306s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 19:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    137f9afb7c09609e32c18363b00b75f90a487459085d3f11278c2bb4e449356a.exe

  • Size

    72KB

  • MD5

    0421fbc0f8a0300be84fb333973beab4

  • SHA1

    e93d415ed8348176ed8858687e2f6fbb530445a9

  • SHA256

    137f9afb7c09609e32c18363b00b75f90a487459085d3f11278c2bb4e449356a

  • SHA512

    365c58ad4bba4bc1cf08ffb2f377c228c0dc8127e79bc27053b94ecc7fe190d3bb5dd64eb60a6b533ef9c805c17a5e4eaeb8aecfd18768ed4e0bec36a233358b

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2n:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPz

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\137f9afb7c09609e32c18363b00b75f90a487459085d3f11278c2bb4e449356a.exe
    "C:\Users\Admin\AppData\Local\Temp\137f9afb7c09609e32c18363b00b75f90a487459085d3f11278c2bb4e449356a.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Local\Temp\671391889\backup.exe
      C:\Users\Admin\AppData\Local\Temp\671391889\backup.exe C:\Users\Admin\AppData\Local\Temp\671391889\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:676
      • C:\data.exe
        \data.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2336
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1908
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1020
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1736
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3524
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2316
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1420
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1292
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4652
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:3812
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1336
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2268
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3784
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4972
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:736
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4532
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1272
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2372
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2688
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:2116
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:4864
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                    PID:4320
                • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4948
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                    8⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4964
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:820
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:332
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                    8⤵
                      PID:2572
                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    PID:5036
                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                      8⤵
                      • Disables RegEdit via registry modification
                      PID:4584
                  • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:2332
                  • C:\Program Files\Common Files\microsoft shared\Source Engine\update.exe
                    "C:\Program Files\Common Files\microsoft shared\Source Engine\update.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:1040
                  • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                    7⤵
                      PID:1200
                  • C:\Program Files\Common Files\Services\backup.exe
                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                    6⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4284
                  • C:\Program Files\Common Files\System\backup.exe
                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                    6⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2260
                    • C:\Program Files\Common Files\System\ado\backup.exe
                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                      7⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of SetWindowsHookEx
                      PID:4244
                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:4044
                      • C:\Program Files\Common Files\System\ado\en-US\update.exe
                        "C:\Program Files\Common Files\System\ado\en-US\update.exe" C:\Program Files\Common Files\System\ado\en-US\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        PID:4656
                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:4720
                      • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                        8⤵
                          PID:2920
                  • C:\Program Files\Google\backup.exe
                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                    5⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    PID:1572
                    • C:\Program Files\Google\Chrome\backup.exe
                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                      6⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:1832
                      • C:\Program Files\Google\Chrome\Application\backup.exe
                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Drops file in Program Files directory
                        • System policy modification
                        PID:3468
                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Drops file in Program Files directory
                          • System policy modification
                          PID:3448
                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                            9⤵
                              PID:1904
                    • C:\Program Files\Internet Explorer\backup.exe
                      "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                      5⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of SetWindowsHookEx
                      PID:4824
                      • C:\Program Files\Internet Explorer\de-DE\backup.exe
                        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:4232
                      • C:\Program Files\Internet Explorer\en-US\System Restore.exe
                        "C:\Program Files\Internet Explorer\en-US\System Restore.exe" C:\Program Files\Internet Explorer\en-US\
                        6⤵
                        • Modifies visibility of file extensions in Explorer
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2944
                      • C:\Program Files\Internet Explorer\es-ES\backup.exe
                        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                        6⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:5076
                      • C:\Program Files\Internet Explorer\fr-FR\System Restore.exe
                        "C:\Program Files\Internet Explorer\fr-FR\System Restore.exe" C:\Program Files\Internet Explorer\fr-FR\
                        6⤵
                          PID:2404
                        • C:\Program Files\Internet Explorer\images\backup.exe
                          "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                          6⤵
                            PID:2088
                      • C:\Program Files (x86)\backup.exe
                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                        4⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:1104
                        • C:\Program Files (x86)\Adobe\backup.exe
                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:5028
                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                            6⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:3484
                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:5044
                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                              7⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:3004
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4032
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                  9⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:4940
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:4412
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                  9⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3268
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:980
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:2336
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4920
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                  9⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System policy modification
                                  PID:524
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\update.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4372
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                  9⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:3104
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • System policy modification
                                PID:4812
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Drops file in Program Files directory
                                • System policy modification
                                PID:2584
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                  9⤵
                                  • System policy modification
                                  PID:3564
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\data.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                8⤵
                                  PID:4564
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:4312
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:2268
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                    9⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:2680
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:1908
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                  8⤵
                                    PID:2120
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1284
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3224
                            • C:\Program Files (x86)\Common Files\System Restore.exe
                              "C:\Program Files (x86)\Common Files\System Restore.exe" C:\Program Files (x86)\Common Files\
                              5⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              PID:1444
                              • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:408
                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                  7⤵
                                  • Drops file in Program Files directory
                                  PID:4324
                                • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  PID:2996
                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                    8⤵
                                      PID:4980
                              • C:\Program Files (x86)\Google\System Restore.exe
                                "C:\Program Files (x86)\Google\System Restore.exe" C:\Program Files (x86)\Google\
                                5⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:1304
                                • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                  6⤵
                                  • Executes dropped EXE
                                  • System policy modification
                                  PID:3380
                                • C:\Program Files (x86)\Google\Policies\backup.exe
                                  "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • System policy modification
                                  PID:4172
                                • C:\Program Files (x86)\Google\Temp\backup.exe
                                  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:5104
                                • C:\Program Files (x86)\Google\Update\backup.exe
                                  "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Drops file in Program Files directory
                                  PID:3188
                                  • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                    "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                    7⤵
                                      PID:4220
                              • C:\Users\backup.exe
                                C:\Users\backup.exe C:\Users\
                                4⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1648
                                • C:\Users\Admin\backup.exe
                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                  5⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4876
                                  • C:\Users\Admin\3D Objects\backup.exe
                                    "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                    6⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3028
                                  • C:\Users\Admin\Contacts\backup.exe
                                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:2056
                                  • C:\Users\Admin\Desktop\backup.exe
                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                    6⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:444
                                  • C:\Users\Admin\Documents\backup.exe
                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:2208
                                  • C:\Users\Admin\Downloads\backup.exe
                                    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                    6⤵
                                      PID:2320
                                • C:\Windows\backup.exe
                                  C:\Windows\backup.exe C:\Windows\
                                  4⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2328
                                  • C:\Windows\addins\backup.exe
                                    C:\Windows\addins\backup.exe C:\Windows\addins\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4840
                                  • C:\Windows\appcompat\update.exe
                                    C:\Windows\appcompat\update.exe C:\Windows\appcompat\
                                    5⤵
                                    • Disables RegEdit via registry modification
                                    • Drops file in Windows directory
                                    PID:4888
                                    • C:\Windows\appcompat\appraiser\backup.exe
                                      C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                      6⤵
                                      • Disables RegEdit via registry modification
                                      • Drops file in Windows directory
                                      PID:748
                                      • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                        C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                        7⤵
                                          PID:5080
                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1136
                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                2⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:2508
                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3500
                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                2⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:2732
                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                2⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4944
                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                2⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1824

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\PerfLogs\backup.exe
                              Filesize

                              72KB

                              MD5

                              b3730a5e2bc43b70fd69d9e8aa340676

                              SHA1

                              0b31cb4799c821aa152cd0b388493b406080c158

                              SHA256

                              5b743ff656a6234348380f00c0006fb8a5e3b8d3d1427b79fc158a391e0d2aff

                              SHA512

                              26d02cf6c1481afeafebaa161cff9cbcfac63f4c5c8038394b264f401988947b0c62d314eb538d678e7259384c365047d15116c59a08663694baaaab903a7282

                              Download Submit

                            • C:\PerfLogs\backup.exe
                              Filesize

                              72KB

                              MD5

                              b3730a5e2bc43b70fd69d9e8aa340676

                              SHA1

                              0b31cb4799c821aa152cd0b388493b406080c158

                              SHA256

                              5b743ff656a6234348380f00c0006fb8a5e3b8d3d1427b79fc158a391e0d2aff

                              SHA512

                              26d02cf6c1481afeafebaa161cff9cbcfac63f4c5c8038394b264f401988947b0c62d314eb538d678e7259384c365047d15116c59a08663694baaaab903a7282

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                              Filesize

                              72KB

                              MD5

                              2f8a7790acf04d603d1b81ccfbb3ddaf

                              SHA1

                              85d5d5f51a3a8ee76b8fae49fe570a49a97e57ac

                              SHA256

                              fbafe210ec517343db59c00ed8724f5b91f5a6f10851b34984901ea5d5bd7492

                              SHA512

                              0c667727bb4e63dce2ab96ce5e36f169a44ad28e45fded755ca1c98afe406db35fee5b9b402b75e8b3bd339a2a9e737ecbf7c9254eef190945cca4f61c0817ed

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                              Filesize

                              72KB

                              MD5

                              2f8a7790acf04d603d1b81ccfbb3ddaf

                              SHA1

                              85d5d5f51a3a8ee76b8fae49fe570a49a97e57ac

                              SHA256

                              fbafe210ec517343db59c00ed8724f5b91f5a6f10851b34984901ea5d5bd7492

                              SHA512

                              0c667727bb4e63dce2ab96ce5e36f169a44ad28e45fded755ca1c98afe406db35fee5b9b402b75e8b3bd339a2a9e737ecbf7c9254eef190945cca4f61c0817ed

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                              Filesize

                              72KB

                              MD5

                              80ee3a974dd57df030fcb67725eb0b5f

                              SHA1

                              50a19a756b221bc53b174c2e3581a7634f2273f1

                              SHA256

                              3983b4ec0cfac5fff4e7969e9ca1358373797f3a0e16d8033568bf1be7b784cd

                              SHA512

                              1826bb9712bbd32c221caa1f2a767f7cc3ac0bfb689fc524e97008795eabf83b0a0a20fd83f69e6a87fe282d15dff73437d4b51b5590db8c14b5273bd408b11b

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                              Filesize

                              72KB

                              MD5

                              80ee3a974dd57df030fcb67725eb0b5f

                              SHA1

                              50a19a756b221bc53b174c2e3581a7634f2273f1

                              SHA256

                              3983b4ec0cfac5fff4e7969e9ca1358373797f3a0e16d8033568bf1be7b784cd

                              SHA512

                              1826bb9712bbd32c221caa1f2a767f7cc3ac0bfb689fc524e97008795eabf83b0a0a20fd83f69e6a87fe282d15dff73437d4b51b5590db8c14b5273bd408b11b

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                              Filesize

                              72KB

                              MD5

                              9b984ad249fe8778c82911a555cac74c

                              SHA1

                              aa1bd2120a6a33b92bee0f206842e3b792af64a1

                              SHA256

                              16b4d626352bbf83d3a8753a26c6f3faec92e53545eabe1b5f8b92473892b2d0

                              SHA512

                              db660993632e420cfad22d7e401b94998c1763d68d0a11b594fca7a96ece555eee617d4be2f0e7094e71463d6cb7ad38d56363eb65a259156b8926846e9c4343

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                              Filesize

                              72KB

                              MD5

                              9b984ad249fe8778c82911a555cac74c

                              SHA1

                              aa1bd2120a6a33b92bee0f206842e3b792af64a1

                              SHA256

                              16b4d626352bbf83d3a8753a26c6f3faec92e53545eabe1b5f8b92473892b2d0

                              SHA512

                              db660993632e420cfad22d7e401b94998c1763d68d0a11b594fca7a96ece555eee617d4be2f0e7094e71463d6cb7ad38d56363eb65a259156b8926846e9c4343

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                              Filesize

                              72KB

                              MD5

                              9b984ad249fe8778c82911a555cac74c

                              SHA1

                              aa1bd2120a6a33b92bee0f206842e3b792af64a1

                              SHA256

                              16b4d626352bbf83d3a8753a26c6f3faec92e53545eabe1b5f8b92473892b2d0

                              SHA512

                              db660993632e420cfad22d7e401b94998c1763d68d0a11b594fca7a96ece555eee617d4be2f0e7094e71463d6cb7ad38d56363eb65a259156b8926846e9c4343

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                              Filesize

                              72KB

                              MD5

                              9b984ad249fe8778c82911a555cac74c

                              SHA1

                              aa1bd2120a6a33b92bee0f206842e3b792af64a1

                              SHA256

                              16b4d626352bbf83d3a8753a26c6f3faec92e53545eabe1b5f8b92473892b2d0

                              SHA512

                              db660993632e420cfad22d7e401b94998c1763d68d0a11b594fca7a96ece555eee617d4be2f0e7094e71463d6cb7ad38d56363eb65a259156b8926846e9c4343

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                              Filesize

                              72KB

                              MD5

                              80ee3a974dd57df030fcb67725eb0b5f

                              SHA1

                              50a19a756b221bc53b174c2e3581a7634f2273f1

                              SHA256

                              3983b4ec0cfac5fff4e7969e9ca1358373797f3a0e16d8033568bf1be7b784cd

                              SHA512

                              1826bb9712bbd32c221caa1f2a767f7cc3ac0bfb689fc524e97008795eabf83b0a0a20fd83f69e6a87fe282d15dff73437d4b51b5590db8c14b5273bd408b11b

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                              Filesize

                              72KB

                              MD5

                              80ee3a974dd57df030fcb67725eb0b5f

                              SHA1

                              50a19a756b221bc53b174c2e3581a7634f2273f1

                              SHA256

                              3983b4ec0cfac5fff4e7969e9ca1358373797f3a0e16d8033568bf1be7b784cd

                              SHA512

                              1826bb9712bbd32c221caa1f2a767f7cc3ac0bfb689fc524e97008795eabf83b0a0a20fd83f69e6a87fe282d15dff73437d4b51b5590db8c14b5273bd408b11b

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                              Filesize

                              72KB

                              MD5

                              2f8a7790acf04d603d1b81ccfbb3ddaf

                              SHA1

                              85d5d5f51a3a8ee76b8fae49fe570a49a97e57ac

                              SHA256

                              fbafe210ec517343db59c00ed8724f5b91f5a6f10851b34984901ea5d5bd7492

                              SHA512

                              0c667727bb4e63dce2ab96ce5e36f169a44ad28e45fded755ca1c98afe406db35fee5b9b402b75e8b3bd339a2a9e737ecbf7c9254eef190945cca4f61c0817ed

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                              Filesize

                              72KB

                              MD5

                              2f8a7790acf04d603d1b81ccfbb3ddaf

                              SHA1

                              85d5d5f51a3a8ee76b8fae49fe570a49a97e57ac

                              SHA256

                              fbafe210ec517343db59c00ed8724f5b91f5a6f10851b34984901ea5d5bd7492

                              SHA512

                              0c667727bb4e63dce2ab96ce5e36f169a44ad28e45fded755ca1c98afe406db35fee5b9b402b75e8b3bd339a2a9e737ecbf7c9254eef190945cca4f61c0817ed

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                              Filesize

                              72KB

                              MD5

                              1fe53d36161ee777a4729d4255b5a12c

                              SHA1

                              76d758ef116addef5abb78deeae0b0d01127e1e7

                              SHA256

                              6a84e7a55900af06786b5e3f3deaeede928ed15b3038cb120d67d0900f5c5342

                              SHA512

                              ed22fe5ec5947ee860047f5c34365a5dcadebd211167ea144de8e6878c25186cd97594e840b3fc34613406fb701978982c1cb3e67e465566673c0e42c7e7ccfa

                              Download Submit

                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                              Filesize

                              72KB

                              MD5

                              1fe53d36161ee777a4729d4255b5a12c

                              SHA1

                              76d758ef116addef5abb78deeae0b0d01127e1e7

                              SHA256

                              6a84e7a55900af06786b5e3f3deaeede928ed15b3038cb120d67d0900f5c5342

                              SHA512

                              ed22fe5ec5947ee860047f5c34365a5dcadebd211167ea144de8e6878c25186cd97594e840b3fc34613406fb701978982c1cb3e67e465566673c0e42c7e7ccfa

                              Download Submit

                            • C:\Program Files (x86)\Adobe\backup.exe
                              Filesize

                              72KB

                              MD5

                              d9602329e3b4c6195fc9099e51836cb6

                              SHA1

                              cf6c473f7842408078de3492121655b42aa1b729

                              SHA256

                              bdbebc2c0c5c91fc4e4165e88d512745ac98e18a736af28d73a77368c986cd5a

                              SHA512

                              4980fbeb7198bf284e952c9034757ce7687a619fbaf75fa2ca9e7abcd17cf5eaa4f6a971d941aa7cf250c501f889feabc7afc81c9e93f7f51f02c85e33eddf8f

                              Download Submit

                            • C:\Program Files (x86)\Adobe\backup.exe
                              Filesize

                              72KB

                              MD5

                              d9602329e3b4c6195fc9099e51836cb6

                              SHA1

                              cf6c473f7842408078de3492121655b42aa1b729

                              SHA256

                              bdbebc2c0c5c91fc4e4165e88d512745ac98e18a736af28d73a77368c986cd5a

                              SHA512

                              4980fbeb7198bf284e952c9034757ce7687a619fbaf75fa2ca9e7abcd17cf5eaa4f6a971d941aa7cf250c501f889feabc7afc81c9e93f7f51f02c85e33eddf8f

                              Download Submit

                            • C:\Program Files (x86)\backup.exe
                              Filesize

                              72KB

                              MD5

                              7dc5fb5d6ebb91302e910f80e22bab90

                              SHA1

                              6096ed3f13acd77fc7f77486b9fde7eb5f88e6a8

                              SHA256

                              1d3155450a86f8f432d87ef7669e7344a46cab80bab68270c2e848ea25b8d609

                              SHA512

                              1946dac9a70dc4ecbe3418ec43a681e6e68fadf859b6590db645ad031e7e21a6c8cc3e2740f0e6d0d987e78993ec94c254799807419cc82cc36b07ac95929a67

                              Download Submit

                            • C:\Program Files (x86)\backup.exe
                              Filesize

                              72KB

                              MD5

                              7dc5fb5d6ebb91302e910f80e22bab90

                              SHA1

                              6096ed3f13acd77fc7f77486b9fde7eb5f88e6a8

                              SHA256

                              1d3155450a86f8f432d87ef7669e7344a46cab80bab68270c2e848ea25b8d609

                              SHA512

                              1946dac9a70dc4ecbe3418ec43a681e6e68fadf859b6590db645ad031e7e21a6c8cc3e2740f0e6d0d987e78993ec94c254799807419cc82cc36b07ac95929a67

                              Download Submit

                            • C:\Program Files\7-Zip\Lang\backup.exe
                              Filesize

                              72KB

                              MD5

                              c8ab6710861d5bb1e56b8057aeb79f7e

                              SHA1

                              db6a5ba1cec59510964ff7cb465a19b3a3b90ada

                              SHA256

                              3f5e31e05e8cb51e228da38d66b0032b724342fefb7122215d80041c971ee52f

                              SHA512

                              aacda79cdb2a97b43837d944253131cf2028dc4dc81fc8951a743c9990ad3b5d006f7279161d62e49e9ea4c0c890f9563d07b04a304b6245933aef701c76f9c5

                              Download Submit

                            • C:\Program Files\7-Zip\Lang\backup.exe
                              Filesize

                              72KB

                              MD5

                              c8ab6710861d5bb1e56b8057aeb79f7e

                              SHA1

                              db6a5ba1cec59510964ff7cb465a19b3a3b90ada

                              SHA256

                              3f5e31e05e8cb51e228da38d66b0032b724342fefb7122215d80041c971ee52f

                              SHA512

                              aacda79cdb2a97b43837d944253131cf2028dc4dc81fc8951a743c9990ad3b5d006f7279161d62e49e9ea4c0c890f9563d07b04a304b6245933aef701c76f9c5

                              Download Submit

                            • C:\Program Files\7-Zip\backup.exe
                              Filesize

                              72KB

                              MD5

                              e987eeb42ee1f9be85c864e816fc3a39

                              SHA1

                              9f0cff41990aa8a266c78e88a3dfc945f935f1df

                              SHA256

                              5ea9dea2434a131c8a46b840f97e200b79b001653303a15fefeaba853762feef

                              SHA512

                              f6c0214c7654cb8d22b86a11d2f7a8bed445150efc2a2a48145055b98dc6fe99425889062e78e38a92afced4201c73034952399d54c604ec650f9708d353f229

                              Download Submit

                            • C:\Program Files\7-Zip\backup.exe
                              Filesize

                              72KB

                              MD5

                              e987eeb42ee1f9be85c864e816fc3a39

                              SHA1

                              9f0cff41990aa8a266c78e88a3dfc945f935f1df

                              SHA256

                              5ea9dea2434a131c8a46b840f97e200b79b001653303a15fefeaba853762feef

                              SHA512

                              f6c0214c7654cb8d22b86a11d2f7a8bed445150efc2a2a48145055b98dc6fe99425889062e78e38a92afced4201c73034952399d54c604ec650f9708d353f229

                              Download Submit

                            • C:\Program Files\Common Files\DESIGNER\backup.exe
                              Filesize

                              72KB

                              MD5

                              8f1d708724789e9e384bf9b318ae9ef1

                              SHA1

                              09e6fe4e36d078dac45786c279c51e822f3f200b

                              SHA256

                              6acda1eeef106c7c1734d2e5bb76e55893ccd5657cd3f26dbb342453ba4e322f

                              SHA512

                              51b65fbc3f3b540bf3130229ee3cd8df12baf64797209f986b608748782ccae52767147336225eb9c789a716590042e08813445acafd03d919186322bfab575f

                              Download Submit

                            • C:\Program Files\Common Files\DESIGNER\backup.exe
                              Filesize

                              72KB

                              MD5

                              8f1d708724789e9e384bf9b318ae9ef1

                              SHA1

                              09e6fe4e36d078dac45786c279c51e822f3f200b

                              SHA256

                              6acda1eeef106c7c1734d2e5bb76e55893ccd5657cd3f26dbb342453ba4e322f

                              SHA512

                              51b65fbc3f3b540bf3130229ee3cd8df12baf64797209f986b608748782ccae52767147336225eb9c789a716590042e08813445acafd03d919186322bfab575f

                              Download Submit

                            • C:\Program Files\Common Files\backup.exe
                              Filesize

                              72KB

                              MD5

                              d6267ac85487fa54b67bd834e9cabf32

                              SHA1

                              121d1a55cd0c5c7d935f5bbc5f5172335ba13125

                              SHA256

                              65c6cddc557a6b798452ad6f92e5828067d0d3404af9effda7d4f9110288d031

                              SHA512

                              97c95bbabbb1b698add622b5259faec2efb0ce8abb886cf4365cb58eec985b7c238788c0859417b47118f77b41f278d033b314a5c68d72249003b57285c0c928

                              Download Submit

                            • C:\Program Files\Common Files\backup.exe
                              Filesize

                              72KB

                              MD5

                              d6267ac85487fa54b67bd834e9cabf32

                              SHA1

                              121d1a55cd0c5c7d935f5bbc5f5172335ba13125

                              SHA256

                              65c6cddc557a6b798452ad6f92e5828067d0d3404af9effda7d4f9110288d031

                              SHA512

                              97c95bbabbb1b698add622b5259faec2efb0ce8abb886cf4365cb58eec985b7c238788c0859417b47118f77b41f278d033b314a5c68d72249003b57285c0c928

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                              Filesize

                              72KB

                              MD5

                              bad8cc288f0759b10e989ed611ceb27a

                              SHA1

                              773b0768ab09f7fc20a0c0726a48d5af80c0be5c

                              SHA256

                              877712abf3e8cd41186e3194b152ff2d2f10f2f770eeefe6149df86c13faab2c

                              SHA512

                              00b0368f21dc2e0d4b5925d51a1b65e76176fa35dc01378c43fd096d795e83f60dc81b666caf0617826dc1ccbef465c921f0f4f899768144a0457b155da9df70

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                              Filesize

                              72KB

                              MD5

                              bad8cc288f0759b10e989ed611ceb27a

                              SHA1

                              773b0768ab09f7fc20a0c0726a48d5af80c0be5c

                              SHA256

                              877712abf3e8cd41186e3194b152ff2d2f10f2f770eeefe6149df86c13faab2c

                              SHA512

                              00b0368f21dc2e0d4b5925d51a1b65e76176fa35dc01378c43fd096d795e83f60dc81b666caf0617826dc1ccbef465c921f0f4f899768144a0457b155da9df70

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\backup.exe
                              Filesize

                              72KB

                              MD5

                              a08b7186cecda0a3eeeafc88d8f9d9df

                              SHA1

                              478ae43b9387baf9eea82c78d720d9f7abd21b9b

                              SHA256

                              f887f65516c343b1b244c50b49d2744cd256386fe9d312ad538c6116747cbce4

                              SHA512

                              104d4186cced3cf5e08a9870d208d28a1fd84aaeb3b7999e744f58d9d91ca1bdd933d9b9827e1ce18950b4b7fe775b4844b000eefe8311af02605d14c9ba60e0

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\backup.exe
                              Filesize

                              72KB

                              MD5

                              a08b7186cecda0a3eeeafc88d8f9d9df

                              SHA1

                              478ae43b9387baf9eea82c78d720d9f7abd21b9b

                              SHA256

                              f887f65516c343b1b244c50b49d2744cd256386fe9d312ad538c6116747cbce4

                              SHA512

                              104d4186cced3cf5e08a9870d208d28a1fd84aaeb3b7999e744f58d9d91ca1bdd933d9b9827e1ce18950b4b7fe775b4844b000eefe8311af02605d14c9ba60e0

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                              Filesize

                              72KB

                              MD5

                              bad8cc288f0759b10e989ed611ceb27a

                              SHA1

                              773b0768ab09f7fc20a0c0726a48d5af80c0be5c

                              SHA256

                              877712abf3e8cd41186e3194b152ff2d2f10f2f770eeefe6149df86c13faab2c

                              SHA512

                              00b0368f21dc2e0d4b5925d51a1b65e76176fa35dc01378c43fd096d795e83f60dc81b666caf0617826dc1ccbef465c921f0f4f899768144a0457b155da9df70

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                              Filesize

                              72KB

                              MD5

                              bad8cc288f0759b10e989ed611ceb27a

                              SHA1

                              773b0768ab09f7fc20a0c0726a48d5af80c0be5c

                              SHA256

                              877712abf3e8cd41186e3194b152ff2d2f10f2f770eeefe6149df86c13faab2c

                              SHA512

                              00b0368f21dc2e0d4b5925d51a1b65e76176fa35dc01378c43fd096d795e83f60dc81b666caf0617826dc1ccbef465c921f0f4f899768144a0457b155da9df70

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                              Filesize

                              72KB

                              MD5

                              817d834514c1f98ace8f092fcc813923

                              SHA1

                              084cf4bb894e6daba7072eaf35884459af02f5a1

                              SHA256

                              0fbc1eb1741aa93bd4cd8d85d2c8451c0c07c40e4a50b269e4f374bf557233da

                              SHA512

                              6118737faf0de3f54f0c19e9b1dc36d4a913cb27e9b6dbb09d311527ff3951f2a8dcb171b1b5e47292178aca15a106cae2b652cd8c9be814758fd83ab397564f

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                              Filesize

                              72KB

                              MD5

                              72dee6d30896e82f2ab560b2f580918c

                              SHA1

                              cb7c1f8fdc686246a925f2a872177999b24612fe

                              SHA256

                              67c2b4da13c5e352d7150923630f4a3e0ee33123a358d31e036d66f3a834f8bd

                              SHA512

                              95ab183d21c51f03ce628d16db96f612bc9f94f3a34af1a5c2bd0527042471db6f9b0078c916ccf0d515edf2b276e642b5637d64ef08cf54b852cf265f3b02be

                              Download Submit

                            • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                              Filesize

                              72KB

                              MD5

                              72dee6d30896e82f2ab560b2f580918c

                              SHA1

                              cb7c1f8fdc686246a925f2a872177999b24612fe

                              SHA256

                              67c2b4da13c5e352d7150923630f4a3e0ee33123a358d31e036d66f3a834f8bd

                              SHA512

                              95ab183d21c51f03ce628d16db96f612bc9f94f3a34af1a5c2bd0527042471db6f9b0078c916ccf0d515edf2b276e642b5637d64ef08cf54b852cf265f3b02be

                              Download Submit

                            • C:\Program Files\backup.exe
                              Filesize

                              72KB

                              MD5

                              b3730a5e2bc43b70fd69d9e8aa340676

                              SHA1

                              0b31cb4799c821aa152cd0b388493b406080c158

                              SHA256

                              5b743ff656a6234348380f00c0006fb8a5e3b8d3d1427b79fc158a391e0d2aff

                              SHA512

                              26d02cf6c1481afeafebaa161cff9cbcfac63f4c5c8038394b264f401988947b0c62d314eb538d678e7259384c365047d15116c59a08663694baaaab903a7282

                              Download Submit

                            • C:\Program Files\backup.exe
                              Filesize

                              72KB

                              MD5

                              b3730a5e2bc43b70fd69d9e8aa340676

                              SHA1

                              0b31cb4799c821aa152cd0b388493b406080c158

                              SHA256

                              5b743ff656a6234348380f00c0006fb8a5e3b8d3d1427b79fc158a391e0d2aff

                              SHA512

                              26d02cf6c1481afeafebaa161cff9cbcfac63f4c5c8038394b264f401988947b0c62d314eb538d678e7259384c365047d15116c59a08663694baaaab903a7282

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\671391889\backup.exe
                              Filesize

                              72KB

                              MD5

                              e036b5e03ca21504a20515d8f67b392e

                              SHA1

                              068d668d8127c74e3fd9ccec3e9d26b10f4462a5

                              SHA256

                              075b2b24a7b35e3708558a86555fa25a4bc4784bc898465a744f2f606d69b72f

                              SHA512

                              81d2bae1658dbe673cf4b316e086ee9dba231b8c6e6a3c70e7e3f9ecb49b0479893ba93aeef5b3802b30c4efe8da0d4bed3ebdda716ec5fb271e594fb2772e1c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\671391889\backup.exe
                              Filesize

                              72KB

                              MD5

                              e036b5e03ca21504a20515d8f67b392e

                              SHA1

                              068d668d8127c74e3fd9ccec3e9d26b10f4462a5

                              SHA256

                              075b2b24a7b35e3708558a86555fa25a4bc4784bc898465a744f2f606d69b72f

                              SHA512

                              81d2bae1658dbe673cf4b316e086ee9dba231b8c6e6a3c70e7e3f9ecb49b0479893ba93aeef5b3802b30c4efe8da0d4bed3ebdda716ec5fb271e594fb2772e1c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                              Filesize

                              72KB

                              MD5

                              e96755f2b8f8ba4b71ca10499a5098a0

                              SHA1

                              e90f20802607ab5be2b731e947658d631eb2a90d

                              SHA256

                              1b00f82d49dc6e4bf079d32c9e6d1bbbcb4dcf93c190514ff5cd2a2506c9db41

                              SHA512

                              5f72a082a96a6a674aff4270f401b848b74bb8c929343e25edf91a7b193c61189db3118deb1cf89dbcc8351d082a42a2be86702c50b147551d210556ee948813

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                              Filesize

                              72KB

                              MD5

                              e96755f2b8f8ba4b71ca10499a5098a0

                              SHA1

                              e90f20802607ab5be2b731e947658d631eb2a90d

                              SHA256

                              1b00f82d49dc6e4bf079d32c9e6d1bbbcb4dcf93c190514ff5cd2a2506c9db41

                              SHA512

                              5f72a082a96a6a674aff4270f401b848b74bb8c929343e25edf91a7b193c61189db3118deb1cf89dbcc8351d082a42a2be86702c50b147551d210556ee948813

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                              Filesize

                              72KB

                              MD5

                              e5ad3eb7c5cfce25055b1d4901eb7539

                              SHA1

                              54710fbdcb0d0be6142fddb92bb6611d112a9d60

                              SHA256

                              e9f15a2516abcd39a0b0a5b988829b394375f31976f8e142bc79719f20deb201

                              SHA512

                              0de54d985107d8beb93d9565c7582a7bed3be380145625a8e3fba18e0685940ca78d2fbfff5015c1e7a8950e118a32285d118cc27ea0469571cc91d0c29e59e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                              Filesize

                              72KB

                              MD5

                              e96755f2b8f8ba4b71ca10499a5098a0

                              SHA1

                              e90f20802607ab5be2b731e947658d631eb2a90d

                              SHA256

                              1b00f82d49dc6e4bf079d32c9e6d1bbbcb4dcf93c190514ff5cd2a2506c9db41

                              SHA512

                              5f72a082a96a6a674aff4270f401b848b74bb8c929343e25edf91a7b193c61189db3118deb1cf89dbcc8351d082a42a2be86702c50b147551d210556ee948813

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                              Filesize

                              72KB

                              MD5

                              e96755f2b8f8ba4b71ca10499a5098a0

                              SHA1

                              e90f20802607ab5be2b731e947658d631eb2a90d

                              SHA256

                              1b00f82d49dc6e4bf079d32c9e6d1bbbcb4dcf93c190514ff5cd2a2506c9db41

                              SHA512

                              5f72a082a96a6a674aff4270f401b848b74bb8c929343e25edf91a7b193c61189db3118deb1cf89dbcc8351d082a42a2be86702c50b147551d210556ee948813

                              Download Submit

                            • C:\data.exe
                              Filesize

                              72KB

                              MD5

                              902608c0286e1b5f3d5c7eb03bc02a22

                              SHA1

                              ecf453804d2104505f6b6329d52d94b72b550c20

                              SHA256

                              bfd73b17c1910985cc4827710280c5a76ea65478603bce5dce4bcb5cc7d73481

                              SHA512

                              b06167e97ddb45e1996604958e880e8015827e13cc98eadc41b7fa5510c1aea60dbf94c33c372032aa62091904d66bf003300ed05a4e370c4d77fc551cc8054c

                              Download Submit

                            • C:\data.exe
                              Filesize

                              72KB

                              MD5

                              902608c0286e1b5f3d5c7eb03bc02a22

                              SHA1

                              ecf453804d2104505f6b6329d52d94b72b550c20

                              SHA256

                              bfd73b17c1910985cc4827710280c5a76ea65478603bce5dce4bcb5cc7d73481

                              SHA512

                              b06167e97ddb45e1996604958e880e8015827e13cc98eadc41b7fa5510c1aea60dbf94c33c372032aa62091904d66bf003300ed05a4e370c4d77fc551cc8054c

                              Download Submit

                            • C:\odt\backup.exe
                              Filesize

                              72KB

                              MD5

                              f8fe99431a43aa86ac48b0bc32a0f5ac

                              SHA1

                              a254edabe4a4a964d03374467ee75d76b236b6be

                              SHA256

                              de774ee55de90d1ee0a1a9d687e3c1009019ec1ffde0beebe8a109d7275dde0e

                              SHA512

                              4d3ba24f505097aaba882193c68b6c30d67ba9d475e7dca33b96759c228ec0517be05ffae75adfcb7ae65aac69810bf43ea3b0e9a81b9f68adbf287e0ec17093

                              Download Submit

                            • C:\odt\backup.exe
                              Filesize

                              72KB

                              MD5

                              f8fe99431a43aa86ac48b0bc32a0f5ac

                              SHA1

                              a254edabe4a4a964d03374467ee75d76b236b6be

                              SHA256

                              de774ee55de90d1ee0a1a9d687e3c1009019ec1ffde0beebe8a109d7275dde0e

                              SHA512

                              4d3ba24f505097aaba882193c68b6c30d67ba9d475e7dca33b96759c228ec0517be05ffae75adfcb7ae65aac69810bf43ea3b0e9a81b9f68adbf287e0ec17093

                              Download Submit