Overview

overview

10

Static

static

48fc33561e...d3.exe

windows7-x64

10

48fc33561e...d3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    180s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2022, 06:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    48fc33561e38a3f14b71319ee0e21036bda22d308c059e70a4f301916b3357d3.exe

  • Size

    72KB

  • MD5

    08d8174f45eff40441024bfa510ddd05

  • SHA1

    29e79771491c311fb5bc5c4fe6c35bbb33a0bb6c

  • SHA256

    48fc33561e38a3f14b71319ee0e21036bda22d308c059e70a4f301916b3357d3

  • SHA512

    9b27943ab8eeedd8152d4a3c86229928b6a27bd63b7de6589c141cee5b44050056399d9f5fd700b35284f00eb7de879c007c11cc0ab1a0e932eb3bf67eb986f7

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2I:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr0

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\48fc33561e38a3f14b71319ee0e21036bda22d308c059e70a4f301916b3357d3.exe
    "C:\Users\Admin\AppData\Local\Temp\48fc33561e38a3f14b71319ee0e21036bda22d308c059e70a4f301916b3357d3.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\1221508560\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1221508560\backup.exe C:\Users\Admin\AppData\Local\Temp\1221508560\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4908
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1488
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1676
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4488
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4432
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2560
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3956
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2024
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2016
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4200
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4348
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1616
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1864
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2252
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1000
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4524
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5016
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\update.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3920
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2660
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1916
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3740
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1568
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1840
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3608
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4280
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3460
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3272
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2168
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:3804
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4836
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1688
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3660
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1308
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4136
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3432
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4328
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2764
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2780
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3428
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3512
                • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                  8⤵
                    PID:4732
                  • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:4856
                  • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:1460
                  • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:2720
                  • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1328
                  • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1940
                  • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                    8⤵
                    • System policy modification
                    PID:2980
                  • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:3704
                  • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:4640
                  • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:4612
                  • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:4720
                  • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:2692
                  • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:3656
                  • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                    8⤵
                      PID:3204
                    • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                      8⤵
                      • Disables RegEdit via registry modification
                      • System policy modification
                      PID:800
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4468
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4228
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:4760
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:1816
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                      8⤵
                        PID:1348
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:1044
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:1616
                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                      7⤵
                      • Disables RegEdit via registry modification
                      PID:4860
                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                        8⤵
                          PID:4888
                      • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                        7⤵
                        • System policy modification
                        PID:1624
                      • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                        7⤵
                        • System policy modification
                        PID:908
                      • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Drops file in Program Files directory
                        PID:2388
                        • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                          8⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:2480
                      • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                        7⤵
                          PID:4844
                        • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                          7⤵
                          • Drops file in Program Files directory
                          PID:4376
                        • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                          7⤵
                            PID:384
                        • C:\Program Files\Common Files\Services\backup.exe
                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                          6⤵
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4060
                        • C:\Program Files\Common Files\System\backup.exe
                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                          6⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          PID:5000
                          • C:\Program Files\Common Files\System\ado\backup.exe
                            "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1140
                            • C:\Program Files\Common Files\System\ado\de-DE\update.exe
                              "C:\Program Files\Common Files\System\ado\de-DE\update.exe" C:\Program Files\Common Files\System\ado\de-DE\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2300
                            • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                              "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                              8⤵
                              • Disables RegEdit via registry modification
                              • System policy modification
                              PID:4384
                            • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                              "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:3716
                            • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                              "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                              8⤵
                              • System policy modification
                              PID:2460
                            • C:\Program Files\Common Files\System\ado\it-IT\System Restore.exe
                              "C:\Program Files\Common Files\System\ado\it-IT\System Restore.exe" C:\Program Files\Common Files\System\ado\it-IT\
                              8⤵
                                PID:4260
                              • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                8⤵
                                • Disables RegEdit via registry modification
                                • System policy modification
                                PID:2960
                            • C:\Program Files\Common Files\System\de-DE\System Restore.exe
                              "C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:2044
                            • C:\Program Files\Common Files\System\en-US\System Restore.exe
                              "C:\Program Files\Common Files\System\en-US\System Restore.exe" C:\Program Files\Common Files\System\en-US\
                              7⤵
                                PID:4864
                              • C:\Program Files\Common Files\System\es-ES\backup.exe
                                "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                7⤵
                                  PID:3804
                                • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                  "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  PID:4124
                                • C:\Program Files\Common Files\System\msadc\backup.exe
                                  "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                  7⤵
                                  • Drops file in Program Files directory
                                  PID:1696
                                  • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                    8⤵
                                      PID:1056
                                  • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:1572
                                  • C:\Program Files\Common Files\System\it-IT\backup.exe
                                    "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                    7⤵
                                    • System policy modification
                                    PID:344
                              • C:\Program Files\Google\backup.exe
                                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:836
                                • C:\Program Files\Google\Chrome\backup.exe
                                  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                  6⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1512
                                  • C:\Program Files\Google\Chrome\Application\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4976
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                      8⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:3728
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                        9⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        PID:4504
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                        9⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System policy modification
                                        PID:3304
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                        9⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:1944
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                        9⤵
                                          PID:4364
                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe
                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                          9⤵
                                            PID:4928
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                            9⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:2664
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                            9⤵
                                            • Disables RegEdit via registry modification
                                            PID:3048
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                            9⤵
                                              PID:2192
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                10⤵
                                                  PID:1068
                                            • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                              8⤵
                                                PID:3152
                                        • C:\Program Files\Internet Explorer\backup.exe
                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                          5⤵
                                          • Disables RegEdit via registry modification
                                          • Drops file in Program Files directory
                                          PID:3896
                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                            6⤵
                                              PID:3844
                                            • C:\Program Files\Internet Explorer\en-US\backup.exe
                                              "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                              6⤵
                                                PID:4916
                                              • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:680
                                              • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                6⤵
                                                • System policy modification
                                                PID:4252
                                              • C:\Program Files\Internet Explorer\images\backup.exe
                                                "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                6⤵
                                                • System policy modification
                                                PID:3312
                                              • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                6⤵
                                                  PID:1012
                                              • C:\Program Files\Java\backup.exe
                                                "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                5⤵
                                                • Disables RegEdit via registry modification
                                                PID:1736
                                                • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                  "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                  6⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Drops file in Program Files directory
                                                  • System policy modification
                                                  PID:2732
                                                  • C:\Program Files\Java\jdk1.8.0_66\bin\update.exe
                                                    "C:\Program Files\Java\jdk1.8.0_66\bin\update.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                    7⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:1564
                                                  • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                    "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                    7⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:2052
                                                    • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                      "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                      8⤵
                                                        PID:4924
                                                      • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                        8⤵
                                                          PID:2848
                                                      • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                        7⤵
                                                          PID:3164
                                                  • C:\Program Files (x86)\backup.exe
                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                    4⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1472
                                                    • C:\Program Files (x86)\Adobe\backup.exe
                                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1392
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3548
                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:684
                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                          7⤵
                                                          • Drops file in Program Files directory
                                                          PID:1760
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                            8⤵
                                                            • Drops file in Program Files directory
                                                            PID:1404
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                              9⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:3708
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                            8⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Drops file in Program Files directory
                                                            • System policy modification
                                                            PID:636
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                              9⤵
                                                              • System policy modification
                                                              PID:1528
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\System Restore.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                            8⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:4040
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                            8⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            PID:3080
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                            8⤵
                                                            • Drops file in Program Files directory
                                                            PID:1244
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                              9⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:3988
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                            8⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:712
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                            8⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • System policy modification
                                                            PID:4988
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                              9⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:4840
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                            8⤵
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Program Files directory
                                                            PID:4884
                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                          7⤵
                                                          • Drops file in Program Files directory
                                                          PID:760
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                            8⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            PID:1648
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                              9⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:3304
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                            8⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:2836
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                            8⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            PID:1940
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                              9⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              • Drops file in Program Files directory
                                                              PID:4508
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                10⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:3556
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\data.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                10⤵
                                                                  PID:1464
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                            7⤵
                                                            • System policy modification
                                                            PID:3524
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                              8⤵
                                                              • System policy modification
                                                              PID:3672
                                                      • C:\Program Files (x86)\Common Files\backup.exe
                                                        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                        5⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • System policy modification
                                                        PID:3272
                                                        • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                          "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                          6⤵
                                                            PID:2524
                                                            • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                              "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:2176
                                                              • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                8⤵
                                                                  PID:4484
                                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                7⤵
                                                                  PID:2488
                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                  7⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:1756
                                                            • C:\Program Files (x86)\Google\backup.exe
                                                              "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                              5⤵
                                                              • Drops file in Program Files directory
                                                              PID:3580
                                                              • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                6⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:4288
                                                              • C:\Program Files (x86)\Google\Update\backup.exe
                                                                "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                6⤵
                                                                • Disables RegEdit via registry modification
                                                                • Drops file in Program Files directory
                                                                PID:2368
                                                                • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                  "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                  7⤵
                                                                    PID:4036
                                                                  • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                    "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                    7⤵
                                                                      PID:4696
                                                                  • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                    6⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    • System policy modification
                                                                    PID:4776
                                                                  • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                    6⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • System policy modification
                                                                    PID:220
                                                              • C:\Users\backup.exe
                                                                C:\Users\backup.exe C:\Users\
                                                                4⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:2072
                                                                • C:\Users\Admin\backup.exe
                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                  5⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:4876
                                                                  • C:\Users\Admin\Contacts\backup.exe
                                                                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                    6⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:3676
                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                    6⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:4748
                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                    6⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:4984
                                                                  • C:\Users\Admin\Downloads\data.exe
                                                                    C:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\
                                                                    6⤵
                                                                    • System policy modification
                                                                    PID:2004
                                                                  • C:\Users\Admin\3D Objects\backup.exe
                                                                    "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                    6⤵
                                                                    • System policy modification
                                                                    PID:4992
                                                              • C:\Windows\update.exe
                                                                C:\Windows\update.exe C:\Windows\
                                                                4⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Drops file in Windows directory
                                                                • System policy modification
                                                                PID:2308
                                                                • C:\Windows\addins\backup.exe
                                                                  C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                  5⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  PID:628
                                                                • C:\Windows\appcompat\backup.exe
                                                                  C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                  5⤵
                                                                  • Drops file in Windows directory
                                                                  PID:4092
                                                                  • C:\Windows\appcompat\appraiser\backup.exe
                                                                    C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                    6⤵
                                                                    • Drops file in Windows directory
                                                                    PID:3832
                                                                    • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                      C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                      7⤵
                                                                        PID:5088
                                                                    • C:\Windows\appcompat\encapsulation\backup.exe
                                                                      C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:1856
                                                                    • C:\Windows\appcompat\Programs\backup.exe
                                                                      C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                      6⤵
                                                                        PID:4108
                                                                    • C:\Windows\apppatch\backup.exe
                                                                      C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                      5⤵
                                                                        PID:4568
                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2268
                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • System policy modification
                                                                  PID:832
                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:684
                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                  2⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4004
                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3548
                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                  2⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1432
                                                                • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                  2⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:1504
                                                                • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                  2⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:4152
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                1⤵
                                                                  PID:2064
                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                  1⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:1384
                                                                • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                                  1⤵
                                                                  • System policy modification
                                                                  PID:372
                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                  1⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:4276

                                                                Network

                                                                      MITRE ATT&CK Enterprise v6

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\PerfLogs\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b1aa5722912c8e6be3bf9168e1aa2de2

                                                                        SHA1

                                                                        2519e00ebc2d8af6812f99fa3df57a4160bd8412

                                                                        SHA256

                                                                        5447fd5f4a95dfd842a8f766e53a3281711210e0a924f339428bc6c0946b4477

                                                                        SHA512

                                                                        7089555b2fa6d84830814bccf579bd5ce3546a24436b483617530f5010e9169ddd5cdcff58ac01152043933116d8d5cf308d82e09ee04e399e806cbcc3883057

                                                                        Download Submit

                                                                      • C:\PerfLogs\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b1aa5722912c8e6be3bf9168e1aa2de2

                                                                        SHA1

                                                                        2519e00ebc2d8af6812f99fa3df57a4160bd8412

                                                                        SHA256

                                                                        5447fd5f4a95dfd842a8f766e53a3281711210e0a924f339428bc6c0946b4477

                                                                        SHA512

                                                                        7089555b2fa6d84830814bccf579bd5ce3546a24436b483617530f5010e9169ddd5cdcff58ac01152043933116d8d5cf308d82e09ee04e399e806cbcc3883057

                                                                        Download Submit

                                                                      • C:\Program Files\7-Zip\Lang\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        ab9af1706e7b02bd5927eec7c19b05ad

                                                                        SHA1

                                                                        d6aa36ab85110ec2c2dfec555132bbe897c7d461

                                                                        SHA256

                                                                        2a402edcec32ed1c952a62574babf8a541d93b86127e707fe75c7b48b6579060

                                                                        SHA512

                                                                        68bec3576cdc1d8047f2cb5e704bd5a3929064d6e03ee5e876f3be9d6a76a5dee03f6e9c0aebb5c8d7583b8cf8c55a3811dd2dc2cb3615decc153a5277b32193

                                                                        Download Submit

                                                                      • C:\Program Files\7-Zip\Lang\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        ab9af1706e7b02bd5927eec7c19b05ad

                                                                        SHA1

                                                                        d6aa36ab85110ec2c2dfec555132bbe897c7d461

                                                                        SHA256

                                                                        2a402edcec32ed1c952a62574babf8a541d93b86127e707fe75c7b48b6579060

                                                                        SHA512

                                                                        68bec3576cdc1d8047f2cb5e704bd5a3929064d6e03ee5e876f3be9d6a76a5dee03f6e9c0aebb5c8d7583b8cf8c55a3811dd2dc2cb3615decc153a5277b32193

                                                                        Download Submit

                                                                      • C:\Program Files\7-Zip\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        3fabae06da45e2c5b1baf21374ee2123

                                                                        SHA1

                                                                        547e4a10d3217dc30ed5564dcb76fa5a29f8c606

                                                                        SHA256

                                                                        aa247d8faac8b0dd283ddb572cf3bbfc8312b928e9f7778eabcd76acb96b2454

                                                                        SHA512

                                                                        9ad5d818bc876dc9f2c8e2690a4d7571b67804d8a0c2118c9d5e8dcfe29d552837d18d5f780c11aea00b5a86027bfefb6ddc1444fc47fae55493f9c2b2edce16

                                                                        Download Submit

                                                                      • C:\Program Files\7-Zip\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        3fabae06da45e2c5b1baf21374ee2123

                                                                        SHA1

                                                                        547e4a10d3217dc30ed5564dcb76fa5a29f8c606

                                                                        SHA256

                                                                        aa247d8faac8b0dd283ddb572cf3bbfc8312b928e9f7778eabcd76acb96b2454

                                                                        SHA512

                                                                        9ad5d818bc876dc9f2c8e2690a4d7571b67804d8a0c2118c9d5e8dcfe29d552837d18d5f780c11aea00b5a86027bfefb6ddc1444fc47fae55493f9c2b2edce16

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        9a804aa79401fc322f5d19e3f8c44b3e

                                                                        SHA1

                                                                        934d233a11eab059abd18afe8fa13f81f32d8500

                                                                        SHA256

                                                                        1d9efd40778e187efba81e9af08bff54d45f90bd46fb75dc0cd4a04fd7fac68d

                                                                        SHA512

                                                                        24ea39b004b53880f90ed3090ed6116b74fb84f5ef888d45ba898588ac76c43e9a0ea40607ed5ea27046a9db92440f235a4889a720c03d381b77a4f221ec3778

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        9a804aa79401fc322f5d19e3f8c44b3e

                                                                        SHA1

                                                                        934d233a11eab059abd18afe8fa13f81f32d8500

                                                                        SHA256

                                                                        1d9efd40778e187efba81e9af08bff54d45f90bd46fb75dc0cd4a04fd7fac68d

                                                                        SHA512

                                                                        24ea39b004b53880f90ed3090ed6116b74fb84f5ef888d45ba898588ac76c43e9a0ea40607ed5ea27046a9db92440f235a4889a720c03d381b77a4f221ec3778

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        ca5b8c4eabe9a2bb05437c2cbf45527d

                                                                        SHA1

                                                                        c4b819a63c014213b254ed92886cecf9583b9222

                                                                        SHA256

                                                                        e83dfdae9f100dab3a527eb76356e9797ac56d14434f993113976afaf79eb3a1

                                                                        SHA512

                                                                        c80034a4f203a282468782063abbd39bb7906245fa25626ae99cba97af8ca0e23da17f4d5cb8b2726cb234299c3364df8ca039f51336e71deae0db61704e75e9

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        ca5b8c4eabe9a2bb05437c2cbf45527d

                                                                        SHA1

                                                                        c4b819a63c014213b254ed92886cecf9583b9222

                                                                        SHA256

                                                                        e83dfdae9f100dab3a527eb76356e9797ac56d14434f993113976afaf79eb3a1

                                                                        SHA512

                                                                        c80034a4f203a282468782063abbd39bb7906245fa25626ae99cba97af8ca0e23da17f4d5cb8b2726cb234299c3364df8ca039f51336e71deae0db61704e75e9

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        2e1aa3cd1b0a4fc32a3567e25e1a184e

                                                                        SHA1

                                                                        70edcceb57decc8aebd4fda0af277fc07497c3e1

                                                                        SHA256

                                                                        87b562637f5e48008b68f9ab42f316da8ff194d696c232e500955f0355161f9f

                                                                        SHA512

                                                                        214e1cc77ca5190dd120b8a4641ce0a79657fef27eab3852e6bfdb5c497f69975f84529db52958fa6dff18064530d3e7ac5ef5372b8b759ffc8e9c722ba96b52

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        2e1aa3cd1b0a4fc32a3567e25e1a184e

                                                                        SHA1

                                                                        70edcceb57decc8aebd4fda0af277fc07497c3e1

                                                                        SHA256

                                                                        87b562637f5e48008b68f9ab42f316da8ff194d696c232e500955f0355161f9f

                                                                        SHA512

                                                                        214e1cc77ca5190dd120b8a4641ce0a79657fef27eab3852e6bfdb5c497f69975f84529db52958fa6dff18064530d3e7ac5ef5372b8b759ffc8e9c722ba96b52

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        9a804aa79401fc322f5d19e3f8c44b3e

                                                                        SHA1

                                                                        934d233a11eab059abd18afe8fa13f81f32d8500

                                                                        SHA256

                                                                        1d9efd40778e187efba81e9af08bff54d45f90bd46fb75dc0cd4a04fd7fac68d

                                                                        SHA512

                                                                        24ea39b004b53880f90ed3090ed6116b74fb84f5ef888d45ba898588ac76c43e9a0ea40607ed5ea27046a9db92440f235a4889a720c03d381b77a4f221ec3778

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        9a804aa79401fc322f5d19e3f8c44b3e

                                                                        SHA1

                                                                        934d233a11eab059abd18afe8fa13f81f32d8500

                                                                        SHA256

                                                                        1d9efd40778e187efba81e9af08bff54d45f90bd46fb75dc0cd4a04fd7fac68d

                                                                        SHA512

                                                                        24ea39b004b53880f90ed3090ed6116b74fb84f5ef888d45ba898588ac76c43e9a0ea40607ed5ea27046a9db92440f235a4889a720c03d381b77a4f221ec3778

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d822912758d29835a62a4511d0931119

                                                                        SHA1

                                                                        41399be51e9f645e7de3cad1c46f490ed9596087

                                                                        SHA256

                                                                        844abb648a18d12cc8baa39b848f12b790d22c33040ce9045e566df95d9f2d15

                                                                        SHA512

                                                                        22e679f076cae62b0be024349fe9105db085b6b7f4ed099072e24bd44c3c88e57a7d4fa66b52d310942a7e0db7e4e554ffa333f1d982cbc01369c4493dd7b8b3

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d822912758d29835a62a4511d0931119

                                                                        SHA1

                                                                        41399be51e9f645e7de3cad1c46f490ed9596087

                                                                        SHA256

                                                                        844abb648a18d12cc8baa39b848f12b790d22c33040ce9045e566df95d9f2d15

                                                                        SHA512

                                                                        22e679f076cae62b0be024349fe9105db085b6b7f4ed099072e24bd44c3c88e57a7d4fa66b52d310942a7e0db7e4e554ffa333f1d982cbc01369c4493dd7b8b3

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        85209e3599e7b683ca11b85161ea12fd

                                                                        SHA1

                                                                        0f38bed3c11804b8a51202a6da1d13c8b3dbc632

                                                                        SHA256

                                                                        6f5a3af8182f8cd231f4ed535d64d18603ebbcb68f5e937ac748afc82feb4144

                                                                        SHA512

                                                                        141e79673ba1624ebde5fb4daa9aa63ca7c660ffb7fabd1b6ced95e086db2db54a54e41d11bccf349eb300ab49a983c872bd5119e9449e2ae946157eb5778ccd

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        85209e3599e7b683ca11b85161ea12fd

                                                                        SHA1

                                                                        0f38bed3c11804b8a51202a6da1d13c8b3dbc632

                                                                        SHA256

                                                                        6f5a3af8182f8cd231f4ed535d64d18603ebbcb68f5e937ac748afc82feb4144

                                                                        SHA512

                                                                        141e79673ba1624ebde5fb4daa9aa63ca7c660ffb7fabd1b6ced95e086db2db54a54e41d11bccf349eb300ab49a983c872bd5119e9449e2ae946157eb5778ccd

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d822912758d29835a62a4511d0931119

                                                                        SHA1

                                                                        41399be51e9f645e7de3cad1c46f490ed9596087

                                                                        SHA256

                                                                        844abb648a18d12cc8baa39b848f12b790d22c33040ce9045e566df95d9f2d15

                                                                        SHA512

                                                                        22e679f076cae62b0be024349fe9105db085b6b7f4ed099072e24bd44c3c88e57a7d4fa66b52d310942a7e0db7e4e554ffa333f1d982cbc01369c4493dd7b8b3

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d822912758d29835a62a4511d0931119

                                                                        SHA1

                                                                        41399be51e9f645e7de3cad1c46f490ed9596087

                                                                        SHA256

                                                                        844abb648a18d12cc8baa39b848f12b790d22c33040ce9045e566df95d9f2d15

                                                                        SHA512

                                                                        22e679f076cae62b0be024349fe9105db085b6b7f4ed099072e24bd44c3c88e57a7d4fa66b52d310942a7e0db7e4e554ffa333f1d982cbc01369c4493dd7b8b3

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d822912758d29835a62a4511d0931119

                                                                        SHA1

                                                                        41399be51e9f645e7de3cad1c46f490ed9596087

                                                                        SHA256

                                                                        844abb648a18d12cc8baa39b848f12b790d22c33040ce9045e566df95d9f2d15

                                                                        SHA512

                                                                        22e679f076cae62b0be024349fe9105db085b6b7f4ed099072e24bd44c3c88e57a7d4fa66b52d310942a7e0db7e4e554ffa333f1d982cbc01369c4493dd7b8b3

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d822912758d29835a62a4511d0931119

                                                                        SHA1

                                                                        41399be51e9f645e7de3cad1c46f490ed9596087

                                                                        SHA256

                                                                        844abb648a18d12cc8baa39b848f12b790d22c33040ce9045e566df95d9f2d15

                                                                        SHA512

                                                                        22e679f076cae62b0be024349fe9105db085b6b7f4ed099072e24bd44c3c88e57a7d4fa66b52d310942a7e0db7e4e554ffa333f1d982cbc01369c4493dd7b8b3

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        2e1c7d4455c93477b628e21e59bc12ba

                                                                        SHA1

                                                                        111da12f7c276173efc05b382b761c2b1996aad1

                                                                        SHA256

                                                                        238e3fac47a33ca30dcc7ee1932dfc25c7ba544f6bf4674b72933c2c9496db56

                                                                        SHA512

                                                                        cc44cb0c91e1f0e4bfb074aac54fe9aee838bac202b90dbe812e761a827decf413ed1cf4b2f766a95042799322ffc81d5f56c63512bb2b0ed38a4352cdcbc3a0

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        2e1c7d4455c93477b628e21e59bc12ba

                                                                        SHA1

                                                                        111da12f7c276173efc05b382b761c2b1996aad1

                                                                        SHA256

                                                                        238e3fac47a33ca30dcc7ee1932dfc25c7ba544f6bf4674b72933c2c9496db56

                                                                        SHA512

                                                                        cc44cb0c91e1f0e4bfb074aac54fe9aee838bac202b90dbe812e761a827decf413ed1cf4b2f766a95042799322ffc81d5f56c63512bb2b0ed38a4352cdcbc3a0

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        04826a4dd19c3f15e33f8c8851d3928f

                                                                        SHA1

                                                                        68db7893c58893b31709e51a7ac29377a8d8bd70

                                                                        SHA256

                                                                        0512c710939b85bdeb7bcedc093cd481fd73bcea500ee727cb310984db1112e3

                                                                        SHA512

                                                                        ed33a84c298ac13e7f66a86c5937ef62d0c1d09268dfba1c5c80798d2ac9b794b16288e4b7514c7d0341e6a0ffcb6164f21893f94c9a0c6458fbb867c64be28e

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        04826a4dd19c3f15e33f8c8851d3928f

                                                                        SHA1

                                                                        68db7893c58893b31709e51a7ac29377a8d8bd70

                                                                        SHA256

                                                                        0512c710939b85bdeb7bcedc093cd481fd73bcea500ee727cb310984db1112e3

                                                                        SHA512

                                                                        ed33a84c298ac13e7f66a86c5937ef62d0c1d09268dfba1c5c80798d2ac9b794b16288e4b7514c7d0341e6a0ffcb6164f21893f94c9a0c6458fbb867c64be28e

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        04826a4dd19c3f15e33f8c8851d3928f

                                                                        SHA1

                                                                        68db7893c58893b31709e51a7ac29377a8d8bd70

                                                                        SHA256

                                                                        0512c710939b85bdeb7bcedc093cd481fd73bcea500ee727cb310984db1112e3

                                                                        SHA512

                                                                        ed33a84c298ac13e7f66a86c5937ef62d0c1d09268dfba1c5c80798d2ac9b794b16288e4b7514c7d0341e6a0ffcb6164f21893f94c9a0c6458fbb867c64be28e

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        04826a4dd19c3f15e33f8c8851d3928f

                                                                        SHA1

                                                                        68db7893c58893b31709e51a7ac29377a8d8bd70

                                                                        SHA256

                                                                        0512c710939b85bdeb7bcedc093cd481fd73bcea500ee727cb310984db1112e3

                                                                        SHA512

                                                                        ed33a84c298ac13e7f66a86c5937ef62d0c1d09268dfba1c5c80798d2ac9b794b16288e4b7514c7d0341e6a0ffcb6164f21893f94c9a0c6458fbb867c64be28e

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\update.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\update.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        d0629702cd6df2feb3f2aa3261b48d96

                                                                        SHA1

                                                                        70fcd3a0f27e4a9a12c12d858347a43af5571ac3

                                                                        SHA256

                                                                        39cbc701cfad676a87474fe0cf69ebb5228aec9d4c7ead334f86534dd0e48bea

                                                                        SHA512

                                                                        2f4e83c9438b02ec2d7abee2166b86d496921dc8830b3d24e3f58eb076a3948e18240c37aa74aed56f52485dc0823eb21b0e21934e2d1275964be2387bf5a34b

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        9529362f4ecfdc181ced0e79feac4f78

                                                                        SHA1

                                                                        5615bc7d07958377f4e2e8e0dd5eae1b75be1ce5

                                                                        SHA256

                                                                        602d070954d08175c0770c691f4ddd8de8482e39223df647582d9b99a97bf8cc

                                                                        SHA512

                                                                        f60c5b3ad4a6181f05d08cf0760e563b3bb42868b1309ad69281558afc442587f7c313bd1a34d85accc4aa5e58d8c4b7c4130719856cb4e96cd9643034e39d64

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        9529362f4ecfdc181ced0e79feac4f78

                                                                        SHA1

                                                                        5615bc7d07958377f4e2e8e0dd5eae1b75be1ce5

                                                                        SHA256

                                                                        602d070954d08175c0770c691f4ddd8de8482e39223df647582d9b99a97bf8cc

                                                                        SHA512

                                                                        f60c5b3ad4a6181f05d08cf0760e563b3bb42868b1309ad69281558afc442587f7c313bd1a34d85accc4aa5e58d8c4b7c4130719856cb4e96cd9643034e39d64

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        46a4bb3246ee52c01caa63655e95eeb9

                                                                        SHA1

                                                                        920cb281db007b65ba257de6f7f4de79b4b40bd5

                                                                        SHA256

                                                                        5cd27e6858a13d62340deb4f95d89dfeaacef44bf92489082cbe654f98df7b4c

                                                                        SHA512

                                                                        412364a4036cfb6ff98f8919560514020f0d918d6ae3d73ea9c48725e5e39b4c1cba20facd126c6399d004b692e1cbab51076f9ccba3996703e1fc5ed0d6170e

                                                                        Download Submit

                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        46a4bb3246ee52c01caa63655e95eeb9

                                                                        SHA1

                                                                        920cb281db007b65ba257de6f7f4de79b4b40bd5

                                                                        SHA256

                                                                        5cd27e6858a13d62340deb4f95d89dfeaacef44bf92489082cbe654f98df7b4c

                                                                        SHA512

                                                                        412364a4036cfb6ff98f8919560514020f0d918d6ae3d73ea9c48725e5e39b4c1cba20facd126c6399d004b692e1cbab51076f9ccba3996703e1fc5ed0d6170e

                                                                        Download Submit

                                                                      • C:\Program Files\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b1aa5722912c8e6be3bf9168e1aa2de2

                                                                        SHA1

                                                                        2519e00ebc2d8af6812f99fa3df57a4160bd8412

                                                                        SHA256

                                                                        5447fd5f4a95dfd842a8f766e53a3281711210e0a924f339428bc6c0946b4477

                                                                        SHA512

                                                                        7089555b2fa6d84830814bccf579bd5ce3546a24436b483617530f5010e9169ddd5cdcff58ac01152043933116d8d5cf308d82e09ee04e399e806cbcc3883057

                                                                        Download Submit

                                                                      • C:\Program Files\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b1aa5722912c8e6be3bf9168e1aa2de2

                                                                        SHA1

                                                                        2519e00ebc2d8af6812f99fa3df57a4160bd8412

                                                                        SHA256

                                                                        5447fd5f4a95dfd842a8f766e53a3281711210e0a924f339428bc6c0946b4477

                                                                        SHA512

                                                                        7089555b2fa6d84830814bccf579bd5ce3546a24436b483617530f5010e9169ddd5cdcff58ac01152043933116d8d5cf308d82e09ee04e399e806cbcc3883057

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\1221508560\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\1221508560\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b79c34f074aba5309f4aead612873091

                                                                        SHA1

                                                                        6988188fd7577f625808f015bae0b581b88de9c5

                                                                        SHA256

                                                                        6f645439d92919f97ed96809bb8739e3e0837d20a95f2459549b9a1e871792b9

                                                                        SHA512

                                                                        d4622a6883e5d99273d980b7b1ee33c771f38bf29306abc7bb8a756d09bdd3d23d328d7419c01f439ff9eb86153512b491ab4b1b23dba89dab65e9b2351d8c63

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        bbf9951ab25def5e7ade745463415639

                                                                        SHA1

                                                                        503c21d2a88310c74ab83b7ddaa212c89493e819

                                                                        SHA256

                                                                        3ea0a89517456c5add9937a8d8ae5fc3805cdc5c7ad80156f287ae99c1a6d251

                                                                        SHA512

                                                                        175c60b255607714f2e5a3b4675f9c6f4b7d9c22f2f6161fbc147dc0f53193a701459b2a1275f4c90ad9b4d631e38ea16deb787c7152c48ed708fb5c7f90ef5d

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        bbf9951ab25def5e7ade745463415639

                                                                        SHA1

                                                                        503c21d2a88310c74ab83b7ddaa212c89493e819

                                                                        SHA256

                                                                        3ea0a89517456c5add9937a8d8ae5fc3805cdc5c7ad80156f287ae99c1a6d251

                                                                        SHA512

                                                                        175c60b255607714f2e5a3b4675f9c6f4b7d9c22f2f6161fbc147dc0f53193a701459b2a1275f4c90ad9b4d631e38ea16deb787c7152c48ed708fb5c7f90ef5d

                                                                        Download Submit

                                                                      • C:\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b2e35fe6f071a854e3f6996e2bce7e6f

                                                                        SHA1

                                                                        9d0d0a6803165869c9fa36e341a4967ce21cb7c2

                                                                        SHA256

                                                                        af05d050e04ad4b2a8ece4d65f6bbdade5f64bffb5684de8a609b31f25056df3

                                                                        SHA512

                                                                        20ada4a3276bbf03f8ef9fbb67adcc99b4c7e9a0045fb972117ef584877997394fcc0d6e8820387cfe8ed0cb51fcc49b655c71086db7de2818c6a07309dff6f8

                                                                        Download Submit

                                                                      • C:\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b2e35fe6f071a854e3f6996e2bce7e6f

                                                                        SHA1

                                                                        9d0d0a6803165869c9fa36e341a4967ce21cb7c2

                                                                        SHA256

                                                                        af05d050e04ad4b2a8ece4d65f6bbdade5f64bffb5684de8a609b31f25056df3

                                                                        SHA512

                                                                        20ada4a3276bbf03f8ef9fbb67adcc99b4c7e9a0045fb972117ef584877997394fcc0d6e8820387cfe8ed0cb51fcc49b655c71086db7de2818c6a07309dff6f8

                                                                        Download Submit

                                                                      • C:\odt\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b1aa5722912c8e6be3bf9168e1aa2de2

                                                                        SHA1

                                                                        2519e00ebc2d8af6812f99fa3df57a4160bd8412

                                                                        SHA256

                                                                        5447fd5f4a95dfd842a8f766e53a3281711210e0a924f339428bc6c0946b4477

                                                                        SHA512

                                                                        7089555b2fa6d84830814bccf579bd5ce3546a24436b483617530f5010e9169ddd5cdcff58ac01152043933116d8d5cf308d82e09ee04e399e806cbcc3883057

                                                                        Download Submit

                                                                      • C:\odt\backup.exe
                                                                        Filesize

                                                                        72KB

                                                                        MD5

                                                                        b1aa5722912c8e6be3bf9168e1aa2de2

                                                                        SHA1

                                                                        2519e00ebc2d8af6812f99fa3df57a4160bd8412

                                                                        SHA256

                                                                        5447fd5f4a95dfd842a8f766e53a3281711210e0a924f339428bc6c0946b4477

                                                                        SHA512

                                                                        7089555b2fa6d84830814bccf579bd5ce3546a24436b483617530f5010e9169ddd5cdcff58ac01152043933116d8d5cf308d82e09ee04e399e806cbcc3883057

                                                                        Download Submit