Overview

overview

10

Static

static

5b95d743ef...51.exe

windows7-x64

10

5b95d743ef...51.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    174s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-10-2022 13:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b95d743ef51159a8d0c8bd1bd0aa653f3b32e3b94520f88d7f4654669b15151.exe

  • Size

    72KB

  • MD5

    a25dbd683904f374a86c997501adf8ec

  • SHA1

    fb185a21882b70fb3da5d68105217ea7bb890767

  • SHA256

    5b95d743ef51159a8d0c8bd1bd0aa653f3b32e3b94520f88d7f4654669b15151

  • SHA512

    48fd799e64522c47793bc0e87b17a61614c4ebdf6d0283ef65c3f10a6bf9f791e9c2c9da1f300fe6f133a26e9432c0e6097476bdc15961192cbb3880ac7995fd

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2c:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPo

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b95d743ef51159a8d0c8bd1bd0aa653f3b32e3b94520f88d7f4654669b15151.exe
    "C:\Users\Admin\AppData\Local\Temp\5b95d743ef51159a8d0c8bd1bd0aa653f3b32e3b94520f88d7f4654669b15151.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\971075890\backup.exe
      C:\Users\Admin\AppData\Local\Temp\971075890\backup.exe C:\Users\Admin\AppData\Local\Temp\971075890\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:664
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:112
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:488
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3956
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4344
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3388
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4840
            • C:\Program Files\Common Files\DESIGNER\data.exe
              "C:\Program Files\Common Files\DESIGNER\data.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:784
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4348
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1952
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4520
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4652
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1820
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1152
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3484
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2908
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4516
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3608
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3876
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4592
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:852
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2516
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1264
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1496
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2752
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2760
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:456
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3276
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3372
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:764
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1776
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3612
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2152
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\update.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    PID:2216
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Disables RegEdit via registry modification
                    PID:2040
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                      PID:3388
                  • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4264
                  • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3320
                  • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4896
                  • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2604
                  • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2356
                  • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                    8⤵
                      PID:220
                    • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                      8⤵
                        PID:4532
                      • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:308
                      • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                        8⤵
                          PID:3816
                        • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                          8⤵
                            PID:3744
                          • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:1036
                          • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • System policy modification
                            PID:64
                          • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:4172
                          • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                            8⤵
                              PID:4168
                            • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:1840
                            • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                              8⤵
                              • Disables RegEdit via registry modification
                              • System policy modification
                              PID:4336
                            • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                              8⤵
                                PID:3568
                              • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:2856
                              • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • System policy modification
                                PID:2208
                              • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                                8⤵
                                  PID:2960
                                • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:4192
                                • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  PID:1348
                                • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                  8⤵
                                    PID:4240
                                  • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                                    8⤵
                                      PID:1548
                                    • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                                      8⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:4676
                                    • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                                      8⤵
                                        PID:4652
                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                      7⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4832
                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1548
                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4956
                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4284
                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2252
                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                        8⤵
                                          PID:2144
                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:2032
                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                        7⤵
                                          PID:4232
                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\update.exe
                                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\update.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                            8⤵
                                            • Disables RegEdit via registry modification
                                            PID:4784
                                        • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                          7⤵
                                            PID:4240
                                          • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                            7⤵
                                            • Disables RegEdit via registry modification
                                            • System policy modification
                                            PID:3748
                                          • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                            7⤵
                                              PID:1392
                                            • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Drops file in Program Files directory
                                              • System policy modification
                                              PID:776
                                              • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:3524
                                            • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                              7⤵
                                              • System policy modification
                                              PID:2168
                                              • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                8⤵
                                                • System policy modification
                                                PID:3584
                                            • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:4228
                                            • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • System policy modification
                                              PID:4084
                                            • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                              7⤵
                                                PID:2388
                                                • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:4004
                                                  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                    9⤵
                                                      PID:1852
                                              • C:\Program Files\Common Files\Services\backup.exe
                                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2884
                                              • C:\Program Files\Common Files\System\backup.exe
                                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:2256
                                                • C:\Program Files\Common Files\System\ado\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                  7⤵
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1740
                                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                    8⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2748
                                                  • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                    8⤵
                                                      PID:228
                                                    • C:\Program Files\Common Files\System\ado\es-ES\update.exe
                                                      "C:\Program Files\Common Files\System\ado\es-ES\update.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                      8⤵
                                                      • System policy modification
                                                      PID:4192
                                                    • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      PID:2796
                                                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                      8⤵
                                                      • System policy modification
                                                      PID:372
                                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                      8⤵
                                                        PID:4872
                                                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:3604
                                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                      7⤵
                                                        PID:1880
                                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                        7⤵
                                                          PID:1648
                                                        • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                          "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                          7⤵
                                                            PID:2360
                                                          • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                            "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                            7⤵
                                                              PID:3056
                                                            • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                              "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                              7⤵
                                                                PID:1340
                                                              • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                7⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • Drops file in Program Files directory
                                                                PID:1232
                                                                • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:316
                                                                • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • System policy modification
                                                                  PID:4932
                                                                • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • System policy modification
                                                                  PID:3388
                                                                • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:3744
                                                                • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  PID:3344
                                                                • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                  8⤵
                                                                  • System policy modification
                                                                  PID:4244
                                                              • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                7⤵
                                                                • Drops file in Program Files directory
                                                                PID:3760
                                                                • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:4884
                                                                • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:3816
                                                                • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                  8⤵
                                                                    PID:3824
                                                                  • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                    "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                    8⤵
                                                                      PID:4920
                                                                    • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                      8⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:3676
                                                                    • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                      8⤵
                                                                        PID:4196
                                                                • C:\Program Files\Google\backup.exe
                                                                  "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                  5⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1000
                                                                  • C:\Program Files\Google\Chrome\backup.exe
                                                                    "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                    6⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:3308
                                                                    • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2812
                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                        8⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3104
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                          9⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:4888
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                          9⤵
                                                                            PID:1244
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                            9⤵
                                                                              PID:900
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                              9⤵
                                                                              • System policy modification
                                                                              PID:968
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:3484
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                              9⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • System policy modification
                                                                              PID:2200
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:3976
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                              9⤵
                                                                              • Disables RegEdit via registry modification
                                                                              PID:2752
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                10⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:3128
                                                                          • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            PID:1288
                                                                    • C:\Program Files\Internet Explorer\backup.exe
                                                                      "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                      5⤵
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:4868
                                                                      • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                        6⤵
                                                                        • System policy modification
                                                                        PID:1116
                                                                      • C:\Program Files\Internet Explorer\en-US\update.exe
                                                                        "C:\Program Files\Internet Explorer\en-US\update.exe" C:\Program Files\Internet Explorer\en-US\
                                                                        6⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • System policy modification
                                                                        PID:4344
                                                                      • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                        6⤵
                                                                        • System policy modification
                                                                        PID:1152
                                                                      • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        PID:3740
                                                                      • C:\Program Files\Internet Explorer\images\backup.exe
                                                                        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                        6⤵
                                                                          PID:2520
                                                                        • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                          "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                          6⤵
                                                                          • Disables RegEdit via registry modification
                                                                          PID:2360
                                                                        • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                          "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                          6⤵
                                                                            PID:2076
                                                                          • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                            "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                            6⤵
                                                                              PID:3840
                                                                          • C:\Program Files\Java\backup.exe
                                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                            5⤵
                                                                            • Drops file in Program Files directory
                                                                            PID:1260
                                                                            • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                              "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                              6⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:488
                                                                              • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                7⤵
                                                                                  PID:3424
                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                  7⤵
                                                                                  • Drops file in Program Files directory
                                                                                  • System policy modification
                                                                                  PID:2060
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                    8⤵
                                                                                      PID:828
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                      8⤵
                                                                                        PID:3868
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                      7⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:4188
                                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                        8⤵
                                                                                          PID:4460
                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                        7⤵
                                                                                          PID:4600
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                            8⤵
                                                                                              PID:1456
                                                                                        • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                          "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                          6⤵
                                                                                            PID:3560
                                                                                            • C:\Program Files\Java\jre1.8.0_66\bin\data.exe
                                                                                              "C:\Program Files\Java\jre1.8.0_66\bin\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                              7⤵
                                                                                                PID:3624
                                                                                                • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\System Restore.exe
                                                                                                  "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\System Restore.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                  8⤵
                                                                                                    PID:5036
                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\data.exe
                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                    8⤵
                                                                                                      PID:4004
                                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                      8⤵
                                                                                                        PID:1660
                                                                                                • C:\Program Files\Microsoft Office\backup.exe
                                                                                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                  5⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  PID:4492
                                                                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:2120
                                                                                                  • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                    "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                    6⤵
                                                                                                      PID:2040
                                                                                                • C:\Program Files (x86)\backup.exe
                                                                                                  "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                  4⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4684
                                                                                                  • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4780
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in Program Files directory
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4220
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\update.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1296
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                        7⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        • System policy modification
                                                                                                        PID:2444
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                          8⤵
                                                                                                          • Drops file in Program Files directory
                                                                                                          PID:4416
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                            9⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:3992
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                          8⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:2520
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                            9⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • System policy modification
                                                                                                            PID:3344
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                          8⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:1420
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                          8⤵
                                                                                                            PID:4072
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                            8⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:1480
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                              9⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • System policy modification
                                                                                                              PID:2892
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\data.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                            8⤵
                                                                                                              PID:2120
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                9⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • System policy modification
                                                                                                                PID:1760
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                              8⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:3704
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                              8⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • Drops file in Program Files directory
                                                                                                              • System policy modification
                                                                                                              PID:1984
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                9⤵
                                                                                                                  PID:1820
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                8⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • System policy modification
                                                                                                                PID:4448
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                  9⤵
                                                                                                                    PID:2436
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                  8⤵
                                                                                                                    PID:636
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                      9⤵
                                                                                                                        PID:540
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                    7⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • System policy modification
                                                                                                                    PID:1772
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                      8⤵
                                                                                                                        PID:1384
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\data.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                          9⤵
                                                                                                                            PID:968
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                          8⤵
                                                                                                                          • System policy modification
                                                                                                                          PID:4012
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                          8⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:1420
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\System Restore.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                            9⤵
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • System policy modification
                                                                                                                            PID:4468
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                              10⤵
                                                                                                                                PID:1628
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                10⤵
                                                                                                                                  PID:4324
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                    11⤵
                                                                                                                                      PID:4592
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                              7⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:404
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\data.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                8⤵
                                                                                                                                  PID:4288
                                                                                                                          • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                            5⤵
                                                                                                                            • System policy modification
                                                                                                                            PID:3612
                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                              6⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:32
                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                7⤵
                                                                                                                                • System policy modification
                                                                                                                                PID:2796
                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                7⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • System policy modification
                                                                                                                                PID:3616
                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                  8⤵
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  PID:1816
                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                7⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • System policy modification
                                                                                                                                PID:1972
                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                  8⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • System policy modification
                                                                                                                                  PID:1000
                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                7⤵
                                                                                                                                  PID:4056
                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                    8⤵
                                                                                                                                      PID:2960
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                        9⤵
                                                                                                                                          PID:4576
                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                            10⤵
                                                                                                                                              PID:4452
                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                              10⤵
                                                                                                                                                PID:2680
                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                  11⤵
                                                                                                                                                    PID:3892
                                                                                                                                        • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                          6⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • System policy modification
                                                                                                                                          PID:4988
                                                                                                                                          • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                            7⤵
                                                                                                                                              PID:520
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                            6⤵
                                                                                                                                              PID:5100
                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                7⤵
                                                                                                                                                  PID:372
                                                                                                                                            • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                              5⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              PID:2224
                                                                                                                                              • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                6⤵
                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                • System policy modification
                                                                                                                                                PID:1256
                                                                                                                                              • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                6⤵
                                                                                                                                                  PID:4228
                                                                                                                                                • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                  6⤵
                                                                                                                                                    PID:2964
                                                                                                                                              • C:\Users\backup.exe
                                                                                                                                                C:\Users\backup.exe C:\Users\
                                                                                                                                                4⤵
                                                                                                                                                  PID:3556
                                                                                                                                                  • C:\Users\Admin\backup.exe
                                                                                                                                                    C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                    5⤵
                                                                                                                                                      PID:484
                                                                                                                                                      • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                        "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                        6⤵
                                                                                                                                                          PID:1952
                                                                                                                                                        • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                          C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                          6⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          PID:2656
                                                                                                                                                        • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                          C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                          6⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          PID:1892
                                                                                                                                                        • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                          C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                          6⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • System policy modification
                                                                                                                                                          PID:4972
                                                                                                                                                        • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                          C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                          6⤵
                                                                                                                                                            PID:768
                                                                                                                                                          • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                            C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                            6⤵
                                                                                                                                                              PID:1124
                                                                                                                                                            • C:\Users\Admin\Links\update.exe
                                                                                                                                                              C:\Users\Admin\Links\update.exe C:\Users\Admin\Links\
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5112
                                                                                                                                                              • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:1920
                                                                                                                                                                • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                  C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:4012
                                                                                                                                                                • C:\Users\Public\backup.exe
                                                                                                                                                                  C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:3276
                                                                                                                                                                    • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                      C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:3852
                                                                                                                                                                      • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:3808
                                                                                                                                                                        • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                          C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:1908
                                                                                                                                                                      • C:\Windows\backup.exe
                                                                                                                                                                        C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:1716
                                                                                                                                                                        • C:\Windows\addins\backup.exe
                                                                                                                                                                          C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          PID:4824
                                                                                                                                                                        • C:\Windows\appcompat\backup.exe
                                                                                                                                                                          C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:4340
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:4916
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:4888
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:1240
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:1128
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:3472
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:4884
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                                                                                    1⤵
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:2884
                                                                                                                                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:648
                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:2436
                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4880

                                                                                                                                                                        Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9828fe9ca3ab4826f7e593228185338e

                                                                                                                                                                          SHA1

                                                                                                                                                                          5c93028ac6acf20f5f4e4c80aa75b7015916a3b2

                                                                                                                                                                          SHA256

                                                                                                                                                                          0cc79fc058487cd3a91fff5b4f62a5077ad36ebe606634540e447a81eccc8d0e

                                                                                                                                                                          SHA512

                                                                                                                                                                          2d9bb060aeb85b234b49e144c1f8e371f48ef3d388dd76a3d4b041e0fe3cd3b2c618f75d87e460fceb633e9b3d1caaf40c58b62436b09bfc5f117359822717a5

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9828fe9ca3ab4826f7e593228185338e

                                                                                                                                                                          SHA1

                                                                                                                                                                          5c93028ac6acf20f5f4e4c80aa75b7015916a3b2

                                                                                                                                                                          SHA256

                                                                                                                                                                          0cc79fc058487cd3a91fff5b4f62a5077ad36ebe606634540e447a81eccc8d0e

                                                                                                                                                                          SHA512

                                                                                                                                                                          2d9bb060aeb85b234b49e144c1f8e371f48ef3d388dd76a3d4b041e0fe3cd3b2c618f75d87e460fceb633e9b3d1caaf40c58b62436b09bfc5f117359822717a5

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a9368fc522e7362e01520d7d0152ecfc

                                                                                                                                                                          SHA1

                                                                                                                                                                          f3fba6d103973099dfe9a1ff3c0338310997d6fd

                                                                                                                                                                          SHA256

                                                                                                                                                                          2016cc600a8dccad1371506d6765d7d072fec0ab8aa13a07b585834b5cfb5348

                                                                                                                                                                          SHA512

                                                                                                                                                                          d8e30b476685280e15017296680038654a66ebc952658fc06009105a6b1fe8d42b07a83d91ad650f870353dab771f312435a9663a830f83fdaf3f62c9d0b0660

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a9368fc522e7362e01520d7d0152ecfc

                                                                                                                                                                          SHA1

                                                                                                                                                                          f3fba6d103973099dfe9a1ff3c0338310997d6fd

                                                                                                                                                                          SHA256

                                                                                                                                                                          2016cc600a8dccad1371506d6765d7d072fec0ab8aa13a07b585834b5cfb5348

                                                                                                                                                                          SHA512

                                                                                                                                                                          d8e30b476685280e15017296680038654a66ebc952658fc06009105a6b1fe8d42b07a83d91ad650f870353dab771f312435a9663a830f83fdaf3f62c9d0b0660

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          1b4cc8985f302e96ab50437aff0930ab

                                                                                                                                                                          SHA1

                                                                                                                                                                          fe66290f67061eb9885faee6b568bd8d9646b9ae

                                                                                                                                                                          SHA256

                                                                                                                                                                          ce9919ef6abe97f1881a0d6c6f64dd6b1d35b6300c36b9c661aa2740f86f14f3

                                                                                                                                                                          SHA512

                                                                                                                                                                          85d9f5a13021a30529172b698d5cfd53956042e0eb0efb7a93f15f4916fdaa7664ee07d442ef71b6888caf146cd906bf854056a58bcab77ab13786272c11dd9e

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          1b4cc8985f302e96ab50437aff0930ab

                                                                                                                                                                          SHA1

                                                                                                                                                                          fe66290f67061eb9885faee6b568bd8d9646b9ae

                                                                                                                                                                          SHA256

                                                                                                                                                                          ce9919ef6abe97f1881a0d6c6f64dd6b1d35b6300c36b9c661aa2740f86f14f3

                                                                                                                                                                          SHA512

                                                                                                                                                                          85d9f5a13021a30529172b698d5cfd53956042e0eb0efb7a93f15f4916fdaa7664ee07d442ef71b6888caf146cd906bf854056a58bcab77ab13786272c11dd9e

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\data.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          4e25f8147064df00adf6e41daf46c820

                                                                                                                                                                          SHA1

                                                                                                                                                                          abf031fbb60d310e08f1f23ff333bcafb29b095b

                                                                                                                                                                          SHA256

                                                                                                                                                                          9f76ac6710fa14ea1f802449777740fb7a66ce5abf2f1e5f0ea288389fbe9e77

                                                                                                                                                                          SHA512

                                                                                                                                                                          d9645dfeaa10bc7e33d8b1d783ded173843e915800b5a727fd56b019b33c4d9b0c8c2d4d256d61243a97534b23b41c63a3c8e51a3d015226080d8764e8f67357

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\DESIGNER\data.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          4e25f8147064df00adf6e41daf46c820

                                                                                                                                                                          SHA1

                                                                                                                                                                          abf031fbb60d310e08f1f23ff333bcafb29b095b

                                                                                                                                                                          SHA256

                                                                                                                                                                          9f76ac6710fa14ea1f802449777740fb7a66ce5abf2f1e5f0ea288389fbe9e77

                                                                                                                                                                          SHA512

                                                                                                                                                                          d9645dfeaa10bc7e33d8b1d783ded173843e915800b5a727fd56b019b33c4d9b0c8c2d4d256d61243a97534b23b41c63a3c8e51a3d015226080d8764e8f67357

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7fa49950d88db9b71dea6527b9c43318

                                                                                                                                                                          SHA1

                                                                                                                                                                          9420ac2d200079e7e75d69c5bb90f69aa12c8385

                                                                                                                                                                          SHA256

                                                                                                                                                                          d4d5bb7df7c329564bc164da3bb3f6f014a8c8d049f6fc287b117682dfee365b

                                                                                                                                                                          SHA512

                                                                                                                                                                          a61b11d48034c68d85e12c0f0bcee7cccbac2b37eff6b16f72c3fa3f711856cccdd70028015842fd7b1254deebcd6043bc01b32cba316fbdcb6c7cfb0610649e

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7fa49950d88db9b71dea6527b9c43318

                                                                                                                                                                          SHA1

                                                                                                                                                                          9420ac2d200079e7e75d69c5bb90f69aa12c8385

                                                                                                                                                                          SHA256

                                                                                                                                                                          d4d5bb7df7c329564bc164da3bb3f6f014a8c8d049f6fc287b117682dfee365b

                                                                                                                                                                          SHA512

                                                                                                                                                                          a61b11d48034c68d85e12c0f0bcee7cccbac2b37eff6b16f72c3fa3f711856cccdd70028015842fd7b1254deebcd6043bc01b32cba316fbdcb6c7cfb0610649e

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f7626ca5a32049d93b3602362b4bed31

                                                                                                                                                                          SHA1

                                                                                                                                                                          3f08dba1b784f1c8555e0875912b372240db0e9c

                                                                                                                                                                          SHA256

                                                                                                                                                                          734e98df5aa96a365d3778caea9988fbfb281b292ce990caa69966d1f34516e9

                                                                                                                                                                          SHA512

                                                                                                                                                                          e3cc452b9063b8e44a9ebb26bfc0516b9d20d5a4ad43fbf2846f82fe8439cc37dedd1b44262aee502729558914441e4d17f33b140275a7d2a4a80ac33d757b3f

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f7626ca5a32049d93b3602362b4bed31

                                                                                                                                                                          SHA1

                                                                                                                                                                          3f08dba1b784f1c8555e0875912b372240db0e9c

                                                                                                                                                                          SHA256

                                                                                                                                                                          734e98df5aa96a365d3778caea9988fbfb281b292ce990caa69966d1f34516e9

                                                                                                                                                                          SHA512

                                                                                                                                                                          e3cc452b9063b8e44a9ebb26bfc0516b9d20d5a4ad43fbf2846f82fe8439cc37dedd1b44262aee502729558914441e4d17f33b140275a7d2a4a80ac33d757b3f

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          4e25f8147064df00adf6e41daf46c820

                                                                                                                                                                          SHA1

                                                                                                                                                                          abf031fbb60d310e08f1f23ff333bcafb29b095b

                                                                                                                                                                          SHA256

                                                                                                                                                                          9f76ac6710fa14ea1f802449777740fb7a66ce5abf2f1e5f0ea288389fbe9e77

                                                                                                                                                                          SHA512

                                                                                                                                                                          d9645dfeaa10bc7e33d8b1d783ded173843e915800b5a727fd56b019b33c4d9b0c8c2d4d256d61243a97534b23b41c63a3c8e51a3d015226080d8764e8f67357

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          4e25f8147064df00adf6e41daf46c820

                                                                                                                                                                          SHA1

                                                                                                                                                                          abf031fbb60d310e08f1f23ff333bcafb29b095b

                                                                                                                                                                          SHA256

                                                                                                                                                                          9f76ac6710fa14ea1f802449777740fb7a66ce5abf2f1e5f0ea288389fbe9e77

                                                                                                                                                                          SHA512

                                                                                                                                                                          d9645dfeaa10bc7e33d8b1d783ded173843e915800b5a727fd56b019b33c4d9b0c8c2d4d256d61243a97534b23b41c63a3c8e51a3d015226080d8764e8f67357

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          11a6831fcde09918e11336c77954adb9

                                                                                                                                                                          SHA1

                                                                                                                                                                          66bee86bc0214ca78e70c7413b1ef705c73f64e8

                                                                                                                                                                          SHA256

                                                                                                                                                                          c425a53a758917a912771eab19cf5fcaf62f30f8790787e9d96f2dbfc4ff66dc

                                                                                                                                                                          SHA512

                                                                                                                                                                          0dac5d0fa6467e1129515793aac0ff9d4eea0c515d7d340cb30dd21a1d7cbadebe881afd3efac6a946a7ac69120528317e6526adcf7b026e292fe975e7e6229a

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          11a6831fcde09918e11336c77954adb9

                                                                                                                                                                          SHA1

                                                                                                                                                                          66bee86bc0214ca78e70c7413b1ef705c73f64e8

                                                                                                                                                                          SHA256

                                                                                                                                                                          c425a53a758917a912771eab19cf5fcaf62f30f8790787e9d96f2dbfc4ff66dc

                                                                                                                                                                          SHA512

                                                                                                                                                                          0dac5d0fa6467e1129515793aac0ff9d4eea0c515d7d340cb30dd21a1d7cbadebe881afd3efac6a946a7ac69120528317e6526adcf7b026e292fe975e7e6229a

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f7626ca5a32049d93b3602362b4bed31

                                                                                                                                                                          SHA1

                                                                                                                                                                          3f08dba1b784f1c8555e0875912b372240db0e9c

                                                                                                                                                                          SHA256

                                                                                                                                                                          734e98df5aa96a365d3778caea9988fbfb281b292ce990caa69966d1f34516e9

                                                                                                                                                                          SHA512

                                                                                                                                                                          e3cc452b9063b8e44a9ebb26bfc0516b9d20d5a4ad43fbf2846f82fe8439cc37dedd1b44262aee502729558914441e4d17f33b140275a7d2a4a80ac33d757b3f

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f7626ca5a32049d93b3602362b4bed31

                                                                                                                                                                          SHA1

                                                                                                                                                                          3f08dba1b784f1c8555e0875912b372240db0e9c

                                                                                                                                                                          SHA256

                                                                                                                                                                          734e98df5aa96a365d3778caea9988fbfb281b292ce990caa69966d1f34516e9

                                                                                                                                                                          SHA512

                                                                                                                                                                          e3cc452b9063b8e44a9ebb26bfc0516b9d20d5a4ad43fbf2846f82fe8439cc37dedd1b44262aee502729558914441e4d17f33b140275a7d2a4a80ac33d757b3f

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          11a6831fcde09918e11336c77954adb9

                                                                                                                                                                          SHA1

                                                                                                                                                                          66bee86bc0214ca78e70c7413b1ef705c73f64e8

                                                                                                                                                                          SHA256

                                                                                                                                                                          c425a53a758917a912771eab19cf5fcaf62f30f8790787e9d96f2dbfc4ff66dc

                                                                                                                                                                          SHA512

                                                                                                                                                                          0dac5d0fa6467e1129515793aac0ff9d4eea0c515d7d340cb30dd21a1d7cbadebe881afd3efac6a946a7ac69120528317e6526adcf7b026e292fe975e7e6229a

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          11a6831fcde09918e11336c77954adb9

                                                                                                                                                                          SHA1

                                                                                                                                                                          66bee86bc0214ca78e70c7413b1ef705c73f64e8

                                                                                                                                                                          SHA256

                                                                                                                                                                          c425a53a758917a912771eab19cf5fcaf62f30f8790787e9d96f2dbfc4ff66dc

                                                                                                                                                                          SHA512

                                                                                                                                                                          0dac5d0fa6467e1129515793aac0ff9d4eea0c515d7d340cb30dd21a1d7cbadebe881afd3efac6a946a7ac69120528317e6526adcf7b026e292fe975e7e6229a

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          11a6831fcde09918e11336c77954adb9

                                                                                                                                                                          SHA1

                                                                                                                                                                          66bee86bc0214ca78e70c7413b1ef705c73f64e8

                                                                                                                                                                          SHA256

                                                                                                                                                                          c425a53a758917a912771eab19cf5fcaf62f30f8790787e9d96f2dbfc4ff66dc

                                                                                                                                                                          SHA512

                                                                                                                                                                          0dac5d0fa6467e1129515793aac0ff9d4eea0c515d7d340cb30dd21a1d7cbadebe881afd3efac6a946a7ac69120528317e6526adcf7b026e292fe975e7e6229a

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          11a6831fcde09918e11336c77954adb9

                                                                                                                                                                          SHA1

                                                                                                                                                                          66bee86bc0214ca78e70c7413b1ef705c73f64e8

                                                                                                                                                                          SHA256

                                                                                                                                                                          c425a53a758917a912771eab19cf5fcaf62f30f8790787e9d96f2dbfc4ff66dc

                                                                                                                                                                          SHA512

                                                                                                                                                                          0dac5d0fa6467e1129515793aac0ff9d4eea0c515d7d340cb30dd21a1d7cbadebe881afd3efac6a946a7ac69120528317e6526adcf7b026e292fe975e7e6229a

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          861afb7f78489c9c818eed94c0161b9e

                                                                                                                                                                          SHA1

                                                                                                                                                                          57ded564e5c346e33089bfec908a8fbc0625420d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5ca3801d13211ac710d1686794cd5f069ecde63825a62fe5440dda8f9540f383

                                                                                                                                                                          SHA512

                                                                                                                                                                          f20cdaa5362fbae45efd3206a1f8c13d31331892978b749160d8fbc38ba6fd784dc7e250664c121813c47aae847872be201d816ee144ff592fd80c0e47d94e01

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          861afb7f78489c9c818eed94c0161b9e

                                                                                                                                                                          SHA1

                                                                                                                                                                          57ded564e5c346e33089bfec908a8fbc0625420d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5ca3801d13211ac710d1686794cd5f069ecde63825a62fe5440dda8f9540f383

                                                                                                                                                                          SHA512

                                                                                                                                                                          f20cdaa5362fbae45efd3206a1f8c13d31331892978b749160d8fbc38ba6fd784dc7e250664c121813c47aae847872be201d816ee144ff592fd80c0e47d94e01

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          861afb7f78489c9c818eed94c0161b9e

                                                                                                                                                                          SHA1

                                                                                                                                                                          57ded564e5c346e33089bfec908a8fbc0625420d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5ca3801d13211ac710d1686794cd5f069ecde63825a62fe5440dda8f9540f383

                                                                                                                                                                          SHA512

                                                                                                                                                                          f20cdaa5362fbae45efd3206a1f8c13d31331892978b749160d8fbc38ba6fd784dc7e250664c121813c47aae847872be201d816ee144ff592fd80c0e47d94e01

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          861afb7f78489c9c818eed94c0161b9e

                                                                                                                                                                          SHA1

                                                                                                                                                                          57ded564e5c346e33089bfec908a8fbc0625420d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5ca3801d13211ac710d1686794cd5f069ecde63825a62fe5440dda8f9540f383

                                                                                                                                                                          SHA512

                                                                                                                                                                          f20cdaa5362fbae45efd3206a1f8c13d31331892978b749160d8fbc38ba6fd784dc7e250664c121813c47aae847872be201d816ee144ff592fd80c0e47d94e01

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          861afb7f78489c9c818eed94c0161b9e

                                                                                                                                                                          SHA1

                                                                                                                                                                          57ded564e5c346e33089bfec908a8fbc0625420d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5ca3801d13211ac710d1686794cd5f069ecde63825a62fe5440dda8f9540f383

                                                                                                                                                                          SHA512

                                                                                                                                                                          f20cdaa5362fbae45efd3206a1f8c13d31331892978b749160d8fbc38ba6fd784dc7e250664c121813c47aae847872be201d816ee144ff592fd80c0e47d94e01

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          861afb7f78489c9c818eed94c0161b9e

                                                                                                                                                                          SHA1

                                                                                                                                                                          57ded564e5c346e33089bfec908a8fbc0625420d

                                                                                                                                                                          SHA256

                                                                                                                                                                          5ca3801d13211ac710d1686794cd5f069ecde63825a62fe5440dda8f9540f383

                                                                                                                                                                          SHA512

                                                                                                                                                                          f20cdaa5362fbae45efd3206a1f8c13d31331892978b749160d8fbc38ba6fd784dc7e250664c121813c47aae847872be201d816ee144ff592fd80c0e47d94e01

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\en-US\System Restore.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb7c693b81030ea78ec35b34898bd4e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          75a1f0111e48921a9e1616a64225683f0b2eae19

                                                                                                                                                                          SHA256

                                                                                                                                                                          8b14e0b57d95a391a16de1718af795cf29eb4a0e088bcf92f3e3e2922e57d484

                                                                                                                                                                          SHA512

                                                                                                                                                                          79f919bfd11aedaa28c27a7c358dd49f3e1fd1149c95c9cf82fe2bc164339885eb0f91115326fc3f67e587becfd3964839433d0cb0bac9b275e73b84156007ab

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb31a08811f9a2235b81625435c86e99

                                                                                                                                                                          SHA1

                                                                                                                                                                          dde1c49631d03cbcb10e8276da53058423978734

                                                                                                                                                                          SHA256

                                                                                                                                                                          b141e70331b8462069e171d550581bc84c9933a67fac407b3cddc565a280d8a9

                                                                                                                                                                          SHA512

                                                                                                                                                                          a149f8b1d65d530f0ad61a79b412296a400c2ea2f1cb2f1f5db6bc6e28f3cf7844d5dde2b58c9b27d5d37900948382eb2187b5b5281b7de2283870e057213516

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb31a08811f9a2235b81625435c86e99

                                                                                                                                                                          SHA1

                                                                                                                                                                          dde1c49631d03cbcb10e8276da53058423978734

                                                                                                                                                                          SHA256

                                                                                                                                                                          b141e70331b8462069e171d550581bc84c9933a67fac407b3cddc565a280d8a9

                                                                                                                                                                          SHA512

                                                                                                                                                                          a149f8b1d65d530f0ad61a79b412296a400c2ea2f1cb2f1f5db6bc6e28f3cf7844d5dde2b58c9b27d5d37900948382eb2187b5b5281b7de2283870e057213516

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb31a08811f9a2235b81625435c86e99

                                                                                                                                                                          SHA1

                                                                                                                                                                          dde1c49631d03cbcb10e8276da53058423978734

                                                                                                                                                                          SHA256

                                                                                                                                                                          b141e70331b8462069e171d550581bc84c9933a67fac407b3cddc565a280d8a9

                                                                                                                                                                          SHA512

                                                                                                                                                                          a149f8b1d65d530f0ad61a79b412296a400c2ea2f1cb2f1f5db6bc6e28f3cf7844d5dde2b58c9b27d5d37900948382eb2187b5b5281b7de2283870e057213516

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb31a08811f9a2235b81625435c86e99

                                                                                                                                                                          SHA1

                                                                                                                                                                          dde1c49631d03cbcb10e8276da53058423978734

                                                                                                                                                                          SHA256

                                                                                                                                                                          b141e70331b8462069e171d550581bc84c9933a67fac407b3cddc565a280d8a9

                                                                                                                                                                          SHA512

                                                                                                                                                                          a149f8b1d65d530f0ad61a79b412296a400c2ea2f1cb2f1f5db6bc6e28f3cf7844d5dde2b58c9b27d5d37900948382eb2187b5b5281b7de2283870e057213516

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb31a08811f9a2235b81625435c86e99

                                                                                                                                                                          SHA1

                                                                                                                                                                          dde1c49631d03cbcb10e8276da53058423978734

                                                                                                                                                                          SHA256

                                                                                                                                                                          b141e70331b8462069e171d550581bc84c9933a67fac407b3cddc565a280d8a9

                                                                                                                                                                          SHA512

                                                                                                                                                                          a149f8b1d65d530f0ad61a79b412296a400c2ea2f1cb2f1f5db6bc6e28f3cf7844d5dde2b58c9b27d5d37900948382eb2187b5b5281b7de2283870e057213516

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb31a08811f9a2235b81625435c86e99

                                                                                                                                                                          SHA1

                                                                                                                                                                          dde1c49631d03cbcb10e8276da53058423978734

                                                                                                                                                                          SHA256

                                                                                                                                                                          b141e70331b8462069e171d550581bc84c9933a67fac407b3cddc565a280d8a9

                                                                                                                                                                          SHA512

                                                                                                                                                                          a149f8b1d65d530f0ad61a79b412296a400c2ea2f1cb2f1f5db6bc6e28f3cf7844d5dde2b58c9b27d5d37900948382eb2187b5b5281b7de2283870e057213516

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9828fe9ca3ab4826f7e593228185338e

                                                                                                                                                                          SHA1

                                                                                                                                                                          5c93028ac6acf20f5f4e4c80aa75b7015916a3b2

                                                                                                                                                                          SHA256

                                                                                                                                                                          0cc79fc058487cd3a91fff5b4f62a5077ad36ebe606634540e447a81eccc8d0e

                                                                                                                                                                          SHA512

                                                                                                                                                                          2d9bb060aeb85b234b49e144c1f8e371f48ef3d388dd76a3d4b041e0fe3cd3b2c618f75d87e460fceb633e9b3d1caaf40c58b62436b09bfc5f117359822717a5

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9828fe9ca3ab4826f7e593228185338e

                                                                                                                                                                          SHA1

                                                                                                                                                                          5c93028ac6acf20f5f4e4c80aa75b7015916a3b2

                                                                                                                                                                          SHA256

                                                                                                                                                                          0cc79fc058487cd3a91fff5b4f62a5077ad36ebe606634540e447a81eccc8d0e

                                                                                                                                                                          SHA512

                                                                                                                                                                          2d9bb060aeb85b234b49e144c1f8e371f48ef3d388dd76a3d4b041e0fe3cd3b2c618f75d87e460fceb633e9b3d1caaf40c58b62436b09bfc5f117359822717a5

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\971075890\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ee9b1b223a31853a8eaef727a1185c72

                                                                                                                                                                          SHA1

                                                                                                                                                                          2311e48d06dd34ef8d2e6b0dc9f5475e535c1871

                                                                                                                                                                          SHA256

                                                                                                                                                                          c4c52fa48ec9b909f17f7f4e332b1a88cddc88faf9ef7a0f822b3cd88d992a6d

                                                                                                                                                                          SHA512

                                                                                                                                                                          3b0a1923120a0781d4777036d471c06e4324742a37a01acc59d634e2b52c1b59f3f3c10138a1a810f6c0cfc02b08e7a5c6e98b1b3b61fc30582899aae4943182

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\971075890\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          ee9b1b223a31853a8eaef727a1185c72

                                                                                                                                                                          SHA1

                                                                                                                                                                          2311e48d06dd34ef8d2e6b0dc9f5475e535c1871

                                                                                                                                                                          SHA256

                                                                                                                                                                          c4c52fa48ec9b909f17f7f4e332b1a88cddc88faf9ef7a0f822b3cd88d992a6d

                                                                                                                                                                          SHA512

                                                                                                                                                                          3b0a1923120a0781d4777036d471c06e4324742a37a01acc59d634e2b52c1b59f3f3c10138a1a810f6c0cfc02b08e7a5c6e98b1b3b61fc30582899aae4943182

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          aacfc8d9279c3d512f22efafd9848667

                                                                                                                                                                          SHA1

                                                                                                                                                                          06b1fac74ef90c31de0b5dfe326e054dfc6ada55

                                                                                                                                                                          SHA256

                                                                                                                                                                          b6ab6be54da4a6b3512032081ed34f850fc4c89236181090422e3f4df7f943e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          eb0da1421a6afcc5a9dd372eb7981e063e0a7c527f0419600a3096e0f22c27df61e3cc56b19c19390335049c4601b0b5a84ee34446e5f8c8db4118d72070bf34

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          aacfc8d9279c3d512f22efafd9848667

                                                                                                                                                                          SHA1

                                                                                                                                                                          06b1fac74ef90c31de0b5dfe326e054dfc6ada55

                                                                                                                                                                          SHA256

                                                                                                                                                                          b6ab6be54da4a6b3512032081ed34f850fc4c89236181090422e3f4df7f943e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          eb0da1421a6afcc5a9dd372eb7981e063e0a7c527f0419600a3096e0f22c27df61e3cc56b19c19390335049c4601b0b5a84ee34446e5f8c8db4118d72070bf34

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f52e977c4939fdf16a3ecbe926308011

                                                                                                                                                                          SHA1

                                                                                                                                                                          3bd17d5cf147d1f191a88004ebbc7b611c870a85

                                                                                                                                                                          SHA256

                                                                                                                                                                          498e2c6a884052c779a6cfbbbc1b9ec71ccc460f7895f95fa05b23a2f1c8f012

                                                                                                                                                                          SHA512

                                                                                                                                                                          9ef5eb4289b62c031e5e1bb5afff0a8608bd2fe446d464342c0681f881e3a40f5d9e4fc3bad528f8dc5004959b54be2c085c2f8f49cfb993e45e354107630011

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          f52e977c4939fdf16a3ecbe926308011

                                                                                                                                                                          SHA1

                                                                                                                                                                          3bd17d5cf147d1f191a88004ebbc7b611c870a85

                                                                                                                                                                          SHA256

                                                                                                                                                                          498e2c6a884052c779a6cfbbbc1b9ec71ccc460f7895f95fa05b23a2f1c8f012

                                                                                                                                                                          SHA512

                                                                                                                                                                          9ef5eb4289b62c031e5e1bb5afff0a8608bd2fe446d464342c0681f881e3a40f5d9e4fc3bad528f8dc5004959b54be2c085c2f8f49cfb993e45e354107630011

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3b543dbe5d3dbe8133b6a8ea2ef58781

                                                                                                                                                                          SHA1

                                                                                                                                                                          e4c2e8c1d28ef90d85366e3b6544028b87c5c060

                                                                                                                                                                          SHA256

                                                                                                                                                                          92e14cb5726b084234df261ba8182a4c4578ea72b8c0d209964fa455e3ec778a

                                                                                                                                                                          SHA512

                                                                                                                                                                          ff43635b2fe426f5396b4080ccfce4158f01c5580a04a8985786561b894e27b2e3c94315e9a510cb1d5bcf0ca4b79647d431ac7be0c0238001bc59a9670211cf

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3b543dbe5d3dbe8133b6a8ea2ef58781

                                                                                                                                                                          SHA1

                                                                                                                                                                          e4c2e8c1d28ef90d85366e3b6544028b87c5c060

                                                                                                                                                                          SHA256

                                                                                                                                                                          92e14cb5726b084234df261ba8182a4c4578ea72b8c0d209964fa455e3ec778a

                                                                                                                                                                          SHA512

                                                                                                                                                                          ff43635b2fe426f5396b4080ccfce4158f01c5580a04a8985786561b894e27b2e3c94315e9a510cb1d5bcf0ca4b79647d431ac7be0c0238001bc59a9670211cf

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          aacfc8d9279c3d512f22efafd9848667

                                                                                                                                                                          SHA1

                                                                                                                                                                          06b1fac74ef90c31de0b5dfe326e054dfc6ada55

                                                                                                                                                                          SHA256

                                                                                                                                                                          b6ab6be54da4a6b3512032081ed34f850fc4c89236181090422e3f4df7f943e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          eb0da1421a6afcc5a9dd372eb7981e063e0a7c527f0419600a3096e0f22c27df61e3cc56b19c19390335049c4601b0b5a84ee34446e5f8c8db4118d72070bf34

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          aacfc8d9279c3d512f22efafd9848667

                                                                                                                                                                          SHA1

                                                                                                                                                                          06b1fac74ef90c31de0b5dfe326e054dfc6ada55

                                                                                                                                                                          SHA256

                                                                                                                                                                          b6ab6be54da4a6b3512032081ed34f850fc4c89236181090422e3f4df7f943e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          eb0da1421a6afcc5a9dd372eb7981e063e0a7c527f0419600a3096e0f22c27df61e3cc56b19c19390335049c4601b0b5a84ee34446e5f8c8db4118d72070bf34

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          aacfc8d9279c3d512f22efafd9848667

                                                                                                                                                                          SHA1

                                                                                                                                                                          06b1fac74ef90c31de0b5dfe326e054dfc6ada55

                                                                                                                                                                          SHA256

                                                                                                                                                                          b6ab6be54da4a6b3512032081ed34f850fc4c89236181090422e3f4df7f943e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          eb0da1421a6afcc5a9dd372eb7981e063e0a7c527f0419600a3096e0f22c27df61e3cc56b19c19390335049c4601b0b5a84ee34446e5f8c8db4118d72070bf34

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          aacfc8d9279c3d512f22efafd9848667

                                                                                                                                                                          SHA1

                                                                                                                                                                          06b1fac74ef90c31de0b5dfe326e054dfc6ada55

                                                                                                                                                                          SHA256

                                                                                                                                                                          b6ab6be54da4a6b3512032081ed34f850fc4c89236181090422e3f4df7f943e8

                                                                                                                                                                          SHA512

                                                                                                                                                                          eb0da1421a6afcc5a9dd372eb7981e063e0a7c527f0419600a3096e0f22c27df61e3cc56b19c19390335049c4601b0b5a84ee34446e5f8c8db4118d72070bf34

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          18f22e1149670df2dae49767dfba7f9f

                                                                                                                                                                          SHA1

                                                                                                                                                                          dd2a22064801c017bf1c9300eb78a5e1aac6710d

                                                                                                                                                                          SHA256

                                                                                                                                                                          e30f30d949dadc7491dc2b12d1526056370bad2feb92ab25b5f46db9caeee8d6

                                                                                                                                                                          SHA512

                                                                                                                                                                          b1257e11522ae917459c0d2b13d6f5a3f8ad326cbf3ad03d80272465874ab79dd292aceeef8b55c524e8ce3dec0f9cf059189fba8e7b5d388e002d2eabf30982

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          18f22e1149670df2dae49767dfba7f9f

                                                                                                                                                                          SHA1

                                                                                                                                                                          dd2a22064801c017bf1c9300eb78a5e1aac6710d

                                                                                                                                                                          SHA256

                                                                                                                                                                          e30f30d949dadc7491dc2b12d1526056370bad2feb92ab25b5f46db9caeee8d6

                                                                                                                                                                          SHA512

                                                                                                                                                                          b1257e11522ae917459c0d2b13d6f5a3f8ad326cbf3ad03d80272465874ab79dd292aceeef8b55c524e8ce3dec0f9cf059189fba8e7b5d388e002d2eabf30982

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3ce1c7d585e7da572121308b7330ffc8

                                                                                                                                                                          SHA1

                                                                                                                                                                          6aaf7e1b656f4d3d4420642572a3f43406154923

                                                                                                                                                                          SHA256

                                                                                                                                                                          7621bd2558c3ae1a1779e98901a7eef437f70a438b5c426c55162ce0fa410313

                                                                                                                                                                          SHA512

                                                                                                                                                                          bd6904998f7d21193fadfbed452d29150b8e80dc840ab7ba03d9ca862ad0400e9e97a151edfeb3bddcb1b578d013e8a37f31284a8220464331823164fe02ecd8

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          3ce1c7d585e7da572121308b7330ffc8

                                                                                                                                                                          SHA1

                                                                                                                                                                          6aaf7e1b656f4d3d4420642572a3f43406154923

                                                                                                                                                                          SHA256

                                                                                                                                                                          7621bd2558c3ae1a1779e98901a7eef437f70a438b5c426c55162ce0fa410313

                                                                                                                                                                          SHA512

                                                                                                                                                                          bd6904998f7d21193fadfbed452d29150b8e80dc840ab7ba03d9ca862ad0400e9e97a151edfeb3bddcb1b578d013e8a37f31284a8220464331823164fe02ecd8

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\odt\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          c5e06aab353b54c0d6ed6ca74f70da0d

                                                                                                                                                                          SHA1

                                                                                                                                                                          692394f526d04f5d51e329de0c327b505a4fef5b

                                                                                                                                                                          SHA256

                                                                                                                                                                          030ccaa9755de1fe1ff443aafdc640edd21466d9f52f67d6b549ef02885bd362

                                                                                                                                                                          SHA512

                                                                                                                                                                          f5948f5e018927efd05ab79dbc4adb0e54bf6135aaaae1d3d4ad8ee25313e006722fb6c185c98bb065482a8300be7e374980fecb0f0ee69a860ac6d629d4a6eb

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • C:\odt\backup.exe
                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                          MD5

                                                                                                                                                                          c5e06aab353b54c0d6ed6ca74f70da0d

                                                                                                                                                                          SHA1

                                                                                                                                                                          692394f526d04f5d51e329de0c327b505a4fef5b

                                                                                                                                                                          SHA256

                                                                                                                                                                          030ccaa9755de1fe1ff443aafdc640edd21466d9f52f67d6b549ef02885bd362

                                                                                                                                                                          SHA512

                                                                                                                                                                          f5948f5e018927efd05ab79dbc4adb0e54bf6135aaaae1d3d4ad8ee25313e006722fb6c185c98bb065482a8300be7e374980fecb0f0ee69a860ac6d629d4a6eb

                                                                                                                                                                          Download Submit