Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

bc722eb724...be.exe

windows7-x64

10

bc722eb724...be.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    208s
  • max time network
    231s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 17:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc722eb724004fdeef3bfcb405ef89adbb24257f451bf8c611a2bb1984a242be.exe

  • Size

    72KB

  • MD5

    024c35416b90e3c9347244397b250331

  • SHA1

    23ac21da102126e203aa1b9cb9c7f176e45dd783

  • SHA256

    bc722eb724004fdeef3bfcb405ef89adbb24257f451bf8c611a2bb1984a242be

  • SHA512

    ab9a20b4a37223296035fe81db42b002da437bca8bb40dc5d7ea4f42fcf9e41402e9cea14c9608fbe9b7eceb31724eab898e762414b36de080a4f96d43947c0d

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2z:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr/

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc722eb724004fdeef3bfcb405ef89adbb24257f451bf8c611a2bb1984a242be.exe
    "C:\Users\Admin\AppData\Local\Temp\bc722eb724004fdeef3bfcb405ef89adbb24257f451bf8c611a2bb1984a242be.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3376
    • C:\Users\Admin\AppData\Local\Temp\2991090794\System Restore.exe
      "C:\Users\Admin\AppData\Local\Temp\2991090794\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\2991090794\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4636
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1204
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1296
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2532
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:216
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3336
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3716
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:664
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4796
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4128
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1964
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:904
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4928
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1504
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3984
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2164
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3668
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4280
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3640
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3168
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2988
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4324
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3604
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1808
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1996
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4108
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3560
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\System Restore.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    PID:1680
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:332
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                      PID:3776
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                      9⤵
                      • Disables RegEdit via registry modification
                      PID:588
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                        PID:3624
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                        9⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:4268
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                        9⤵
                          PID:4404
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                          9⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:1996
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\data.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                          9⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:3660
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                          9⤵
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:5024
                      • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:4688
                      • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                        8⤵
                        • System policy modification
                        PID:2852
                      • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\update.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        PID:1648
                      • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                        8⤵
                          PID:840
                        • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                          8⤵
                            PID:1068
                          • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:3472
                          • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                            8⤵
                              PID:408
                            • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:3236
                            • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                              8⤵
                                PID:3164
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1460
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:3100
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:2740
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2312
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2788
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3060
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                8⤵
                                  PID:3336
                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1112
                                • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                  8⤵
                                    PID:3780
                                • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  PID:4012
                                • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                  7⤵
                                    PID:3984
                                  • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • System policy modification
                                    PID:1076
                                  • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Drops file in Program Files directory
                                    PID:1276
                                    • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                      8⤵
                                      • Disables RegEdit via registry modification
                                      PID:3788
                                  • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                    7⤵
                                    • System policy modification
                                    PID:5040
                                    • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:3720
                                  • C:\Program Files\Common Files\microsoft shared\VSTO\update.exe
                                    "C:\Program Files\Common Files\microsoft shared\VSTO\update.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:1492
                                  • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:3684
                                  • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                    7⤵
                                      PID:4352
                                  • C:\Program Files\Common Files\Services\backup.exe
                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2952
                                  • C:\Program Files\Common Files\System\backup.exe
                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2276
                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2420
                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:4768
                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1560
                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                        • Executes dropped EXE
                                        PID:2440
                                      • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                        8⤵
                                        • System policy modification
                                        PID:4576
                                      • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:1964
                                        • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                          "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                          9⤵
                                          • System policy modification
                                          PID:400
                                      • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                        8⤵
                                        • System policy modification
                                        PID:3236
                                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:3688
                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:4808
                                    • C:\Program Files\Common Files\System\es-ES\backup.exe
                                      "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                      7⤵
                                        PID:3132
                                      • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • System policy modification
                                        PID:4484
                                      • C:\Program Files\Common Files\System\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                        7⤵
                                        • Disables RegEdit via registry modification
                                        PID:4384
                                      • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                        7⤵
                                        • Disables RegEdit via registry modification
                                        PID:2412
                                      • C:\Program Files\Common Files\System\msadc\backup.exe
                                        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                        7⤵
                                        • Drops file in Program Files directory
                                        • System policy modification
                                        PID:4256
                                        • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                          8⤵
                                          • System policy modification
                                          PID:4612
                                        • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                          "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                          8⤵
                                            PID:1964
                                        • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                          "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                          7⤵
                                            PID:3108
                                            • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                              "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                              8⤵
                                                PID:2304
                                        • C:\Program Files\Google\backup.exe
                                          "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2196
                                          • C:\Program Files\Google\Chrome\backup.exe
                                            "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                            6⤵
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3340
                                            • C:\Program Files\Google\Chrome\Application\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:388
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3312
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                  9⤵
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:4584
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                  9⤵
                                                  • Disables RegEdit via registry modification
                                                  PID:5008
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                  9⤵
                                                    PID:2152
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                    9⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:4084
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                    9⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:2448
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                      10⤵
                                                        PID:1868
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                      9⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      PID:628
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                      9⤵
                                                        PID:4304
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                        9⤵
                                                        • Drops file in Program Files directory
                                                        PID:1408
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                          10⤵
                                                          • Drops file in Program Files directory
                                                          PID:3780
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                            11⤵
                                                            • System policy modification
                                                            PID:932
                                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System policy modification
                                                      PID:536
                                              • C:\Program Files\Internet Explorer\System Restore.exe
                                                "C:\Program Files\Internet Explorer\System Restore.exe" C:\Program Files\Internet Explorer\
                                                5⤵
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                PID:4772
                                                • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                  6⤵
                                                  • System policy modification
                                                  PID:1608
                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                  6⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:760
                                                • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                  "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                  6⤵
                                                    PID:4316
                                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:4824
                                                  • C:\Program Files\Internet Explorer\images\backup.exe
                                                    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                    6⤵
                                                      PID:3472
                                                    • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                      "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                      6⤵
                                                        PID:4700
                                                      • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                        "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                        6⤵
                                                          PID:2052
                                                        • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                          "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                          6⤵
                                                          • System policy modification
                                                          PID:4868
                                                      • C:\Program Files\Java\backup.exe
                                                        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                        5⤵
                                                        • Drops file in Program Files directory
                                                        PID:3848
                                                        • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                          "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                          6⤵
                                                            PID:1976
                                                        • C:\Program Files\Microsoft Office\backup.exe
                                                          "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                          5⤵
                                                            PID:1740
                                                            • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                              "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                              6⤵
                                                                PID:4388
                                                              • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                6⤵
                                                                  PID:2548
                                                            • C:\Program Files (x86)\backup.exe
                                                              "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                              4⤵
                                                              • Disables RegEdit via registry modification
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:1360
                                                              • C:\Program Files (x86)\Adobe\backup.exe
                                                                "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                5⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:4140
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2244
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                    7⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1428
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                    7⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • Executes dropped EXE
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2828
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                      8⤵
                                                                      • System policy modification
                                                                      PID:372
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                        9⤵
                                                                          PID:4992
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                        8⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        PID:4472
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\data.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:4364
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                        8⤵
                                                                        • Drops file in Program Files directory
                                                                        PID:2384
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                          9⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1680
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:3188
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                          9⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:4048
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                        8⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • Drops file in Program Files directory
                                                                        • System policy modification
                                                                        PID:1744
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                          9⤵
                                                                            PID:4536
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                          8⤵
                                                                          • Drops file in Program Files directory
                                                                          PID:384
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                          8⤵
                                                                            PID:4288
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                            8⤵
                                                                              PID:4820
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                9⤵
                                                                                  PID:1408
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                8⤵
                                                                                  PID:1428
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                    9⤵
                                                                                      PID:3044
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                    8⤵
                                                                                      PID:4084
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                    7⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Drops file in Program Files directory
                                                                                    PID:4592
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                    7⤵
                                                                                      PID:3824
                                                                                • C:\Program Files (x86)\Common Files\backup.exe
                                                                                  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                  5⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:908
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:2376
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                      7⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:4900
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                      7⤵
                                                                                        PID:2080
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                          8⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          PID:2856
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                        7⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        PID:4408
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                          8⤵
                                                                                            PID:4776
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                          7⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:3528
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                            8⤵
                                                                                              PID:4084
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\update.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                9⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • System policy modification
                                                                                                PID:2652
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                  10⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  PID:2168
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                    11⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:364
                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                      12⤵
                                                                                                        PID:3844
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                    10⤵
                                                                                                      PID:520
                                                                                            • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                              6⤵
                                                                                              • Drops file in Program Files directory
                                                                                              PID:4848
                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                7⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:4608
                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                7⤵
                                                                                                  PID:3668
                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                    8⤵
                                                                                                      PID:1576
                                                                                                • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                  6⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:1964
                                                                                                • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                  6⤵
                                                                                                    PID:3752
                                                                                                • C:\Program Files (x86)\Google\update.exe
                                                                                                  "C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\
                                                                                                  5⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  • System policy modification
                                                                                                  PID:4780
                                                                                                • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                  5⤵
                                                                                                    PID:2408
                                                                                                    • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                      "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                      6⤵
                                                                                                        PID:2248
                                                                                                  • C:\Users\System Restore.exe
                                                                                                    "C:\Users\System Restore.exe" C:\Users\
                                                                                                    4⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • System policy modification
                                                                                                    PID:2780
                                                                                                    • C:\Users\Admin\update.exe
                                                                                                      C:\Users\Admin\update.exe C:\Users\Admin\
                                                                                                      5⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      • System policy modification
                                                                                                      PID:1228
                                                                                                      • C:\Users\Admin\3D Objects\backup.exe
                                                                                                        "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                        6⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:1304
                                                                                                      • C:\Users\Admin\Contacts\backup.exe
                                                                                                        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                        6⤵
                                                                                                          PID:5024
                                                                                                        • C:\Users\Admin\Desktop\backup.exe
                                                                                                          C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                          6⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          • System policy modification
                                                                                                          PID:4552
                                                                                                        • C:\Users\Admin\Documents\backup.exe
                                                                                                          C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                          6⤵
                                                                                                            PID:4852
                                                                                                          • C:\Users\Admin\Downloads\backup.exe
                                                                                                            C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                            6⤵
                                                                                                            • System policy modification
                                                                                                            PID:4620
                                                                                                          • C:\Users\Admin\Favorites\backup.exe
                                                                                                            C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                            6⤵
                                                                                                              PID:1792
                                                                                                            • C:\Users\Admin\Links\backup.exe
                                                                                                              C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                              6⤵
                                                                                                              • System policy modification
                                                                                                              PID:1668
                                                                                                            • C:\Users\Admin\Music\backup.exe
                                                                                                              C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                              6⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:1064
                                                                                                            • C:\Users\Admin\OneDrive\backup.exe
                                                                                                              C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                              6⤵
                                                                                                              • System policy modification
                                                                                                              PID:3112
                                                                                                            • C:\Users\Admin\Pictures\backup.exe
                                                                                                              C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                              6⤵
                                                                                                                PID:844
                                                                                                                • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                  "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                  7⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • System policy modification
                                                                                                                  PID:1540
                                                                                                                • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                  "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                  7⤵
                                                                                                                    PID:1104
                                                                                                                • C:\Users\Admin\Videos\backup.exe
                                                                                                                  C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                  6⤵
                                                                                                                    PID:1448
                                                                                                                  • C:\Users\Admin\Searches\backup.exe
                                                                                                                    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                    6⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    PID:872
                                                                                                                  • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                    6⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:2460
                                                                                                                • C:\Users\Public\backup.exe
                                                                                                                  C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                  5⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • System policy modification
                                                                                                                  PID:3384
                                                                                                                  • C:\Users\Public\Documents\backup.exe
                                                                                                                    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                    6⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:3776
                                                                                                                  • C:\Users\Public\Videos\backup.exe
                                                                                                                    C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                    6⤵
                                                                                                                      PID:5044
                                                                                                                    • C:\Users\Public\Pictures\backup.exe
                                                                                                                      C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                      6⤵
                                                                                                                        PID:4140
                                                                                                                      • C:\Users\Public\Music\backup.exe
                                                                                                                        C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                        6⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        PID:4316
                                                                                                                      • C:\Users\Public\Downloads\backup.exe
                                                                                                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                        6⤵
                                                                                                                          PID:2944
                                                                                                                    • C:\Windows\backup.exe
                                                                                                                      C:\Windows\backup.exe C:\Windows\
                                                                                                                      4⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Drops file in Windows directory
                                                                                                                      PID:3488
                                                                                                                      • C:\Windows\addins\backup.exe
                                                                                                                        C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                        5⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2440
                                                                                                                      • C:\Windows\appcompat\backup.exe
                                                                                                                        C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                        5⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4876
                                                                                                                        • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                          C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                          6⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • System policy modification
                                                                                                                          PID:3936
                                                                                                                          • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                            C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                            7⤵
                                                                                                                            • System policy modification
                                                                                                                            PID:3108
                                                                                                                        • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                          C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                          6⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • System policy modification
                                                                                                                          PID:1852
                                                                                                                        • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                          C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                          6⤵
                                                                                                                          • System policy modification
                                                                                                                          PID:4680
                                                                                                                      • C:\Windows\apppatch\backup.exe
                                                                                                                        C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                        5⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:1500
                                                                                                                        • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                          C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                          6⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          PID:3376
                                                                                                                        • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                          C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                          6⤵
                                                                                                                            PID:4548
                                                                                                                          • C:\Windows\apppatch\fr-FR\backup.exe
                                                                                                                            C:\Windows\apppatch\fr-FR\backup.exe C:\Windows\apppatch\fr-FR\
                                                                                                                            6⤵
                                                                                                                              PID:4332
                                                                                                                          • C:\Windows\AppReadiness\backup.exe
                                                                                                                            C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                            5⤵
                                                                                                                              PID:5100
                                                                                                                            • C:\Windows\assembly\backup.exe
                                                                                                                              C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                              5⤵
                                                                                                                                PID:4972
                                                                                                                                • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                  C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                  6⤵
                                                                                                                                    PID:2900
                                                                                                                                    • C:\Windows\assembly\GAC\ADODB\backup.exe
                                                                                                                                      C:\Windows\assembly\GAC\ADODB\backup.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                      7⤵
                                                                                                                                        PID:5008
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4616
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1080
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4564
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              • System policy modification
                                                                                                                              PID:1052
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:988
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                              2⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:2200
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                            1⤵
                                                                                                                              PID:1236
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                2⤵
                                                                                                                                • System policy modification
                                                                                                                                PID:3716
                                                                                                                            • C:\Program Files (x86)\Google\CrashReports\data.exe
                                                                                                                              "C:\Program Files (x86)\Google\CrashReports\data.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                              1⤵
                                                                                                                                PID:4320
                                                                                                                              • C:\Program Files\Common Files\System\msadc\de-DE\update.exe
                                                                                                                                "C:\Program Files\Common Files\System\msadc\de-DE\update.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                                                                                1⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                PID:3824
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                                                1⤵
                                                                                                                                  PID:3348
                                                                                                                                • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                  1⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:3112
                                                                                                                                • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                  C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                  1⤵
                                                                                                                                    PID:988
                                                                                                                                  • C:\Windows\apppatch\Custom\data.exe
                                                                                                                                    C:\Windows\apppatch\Custom\data.exe C:\Windows\apppatch\Custom\
                                                                                                                                    1⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:3616
                                                                                                                                    • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                      C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                      2⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      PID:3060
                                                                                                                                  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                                                                                                    "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                                                                                                    1⤵
                                                                                                                                      PID:2548
                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                                                                                                        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                                                                                                        2⤵
                                                                                                                                          PID:1840
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                        1⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        PID:4700
                                                                                                                                      • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                        1⤵
                                                                                                                                        • System policy modification
                                                                                                                                        PID:2376
                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                        1⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:4276
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                        1⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        • System policy modification
                                                                                                                                        PID:3456
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                          2⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • System policy modification
                                                                                                                                          PID:2800
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                            3⤵
                                                                                                                                              PID:4120
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                              3⤵
                                                                                                                                                PID:4952
                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                                                            1⤵
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            PID:3548
                                                                                                                                          • C:\Windows\apppatch\CustomSDB\update.exe
                                                                                                                                            C:\Windows\apppatch\CustomSDB\update.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                            1⤵
                                                                                                                                            • System policy modification
                                                                                                                                            PID:5036
                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                            1⤵
                                                                                                                                              PID:5032
                                                                                                                                            • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                                                                                              "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                                                                                              1⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • System policy modification
                                                                                                                                              PID:3288
                                                                                                                                            • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:3448
                                                                                                                                              • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                2⤵
                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                PID:4352
                                                                                                                                                • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2044
                                                                                                                                                • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                                  2⤵
                                                                                                                                                    PID:628
                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe
                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  PID:1396
                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4288
                                                                                                                                                  • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                                                                                                    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                                                                                                    1⤵
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:3788
                                                                                                                                                  • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    PID:4304
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1664
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:2448
                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      PID:4760
                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5048
                                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3972
                                                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1488
                                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2780
                                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3860

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\PerfLogs\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                316f6b52cf9e6d3f186a4a94f84b1c41

                                                                                                                                                                SHA1

                                                                                                                                                                9a502d4606ca927bf1d293ab640d2d52fd5321b6

                                                                                                                                                                SHA256

                                                                                                                                                                4b5d689f9ce2d58134b3f522d51029a4038503325fa9340f7f49c5e09ae03e50

                                                                                                                                                                SHA512

                                                                                                                                                                5a0ed480aaccbb1e2f71e99666c72db4c6e67ad5ab109d0c6c31498b4a8be9fd37a159ea5dd8b20e5fbbe242f16afbce207be387edc3f33b958a87e3b23a4208

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\PerfLogs\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                316f6b52cf9e6d3f186a4a94f84b1c41

                                                                                                                                                                SHA1

                                                                                                                                                                9a502d4606ca927bf1d293ab640d2d52fd5321b6

                                                                                                                                                                SHA256

                                                                                                                                                                4b5d689f9ce2d58134b3f522d51029a4038503325fa9340f7f49c5e09ae03e50

                                                                                                                                                                SHA512

                                                                                                                                                                5a0ed480aaccbb1e2f71e99666c72db4c6e67ad5ab109d0c6c31498b4a8be9fd37a159ea5dd8b20e5fbbe242f16afbce207be387edc3f33b958a87e3b23a4208

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files (x86)\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                4cbb79dddd25e41d6a6cbaa836b37303

                                                                                                                                                                SHA1

                                                                                                                                                                70a0aedc58960aa530937e45406b5f514689fdc0

                                                                                                                                                                SHA256

                                                                                                                                                                4eed7ac13647c923ac06e8283057b6af61006f17eef0d7778370d06b76760724

                                                                                                                                                                SHA512

                                                                                                                                                                63072d66efcd38be27fde61a98dbc9173f62cc99bfacdc0056ce92d5ef487f2211035ee20c4e92b9ff0a266d5c3977ba00e576a9076a69a6161bd95d61db9f70

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files (x86)\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                4cbb79dddd25e41d6a6cbaa836b37303

                                                                                                                                                                SHA1

                                                                                                                                                                70a0aedc58960aa530937e45406b5f514689fdc0

                                                                                                                                                                SHA256

                                                                                                                                                                4eed7ac13647c923ac06e8283057b6af61006f17eef0d7778370d06b76760724

                                                                                                                                                                SHA512

                                                                                                                                                                63072d66efcd38be27fde61a98dbc9173f62cc99bfacdc0056ce92d5ef487f2211035ee20c4e92b9ff0a266d5c3977ba00e576a9076a69a6161bd95d61db9f70

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                c9568fa8142ba495a1f742bcdb8c2ff7

                                                                                                                                                                SHA1

                                                                                                                                                                c75a419519103487f126a63b06e9fc71ad7d275c

                                                                                                                                                                SHA256

                                                                                                                                                                9d3b92dc467827d0e8688a61d3a88eae54e66cfe14f760b7d1d90d66457028ed

                                                                                                                                                                SHA512

                                                                                                                                                                a45bfec5f3497cf854628235dae28a8f2f17941facb0f303c0a2ebc1aad85f4860b30b2ae094fe0330ee7582d4f2907643254f0df416ae3c944a867629a836fd

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                c9568fa8142ba495a1f742bcdb8c2ff7

                                                                                                                                                                SHA1

                                                                                                                                                                c75a419519103487f126a63b06e9fc71ad7d275c

                                                                                                                                                                SHA256

                                                                                                                                                                9d3b92dc467827d0e8688a61d3a88eae54e66cfe14f760b7d1d90d66457028ed

                                                                                                                                                                SHA512

                                                                                                                                                                a45bfec5f3497cf854628235dae28a8f2f17941facb0f303c0a2ebc1aad85f4860b30b2ae094fe0330ee7582d4f2907643254f0df416ae3c944a867629a836fd

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                a44cf77dca5abe8c7600884776caca3b

                                                                                                                                                                SHA1

                                                                                                                                                                b69719b451dffc3eec38e9f6291ae05d4b81a591

                                                                                                                                                                SHA256

                                                                                                                                                                5dab7b95914a4b1ae2dc6e8207b39fa36ffa29e58baa0a502f4ad98d6e767252

                                                                                                                                                                SHA512

                                                                                                                                                                32db4ba858a719bdea6adac5b60f6637cc6fc09ceb4ede00996b796c46b9dad9f870610632973e1d097b92a251843ebeb4c8ff9fb7580101973c6ad26f94592c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                a44cf77dca5abe8c7600884776caca3b

                                                                                                                                                                SHA1

                                                                                                                                                                b69719b451dffc3eec38e9f6291ae05d4b81a591

                                                                                                                                                                SHA256

                                                                                                                                                                5dab7b95914a4b1ae2dc6e8207b39fa36ffa29e58baa0a502f4ad98d6e767252

                                                                                                                                                                SHA512

                                                                                                                                                                32db4ba858a719bdea6adac5b60f6637cc6fc09ceb4ede00996b796c46b9dad9f870610632973e1d097b92a251843ebeb4c8ff9fb7580101973c6ad26f94592c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                493fec08695b758ff469ae2a47cd5a58

                                                                                                                                                                SHA1

                                                                                                                                                                c567adfcee0fa4e89958e4b184d2a2217800c3bd

                                                                                                                                                                SHA256

                                                                                                                                                                9330e94fd378b7ae341106619d54b522b31334c129d920a2ae0ad77c1b97ee3b

                                                                                                                                                                SHA512

                                                                                                                                                                8021ff69ddeeeb1765162fe537aaa084bf5fcc0298a4ec6088c0c2c9073fe27250eb3dc8a0ce912df0ef16e1499eebb313c36d3c00e1d4494058c1a191d861c5

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                493fec08695b758ff469ae2a47cd5a58

                                                                                                                                                                SHA1

                                                                                                                                                                c567adfcee0fa4e89958e4b184d2a2217800c3bd

                                                                                                                                                                SHA256

                                                                                                                                                                9330e94fd378b7ae341106619d54b522b31334c129d920a2ae0ad77c1b97ee3b

                                                                                                                                                                SHA512

                                                                                                                                                                8021ff69ddeeeb1765162fe537aaa084bf5fcc0298a4ec6088c0c2c9073fe27250eb3dc8a0ce912df0ef16e1499eebb313c36d3c00e1d4494058c1a191d861c5

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                a44cf77dca5abe8c7600884776caca3b

                                                                                                                                                                SHA1

                                                                                                                                                                b69719b451dffc3eec38e9f6291ae05d4b81a591

                                                                                                                                                                SHA256

                                                                                                                                                                5dab7b95914a4b1ae2dc6e8207b39fa36ffa29e58baa0a502f4ad98d6e767252

                                                                                                                                                                SHA512

                                                                                                                                                                32db4ba858a719bdea6adac5b60f6637cc6fc09ceb4ede00996b796c46b9dad9f870610632973e1d097b92a251843ebeb4c8ff9fb7580101973c6ad26f94592c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                a44cf77dca5abe8c7600884776caca3b

                                                                                                                                                                SHA1

                                                                                                                                                                b69719b451dffc3eec38e9f6291ae05d4b81a591

                                                                                                                                                                SHA256

                                                                                                                                                                5dab7b95914a4b1ae2dc6e8207b39fa36ffa29e58baa0a502f4ad98d6e767252

                                                                                                                                                                SHA512

                                                                                                                                                                32db4ba858a719bdea6adac5b60f6637cc6fc09ceb4ede00996b796c46b9dad9f870610632973e1d097b92a251843ebeb4c8ff9fb7580101973c6ad26f94592c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                9cf161d3fc904eca208e2cf133909c04

                                                                                                                                                                SHA1

                                                                                                                                                                58c8d9d41feb240eedbd728ad8ab4b3fd4ff0df9

                                                                                                                                                                SHA256

                                                                                                                                                                043e576a0f5172604eb585358ecd45f9c4662cd3fd633a7bb9e3bc9939c6952a

                                                                                                                                                                SHA512

                                                                                                                                                                73156ff27ad154bf61521e835d77405d530d2ed05496522eac35a0411d4dab1d9dc6d3d8081d98aabe7b527beb858bbff05cea67a0f9e394ea14141a97b014f0

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                9cf161d3fc904eca208e2cf133909c04

                                                                                                                                                                SHA1

                                                                                                                                                                58c8d9d41feb240eedbd728ad8ab4b3fd4ff0df9

                                                                                                                                                                SHA256

                                                                                                                                                                043e576a0f5172604eb585358ecd45f9c4662cd3fd633a7bb9e3bc9939c6952a

                                                                                                                                                                SHA512

                                                                                                                                                                73156ff27ad154bf61521e835d77405d530d2ed05496522eac35a0411d4dab1d9dc6d3d8081d98aabe7b527beb858bbff05cea67a0f9e394ea14141a97b014f0

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                493fec08695b758ff469ae2a47cd5a58

                                                                                                                                                                SHA1

                                                                                                                                                                c567adfcee0fa4e89958e4b184d2a2217800c3bd

                                                                                                                                                                SHA256

                                                                                                                                                                9330e94fd378b7ae341106619d54b522b31334c129d920a2ae0ad77c1b97ee3b

                                                                                                                                                                SHA512

                                                                                                                                                                8021ff69ddeeeb1765162fe537aaa084bf5fcc0298a4ec6088c0c2c9073fe27250eb3dc8a0ce912df0ef16e1499eebb313c36d3c00e1d4494058c1a191d861c5

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                493fec08695b758ff469ae2a47cd5a58

                                                                                                                                                                SHA1

                                                                                                                                                                c567adfcee0fa4e89958e4b184d2a2217800c3bd

                                                                                                                                                                SHA256

                                                                                                                                                                9330e94fd378b7ae341106619d54b522b31334c129d920a2ae0ad77c1b97ee3b

                                                                                                                                                                SHA512

                                                                                                                                                                8021ff69ddeeeb1765162fe537aaa084bf5fcc0298a4ec6088c0c2c9073fe27250eb3dc8a0ce912df0ef16e1499eebb313c36d3c00e1d4494058c1a191d861c5

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                82684cc72adb7d6198183d5481e28079

                                                                                                                                                                SHA1

                                                                                                                                                                31d2fb2b1fc61481ccf7c754ef672a3eaf0e6c40

                                                                                                                                                                SHA256

                                                                                                                                                                aca376afe6c799bc831e3924b16a2f8784ed4729f95a33219ee072fd3de8d0de

                                                                                                                                                                SHA512

                                                                                                                                                                d2e9589a2bcfe251d7f6e4e758edb664d30d9213d5ebcb8191ec00e7e954b55cde148f083dc7c893a383ffcdd6d30fda7d16f044b417efbe4105c581a8bdf60b

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                82684cc72adb7d6198183d5481e28079

                                                                                                                                                                SHA1

                                                                                                                                                                31d2fb2b1fc61481ccf7c754ef672a3eaf0e6c40

                                                                                                                                                                SHA256

                                                                                                                                                                aca376afe6c799bc831e3924b16a2f8784ed4729f95a33219ee072fd3de8d0de

                                                                                                                                                                SHA512

                                                                                                                                                                d2e9589a2bcfe251d7f6e4e758edb664d30d9213d5ebcb8191ec00e7e954b55cde148f083dc7c893a383ffcdd6d30fda7d16f044b417efbe4105c581a8bdf60b

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                9cf161d3fc904eca208e2cf133909c04

                                                                                                                                                                SHA1

                                                                                                                                                                58c8d9d41feb240eedbd728ad8ab4b3fd4ff0df9

                                                                                                                                                                SHA256

                                                                                                                                                                043e576a0f5172604eb585358ecd45f9c4662cd3fd633a7bb9e3bc9939c6952a

                                                                                                                                                                SHA512

                                                                                                                                                                73156ff27ad154bf61521e835d77405d530d2ed05496522eac35a0411d4dab1d9dc6d3d8081d98aabe7b527beb858bbff05cea67a0f9e394ea14141a97b014f0

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                9cf161d3fc904eca208e2cf133909c04

                                                                                                                                                                SHA1

                                                                                                                                                                58c8d9d41feb240eedbd728ad8ab4b3fd4ff0df9

                                                                                                                                                                SHA256

                                                                                                                                                                043e576a0f5172604eb585358ecd45f9c4662cd3fd633a7bb9e3bc9939c6952a

                                                                                                                                                                SHA512

                                                                                                                                                                73156ff27ad154bf61521e835d77405d530d2ed05496522eac35a0411d4dab1d9dc6d3d8081d98aabe7b527beb858bbff05cea67a0f9e394ea14141a97b014f0

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                82684cc72adb7d6198183d5481e28079

                                                                                                                                                                SHA1

                                                                                                                                                                31d2fb2b1fc61481ccf7c754ef672a3eaf0e6c40

                                                                                                                                                                SHA256

                                                                                                                                                                aca376afe6c799bc831e3924b16a2f8784ed4729f95a33219ee072fd3de8d0de

                                                                                                                                                                SHA512

                                                                                                                                                                d2e9589a2bcfe251d7f6e4e758edb664d30d9213d5ebcb8191ec00e7e954b55cde148f083dc7c893a383ffcdd6d30fda7d16f044b417efbe4105c581a8bdf60b

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\data.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                82684cc72adb7d6198183d5481e28079

                                                                                                                                                                SHA1

                                                                                                                                                                31d2fb2b1fc61481ccf7c754ef672a3eaf0e6c40

                                                                                                                                                                SHA256

                                                                                                                                                                aca376afe6c799bc831e3924b16a2f8784ed4729f95a33219ee072fd3de8d0de

                                                                                                                                                                SHA512

                                                                                                                                                                d2e9589a2bcfe251d7f6e4e758edb664d30d9213d5ebcb8191ec00e7e954b55cde148f083dc7c893a383ffcdd6d30fda7d16f044b417efbe4105c581a8bdf60b

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                0a1fdd46c76bacd30c22a94b436a3dee

                                                                                                                                                                SHA1

                                                                                                                                                                6413d3ca562cbd3e18fd1c332a51546ae4a7b227

                                                                                                                                                                SHA256

                                                                                                                                                                be4eb9294113927983a15a99a9290d08defd60924b5ff2f2acdbb13ea72dc6f4

                                                                                                                                                                SHA512

                                                                                                                                                                ee31ae19633712525c7aca4685d3370c0d793b9e3aeaff697f594356d51c41a3a76578e21c797c60ae9f1e32ee7f7ae85979fa8ab75b5331f6dc74ee305870f2

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                0a1fdd46c76bacd30c22a94b436a3dee

                                                                                                                                                                SHA1

                                                                                                                                                                6413d3ca562cbd3e18fd1c332a51546ae4a7b227

                                                                                                                                                                SHA256

                                                                                                                                                                be4eb9294113927983a15a99a9290d08defd60924b5ff2f2acdbb13ea72dc6f4

                                                                                                                                                                SHA512

                                                                                                                                                                ee31ae19633712525c7aca4685d3370c0d793b9e3aeaff697f594356d51c41a3a76578e21c797c60ae9f1e32ee7f7ae85979fa8ab75b5331f6dc74ee305870f2

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                0a1fdd46c76bacd30c22a94b436a3dee

                                                                                                                                                                SHA1

                                                                                                                                                                6413d3ca562cbd3e18fd1c332a51546ae4a7b227

                                                                                                                                                                SHA256

                                                                                                                                                                be4eb9294113927983a15a99a9290d08defd60924b5ff2f2acdbb13ea72dc6f4

                                                                                                                                                                SHA512

                                                                                                                                                                ee31ae19633712525c7aca4685d3370c0d793b9e3aeaff697f594356d51c41a3a76578e21c797c60ae9f1e32ee7f7ae85979fa8ab75b5331f6dc74ee305870f2

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                0a1fdd46c76bacd30c22a94b436a3dee

                                                                                                                                                                SHA1

                                                                                                                                                                6413d3ca562cbd3e18fd1c332a51546ae4a7b227

                                                                                                                                                                SHA256

                                                                                                                                                                be4eb9294113927983a15a99a9290d08defd60924b5ff2f2acdbb13ea72dc6f4

                                                                                                                                                                SHA512

                                                                                                                                                                ee31ae19633712525c7aca4685d3370c0d793b9e3aeaff697f594356d51c41a3a76578e21c797c60ae9f1e32ee7f7ae85979fa8ab75b5331f6dc74ee305870f2

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                0a1fdd46c76bacd30c22a94b436a3dee

                                                                                                                                                                SHA1

                                                                                                                                                                6413d3ca562cbd3e18fd1c332a51546ae4a7b227

                                                                                                                                                                SHA256

                                                                                                                                                                be4eb9294113927983a15a99a9290d08defd60924b5ff2f2acdbb13ea72dc6f4

                                                                                                                                                                SHA512

                                                                                                                                                                ee31ae19633712525c7aca4685d3370c0d793b9e3aeaff697f594356d51c41a3a76578e21c797c60ae9f1e32ee7f7ae85979fa8ab75b5331f6dc74ee305870f2

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                0a1fdd46c76bacd30c22a94b436a3dee

                                                                                                                                                                SHA1

                                                                                                                                                                6413d3ca562cbd3e18fd1c332a51546ae4a7b227

                                                                                                                                                                SHA256

                                                                                                                                                                be4eb9294113927983a15a99a9290d08defd60924b5ff2f2acdbb13ea72dc6f4

                                                                                                                                                                SHA512

                                                                                                                                                                ee31ae19633712525c7aca4685d3370c0d793b9e3aeaff697f594356d51c41a3a76578e21c797c60ae9f1e32ee7f7ae85979fa8ab75b5331f6dc74ee305870f2

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                d0a1345257c760e25f8ee855db49b801

                                                                                                                                                                SHA1

                                                                                                                                                                ef0eddacceb8f31cf665a0efc5a132cbee9a9e20

                                                                                                                                                                SHA256

                                                                                                                                                                e8deb25eee2c017224575495caaa79f26f591729781a346cbc3c5a767e95c4be

                                                                                                                                                                SHA512

                                                                                                                                                                604e5e5dc2f35d648eb9246b68d0b40cceb4595cd938ff443a5d52d186b483353c6765d533e6a476a4a74ac9b92552f2c90fb828f11c9be5e1c2046bd17b788c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                d0a1345257c760e25f8ee855db49b801

                                                                                                                                                                SHA1

                                                                                                                                                                ef0eddacceb8f31cf665a0efc5a132cbee9a9e20

                                                                                                                                                                SHA256

                                                                                                                                                                e8deb25eee2c017224575495caaa79f26f591729781a346cbc3c5a767e95c4be

                                                                                                                                                                SHA512

                                                                                                                                                                604e5e5dc2f35d648eb9246b68d0b40cceb4595cd938ff443a5d52d186b483353c6765d533e6a476a4a74ac9b92552f2c90fb828f11c9be5e1c2046bd17b788c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                804aaae61a6910c9109bca926cdfee1b

                                                                                                                                                                SHA1

                                                                                                                                                                b2056d827b006b1932b6c9365cc221e7a3440fdd

                                                                                                                                                                SHA256

                                                                                                                                                                942cf137066c4e0ad1aa4e5c332bc94358966f156e139378feaf8ddf9ba6be01

                                                                                                                                                                SHA512

                                                                                                                                                                e6a1d741e27085fecc91d9e01868b9935230f7080a15049296c9ea9d86c9b8ba6ce90fbeddb083cb7a4ce667a22f0988014e50d3d6d604f109ef4da00b17217c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                804aaae61a6910c9109bca926cdfee1b

                                                                                                                                                                SHA1

                                                                                                                                                                b2056d827b006b1932b6c9365cc221e7a3440fdd

                                                                                                                                                                SHA256

                                                                                                                                                                942cf137066c4e0ad1aa4e5c332bc94358966f156e139378feaf8ddf9ba6be01

                                                                                                                                                                SHA512

                                                                                                                                                                e6a1d741e27085fecc91d9e01868b9935230f7080a15049296c9ea9d86c9b8ba6ce90fbeddb083cb7a4ce667a22f0988014e50d3d6d604f109ef4da00b17217c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                fb6081f4b52f94b6a9a9f14f04ae4068

                                                                                                                                                                SHA1

                                                                                                                                                                a3eba871581dd14832270f5fbee11c552db339dc

                                                                                                                                                                SHA256

                                                                                                                                                                29c7d791b93bfa80a2272f12b4f68a5f025ad424fed3c9f734a5fb3dd8b5665c

                                                                                                                                                                SHA512

                                                                                                                                                                f86f75ad52451ce6b9cf6d0419d4f73befa9b382cf7225fe599f972e372078981065a8fde500859b632a822d634c31f28f096bf64a27a15cd345ec48046c82bc

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                fb6081f4b52f94b6a9a9f14f04ae4068

                                                                                                                                                                SHA1

                                                                                                                                                                a3eba871581dd14832270f5fbee11c552db339dc

                                                                                                                                                                SHA256

                                                                                                                                                                29c7d791b93bfa80a2272f12b4f68a5f025ad424fed3c9f734a5fb3dd8b5665c

                                                                                                                                                                SHA512

                                                                                                                                                                f86f75ad52451ce6b9cf6d0419d4f73befa9b382cf7225fe599f972e372078981065a8fde500859b632a822d634c31f28f096bf64a27a15cd345ec48046c82bc

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                fb6081f4b52f94b6a9a9f14f04ae4068

                                                                                                                                                                SHA1

                                                                                                                                                                a3eba871581dd14832270f5fbee11c552db339dc

                                                                                                                                                                SHA256

                                                                                                                                                                29c7d791b93bfa80a2272f12b4f68a5f025ad424fed3c9f734a5fb3dd8b5665c

                                                                                                                                                                SHA512

                                                                                                                                                                f86f75ad52451ce6b9cf6d0419d4f73befa9b382cf7225fe599f972e372078981065a8fde500859b632a822d634c31f28f096bf64a27a15cd345ec48046c82bc

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                fb6081f4b52f94b6a9a9f14f04ae4068

                                                                                                                                                                SHA1

                                                                                                                                                                a3eba871581dd14832270f5fbee11c552db339dc

                                                                                                                                                                SHA256

                                                                                                                                                                29c7d791b93bfa80a2272f12b4f68a5f025ad424fed3c9f734a5fb3dd8b5665c

                                                                                                                                                                SHA512

                                                                                                                                                                f86f75ad52451ce6b9cf6d0419d4f73befa9b382cf7225fe599f972e372078981065a8fde500859b632a822d634c31f28f096bf64a27a15cd345ec48046c82bc

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                3e84f457446a61ddf8106b33e9e63e9c

                                                                                                                                                                SHA1

                                                                                                                                                                ead8b09bd46d936be3c735d32c48d02dbbf6e077

                                                                                                                                                                SHA256

                                                                                                                                                                26f480b876e750c3fe43d3892579d8ca06327301af6c3ef4a4ded15fbf825c65

                                                                                                                                                                SHA512

                                                                                                                                                                ffb8eded6c20634e4cf3b164a59b86a9cc5c0848fa574f84052cc03cdf16bdf3ead21c8deb64da86f95c0e902c704cd22748b70713435b92de5a7fd8c89abf7f

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                3e84f457446a61ddf8106b33e9e63e9c

                                                                                                                                                                SHA1

                                                                                                                                                                ead8b09bd46d936be3c735d32c48d02dbbf6e077

                                                                                                                                                                SHA256

                                                                                                                                                                26f480b876e750c3fe43d3892579d8ca06327301af6c3ef4a4ded15fbf825c65

                                                                                                                                                                SHA512

                                                                                                                                                                ffb8eded6c20634e4cf3b164a59b86a9cc5c0848fa574f84052cc03cdf16bdf3ead21c8deb64da86f95c0e902c704cd22748b70713435b92de5a7fd8c89abf7f

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                3e84f457446a61ddf8106b33e9e63e9c

                                                                                                                                                                SHA1

                                                                                                                                                                ead8b09bd46d936be3c735d32c48d02dbbf6e077

                                                                                                                                                                SHA256

                                                                                                                                                                26f480b876e750c3fe43d3892579d8ca06327301af6c3ef4a4ded15fbf825c65

                                                                                                                                                                SHA512

                                                                                                                                                                ffb8eded6c20634e4cf3b164a59b86a9cc5c0848fa574f84052cc03cdf16bdf3ead21c8deb64da86f95c0e902c704cd22748b70713435b92de5a7fd8c89abf7f

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                3e84f457446a61ddf8106b33e9e63e9c

                                                                                                                                                                SHA1

                                                                                                                                                                ead8b09bd46d936be3c735d32c48d02dbbf6e077

                                                                                                                                                                SHA256

                                                                                                                                                                26f480b876e750c3fe43d3892579d8ca06327301af6c3ef4a4ded15fbf825c65

                                                                                                                                                                SHA512

                                                                                                                                                                ffb8eded6c20634e4cf3b164a59b86a9cc5c0848fa574f84052cc03cdf16bdf3ead21c8deb64da86f95c0e902c704cd22748b70713435b92de5a7fd8c89abf7f

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                13e5d66cdbb29031a02a7df24af50e87

                                                                                                                                                                SHA1

                                                                                                                                                                0e49e788cc077689178bda56b2b1306d0956b2f0

                                                                                                                                                                SHA256

                                                                                                                                                                1752a988fb29888e264598e03fd1b5d60aeac4f2492d817f136c1b3b52a6f81a

                                                                                                                                                                SHA512

                                                                                                                                                                b3787e942ff8583717dd4f5167efa884031df20dae620dbf49e7b14bcae2af028467f24c6326dff7bd059d83cd387b380fde1434b8b04ac5df7a7275b00a3251

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                13e5d66cdbb29031a02a7df24af50e87

                                                                                                                                                                SHA1

                                                                                                                                                                0e49e788cc077689178bda56b2b1306d0956b2f0

                                                                                                                                                                SHA256

                                                                                                                                                                1752a988fb29888e264598e03fd1b5d60aeac4f2492d817f136c1b3b52a6f81a

                                                                                                                                                                SHA512

                                                                                                                                                                b3787e942ff8583717dd4f5167efa884031df20dae620dbf49e7b14bcae2af028467f24c6326dff7bd059d83cd387b380fde1434b8b04ac5df7a7275b00a3251

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                85b43a00499b0e69f95278f2059d742c

                                                                                                                                                                SHA1

                                                                                                                                                                4ddf8c9108d4f91b5077a390396126ebfd582a3c

                                                                                                                                                                SHA256

                                                                                                                                                                c2ffff8bc8de256a805b7fff0faa334c338143753f9f1282ad125a3c2b7bca3d

                                                                                                                                                                SHA512

                                                                                                                                                                2896af8b478241e36079300ecee567aac1ae418047d758c0dd74407cd4b5475f53bdd27e5f47c6ec60a3c7efa580bab66afa1fe8007c72c99896b4991a719e3c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                85b43a00499b0e69f95278f2059d742c

                                                                                                                                                                SHA1

                                                                                                                                                                4ddf8c9108d4f91b5077a390396126ebfd582a3c

                                                                                                                                                                SHA256

                                                                                                                                                                c2ffff8bc8de256a805b7fff0faa334c338143753f9f1282ad125a3c2b7bca3d

                                                                                                                                                                SHA512

                                                                                                                                                                2896af8b478241e36079300ecee567aac1ae418047d758c0dd74407cd4b5475f53bdd27e5f47c6ec60a3c7efa580bab66afa1fe8007c72c99896b4991a719e3c

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                62a3299e6f9a09d69ba8e31e6d09581c

                                                                                                                                                                SHA1

                                                                                                                                                                c16e5e1cf6fe2a8b941aca03ab590ee108aacd1c

                                                                                                                                                                SHA256

                                                                                                                                                                341ab1fa64e2fe4670e8e20e795d45864721cba4b54516a8780436afa91b8698

                                                                                                                                                                SHA512

                                                                                                                                                                c25a1013361ac63141f81b619394f016352be575c3bd34ca57aab2eea51bfbeb7497aaa5907a32fee04f9b01d3e1a3e21496586ad73681783f8c2808cbc13509

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Program Files\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                62a3299e6f9a09d69ba8e31e6d09581c

                                                                                                                                                                SHA1

                                                                                                                                                                c16e5e1cf6fe2a8b941aca03ab590ee108aacd1c

                                                                                                                                                                SHA256

                                                                                                                                                                341ab1fa64e2fe4670e8e20e795d45864721cba4b54516a8780436afa91b8698

                                                                                                                                                                SHA512

                                                                                                                                                                c25a1013361ac63141f81b619394f016352be575c3bd34ca57aab2eea51bfbeb7497aaa5907a32fee04f9b01d3e1a3e21496586ad73681783f8c2808cbc13509

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2991090794\System Restore.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                1bbf04d5d5531cdee30855e49b21b0e5

                                                                                                                                                                SHA1

                                                                                                                                                                90d054404d75f268b2a4befa7ee363d7253014ed

                                                                                                                                                                SHA256

                                                                                                                                                                b2a052a1933e02d012d434fbb4a4d76213ff545c7b42dceafc3535d1cf7cbd88

                                                                                                                                                                SHA512

                                                                                                                                                                1e2da9194f2edda23892e8e1af4e4153796a28b7211e3ef70746911c7c9deb29d1b6a8ac6abe712f6850f41fea896dcd859434fac38b39ca9e8c1e4602f958d8

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2991090794\System Restore.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                1bbf04d5d5531cdee30855e49b21b0e5

                                                                                                                                                                SHA1

                                                                                                                                                                90d054404d75f268b2a4befa7ee363d7253014ed

                                                                                                                                                                SHA256

                                                                                                                                                                b2a052a1933e02d012d434fbb4a4d76213ff545c7b42dceafc3535d1cf7cbd88

                                                                                                                                                                SHA512

                                                                                                                                                                1e2da9194f2edda23892e8e1af4e4153796a28b7211e3ef70746911c7c9deb29d1b6a8ac6abe712f6850f41fea896dcd859434fac38b39ca9e8c1e4602f958d8

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                2d9ec2293c1d4430d6f7e4e73ed39cd7

                                                                                                                                                                SHA1

                                                                                                                                                                83f20d3eb2a5fdafa094478f888ce953777e8876

                                                                                                                                                                SHA256

                                                                                                                                                                090ec622e2e122610ee18e5355073017151059da60e070b0c560f4b0aa551897

                                                                                                                                                                SHA512

                                                                                                                                                                e0dec0dbe4d949b2973c45896fe2dc3043f408bec66aebae656b994a5b4b5b06b06354689ddbf9242cd492b576602288b647f4016f0b250246f413bc2324d0ad

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                2d9ec2293c1d4430d6f7e4e73ed39cd7

                                                                                                                                                                SHA1

                                                                                                                                                                83f20d3eb2a5fdafa094478f888ce953777e8876

                                                                                                                                                                SHA256

                                                                                                                                                                090ec622e2e122610ee18e5355073017151059da60e070b0c560f4b0aa551897

                                                                                                                                                                SHA512

                                                                                                                                                                e0dec0dbe4d949b2973c45896fe2dc3043f408bec66aebae656b994a5b4b5b06b06354689ddbf9242cd492b576602288b647f4016f0b250246f413bc2324d0ad

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                2d9ec2293c1d4430d6f7e4e73ed39cd7

                                                                                                                                                                SHA1

                                                                                                                                                                83f20d3eb2a5fdafa094478f888ce953777e8876

                                                                                                                                                                SHA256

                                                                                                                                                                090ec622e2e122610ee18e5355073017151059da60e070b0c560f4b0aa551897

                                                                                                                                                                SHA512

                                                                                                                                                                e0dec0dbe4d949b2973c45896fe2dc3043f408bec66aebae656b994a5b4b5b06b06354689ddbf9242cd492b576602288b647f4016f0b250246f413bc2324d0ad

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                2d9ec2293c1d4430d6f7e4e73ed39cd7

                                                                                                                                                                SHA1

                                                                                                                                                                83f20d3eb2a5fdafa094478f888ce953777e8876

                                                                                                                                                                SHA256

                                                                                                                                                                090ec622e2e122610ee18e5355073017151059da60e070b0c560f4b0aa551897

                                                                                                                                                                SHA512

                                                                                                                                                                e0dec0dbe4d949b2973c45896fe2dc3043f408bec66aebae656b994a5b4b5b06b06354689ddbf9242cd492b576602288b647f4016f0b250246f413bc2324d0ad

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                317dbdca13f9b02209ae394a5f8a02ae

                                                                                                                                                                SHA1

                                                                                                                                                                908a5dae1290d3a7d48be82450e1491fbaf302b5

                                                                                                                                                                SHA256

                                                                                                                                                                291b31eaab86255e17605ce9d283335b2e675418553b57cc3f550d9f1af63dba

                                                                                                                                                                SHA512

                                                                                                                                                                8ca42014cf35d038b4552fff5e51ef30b331a60db4e191b98d9b90060eda10d88c41c942c57ba52fd686ade38a4f9928856286ffd0b87eb9c582f4ec2cf38730

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                317dbdca13f9b02209ae394a5f8a02ae

                                                                                                                                                                SHA1

                                                                                                                                                                908a5dae1290d3a7d48be82450e1491fbaf302b5

                                                                                                                                                                SHA256

                                                                                                                                                                291b31eaab86255e17605ce9d283335b2e675418553b57cc3f550d9f1af63dba

                                                                                                                                                                SHA512

                                                                                                                                                                8ca42014cf35d038b4552fff5e51ef30b331a60db4e191b98d9b90060eda10d88c41c942c57ba52fd686ade38a4f9928856286ffd0b87eb9c582f4ec2cf38730

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                8d20ec99bd6c5f428f8fe58011fa3b53

                                                                                                                                                                SHA1

                                                                                                                                                                9b8945c6e8396fe5ca8fbebdf526e90b3555e976

                                                                                                                                                                SHA256

                                                                                                                                                                848cfccda179a32842825aa3daac16219dd87cbc64751a2e32cfe2b0f5aef0e3

                                                                                                                                                                SHA512

                                                                                                                                                                ed6c8bd2a1ff94822671667230bbb3a7ddb496c52a2addfa32a448eccff6075474b11f650ec1a365ced93175dc39db768fab3ae49c5983a6a9252e4669b7dfd1

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                8d20ec99bd6c5f428f8fe58011fa3b53

                                                                                                                                                                SHA1

                                                                                                                                                                9b8945c6e8396fe5ca8fbebdf526e90b3555e976

                                                                                                                                                                SHA256

                                                                                                                                                                848cfccda179a32842825aa3daac16219dd87cbc64751a2e32cfe2b0f5aef0e3

                                                                                                                                                                SHA512

                                                                                                                                                                ed6c8bd2a1ff94822671667230bbb3a7ddb496c52a2addfa32a448eccff6075474b11f650ec1a365ced93175dc39db768fab3ae49c5983a6a9252e4669b7dfd1

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                2d9ec2293c1d4430d6f7e4e73ed39cd7

                                                                                                                                                                SHA1

                                                                                                                                                                83f20d3eb2a5fdafa094478f888ce953777e8876

                                                                                                                                                                SHA256

                                                                                                                                                                090ec622e2e122610ee18e5355073017151059da60e070b0c560f4b0aa551897

                                                                                                                                                                SHA512

                                                                                                                                                                e0dec0dbe4d949b2973c45896fe2dc3043f408bec66aebae656b994a5b4b5b06b06354689ddbf9242cd492b576602288b647f4016f0b250246f413bc2324d0ad

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                2d9ec2293c1d4430d6f7e4e73ed39cd7

                                                                                                                                                                SHA1

                                                                                                                                                                83f20d3eb2a5fdafa094478f888ce953777e8876

                                                                                                                                                                SHA256

                                                                                                                                                                090ec622e2e122610ee18e5355073017151059da60e070b0c560f4b0aa551897

                                                                                                                                                                SHA512

                                                                                                                                                                e0dec0dbe4d949b2973c45896fe2dc3043f408bec66aebae656b994a5b4b5b06b06354689ddbf9242cd492b576602288b647f4016f0b250246f413bc2324d0ad

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                e6a2f11384e3279b20c548b2097a8bed

                                                                                                                                                                SHA1

                                                                                                                                                                ba448b285c90dec9e7ac2b6b31eb3022c6a1f14b

                                                                                                                                                                SHA256

                                                                                                                                                                4d49f4894fb14a31e7d9f8cb5bc266087389942e2c346bb7b0396b89d799c383

                                                                                                                                                                SHA512

                                                                                                                                                                ef192d3049101cf72c89c3e1c98f82c48711b85be0896cc1fc8999fd0430606ca33188645b110adedf575adf6a032b349a2f7fc8eb0fcf1234774fb588796bd7

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                e6a2f11384e3279b20c548b2097a8bed

                                                                                                                                                                SHA1

                                                                                                                                                                ba448b285c90dec9e7ac2b6b31eb3022c6a1f14b

                                                                                                                                                                SHA256

                                                                                                                                                                4d49f4894fb14a31e7d9f8cb5bc266087389942e2c346bb7b0396b89d799c383

                                                                                                                                                                SHA512

                                                                                                                                                                ef192d3049101cf72c89c3e1c98f82c48711b85be0896cc1fc8999fd0430606ca33188645b110adedf575adf6a032b349a2f7fc8eb0fcf1234774fb588796bd7

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                c29a29c4149951cb13578e04a48285a9

                                                                                                                                                                SHA1

                                                                                                                                                                0fc72f5e2bdcaa08e33636c0f4f9de4a10abc082

                                                                                                                                                                SHA256

                                                                                                                                                                566751c82d4205af0149ea4209c673f9906122120bb389107af8350d90d007b7

                                                                                                                                                                SHA512

                                                                                                                                                                ad41d3d45b295d06af7ce499e663e594bcb4a26b49c1ede8913d9727fd23ed9d617bcaae8baea23b7e6e80ea9e5d06cbc28371ef76d1c5329c90a886c0bf9c8e

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                c29a29c4149951cb13578e04a48285a9

                                                                                                                                                                SHA1

                                                                                                                                                                0fc72f5e2bdcaa08e33636c0f4f9de4a10abc082

                                                                                                                                                                SHA256

                                                                                                                                                                566751c82d4205af0149ea4209c673f9906122120bb389107af8350d90d007b7

                                                                                                                                                                SHA512

                                                                                                                                                                ad41d3d45b295d06af7ce499e663e594bcb4a26b49c1ede8913d9727fd23ed9d617bcaae8baea23b7e6e80ea9e5d06cbc28371ef76d1c5329c90a886c0bf9c8e

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\odt\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                84715a9886e2a158ebd22eea6755af86

                                                                                                                                                                SHA1

                                                                                                                                                                31897f7dec80a1dc35ad5b1eb964e5d51e38ee01

                                                                                                                                                                SHA256

                                                                                                                                                                674301156fecb78f3b0f2210b953eebe1d1eeb8bd59ff850a44e2ec18a3ba8ed

                                                                                                                                                                SHA512

                                                                                                                                                                b41068bdb648f973f2c0c0c6917cc8415e4e982106f1b9d736888c78f591401add6023f06367a2c74796b82858450c52a22c77cf8d430ee549ecbe743b403e56

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\odt\backup.exe
                                                                                                                                                                Filesize

                                                                                                                                                                72KB

                                                                                                                                                                MD5

                                                                                                                                                                84715a9886e2a158ebd22eea6755af86

                                                                                                                                                                SHA1

                                                                                                                                                                31897f7dec80a1dc35ad5b1eb964e5d51e38ee01

                                                                                                                                                                SHA256

                                                                                                                                                                674301156fecb78f3b0f2210b953eebe1d1eeb8bd59ff850a44e2ec18a3ba8ed

                                                                                                                                                                SHA512

                                                                                                                                                                b41068bdb648f973f2c0c0c6917cc8415e4e982106f1b9d736888c78f591401add6023f06367a2c74796b82858450c52a22c77cf8d430ee549ecbe743b403e56

                                                                                                                                                                Download Submit