Overview

overview

10

Static

static

78217f069f...a9.exe

windows7-x64

10

78217f069f...a9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    24s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 18:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    78217f069f4641f81c5b3465e814688d5685e718e4ae6dca12696e6d3b5ac8a9.exe

  • Size

    72KB

  • MD5

    52b87b907a236f945c8b42494a09d3c6

  • SHA1

    c4104dea1826dc90e5171e43bc5e0fd5fb5eaa62

  • SHA256

    78217f069f4641f81c5b3465e814688d5685e718e4ae6dca12696e6d3b5ac8a9

  • SHA512

    7e3085a240c3ece31a357561fff3b47fdcd0c7d0a9c2efbe771d8f3354c575be9a44d58cff23df5cad24b7ff19811e0d692b7521b370698d2ea4c0d8a1a7c77f

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf23:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrr

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\78217f069f4641f81c5b3465e814688d5685e718e4ae6dca12696e6d3b5ac8a9.exe
    "C:\Users\Admin\AppData\Local\Temp\78217f069f4641f81c5b3465e814688d5685e718e4ae6dca12696e6d3b5ac8a9.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\3096201276\System Restore.exe
      "C:\Users\Admin\AppData\Local\Temp\3096201276\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\3096201276\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1148
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1428
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1996
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1816
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:972
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1384
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1300
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2012
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1992
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:976
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1880
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1080
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:820
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1572
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1576
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:696
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:336
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1196
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:992
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1152
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:964
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2004
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1620
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1956
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1604
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1460
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1056
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1816
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1908
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1712
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:840
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1300
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1680
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1124
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1992
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:764
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:568
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1292
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1764
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1676
                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1672
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:624
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1452
                • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2008
                • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1196
                • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:992
                • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1016
                • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:964
                • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1408
                • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:664
                • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1556
                • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:884
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:744
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1460
              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe
                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • System policy modification
                PID:464
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                  8⤵
                    PID:740
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:1068
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1908
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                    8⤵
                      PID:1084
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                      8⤵
                      • System policy modification
                      PID:1104
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\update.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                      8⤵
                        PID:1112
                    • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • Drops file in Program Files directory
                      PID:2020
                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        PID:1160
                    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • System policy modification
                      PID:1960
                    • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                      7⤵
                      • Disables RegEdit via registry modification
                      • System policy modification
                      PID:544
                    • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                      7⤵
                      • Drops file in Program Files directory
                      • System policy modification
                      PID:1992
                      • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        PID:2028
                      • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:1880
                      • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\update.exe
                        "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:1080
                      • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        PID:1276
                      • C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:1580
                      • C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
                        8⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:1676
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                      7⤵
                      • Disables RegEdit via registry modification
                      • Drops file in Program Files directory
                      PID:1896
                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:696
                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:1592
                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:1516
                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
                        8⤵
                        • Disables RegEdit via registry modification
                        PID:1324
                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:2008
                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • System policy modification
                        PID:980
                    • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:1040
                    • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:2000
                    • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Drops file in Program Files directory
                      • System policy modification
                      PID:1984
                      • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\data.exe
                        "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\data.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:964
                        • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
                          9⤵
                            PID:2004
                    • C:\Program Files\Common Files\Services\System Restore.exe
                      "C:\Program Files\Common Files\Services\System Restore.exe" C:\Program Files\Common Files\Services\
                      6⤵
                      • Modifies visibility of file extensions in Explorer
                      • System policy modification
                      PID:1620
                    • C:\Program Files\Common Files\SpeechEngines\backup.exe
                      "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                      6⤵
                      • Drops file in Program Files directory
                      PID:1956
                      • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                        7⤵
                        • Disables RegEdit via registry modification
                        • Drops file in Program Files directory
                        • System policy modification
                        PID:1512
                    • C:\Program Files\Common Files\System\backup.exe
                      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                      6⤵
                      • Drops file in Program Files directory
                      PID:884
                      • C:\Program Files\Common Files\System\ado\backup.exe
                        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                        7⤵
                        • Drops file in Program Files directory
                        • System policy modification
                        PID:1648
                        • C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe
                          "C:\Program Files\Common Files\System\ado\de-DE\System Restore.exe" C:\Program Files\Common Files\System\ado\de-DE\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • System policy modification
                          PID:1916
                        • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                          "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                          8⤵
                            PID:2012
                          • C:\Program Files\Common Files\System\ado\es-ES\data.exe
                            "C:\Program Files\Common Files\System\ado\es-ES\data.exe" C:\Program Files\Common Files\System\ado\es-ES\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:1816
                          • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                            "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • System policy modification
                            PID:1832
                          • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                            "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                            8⤵
                              PID:1152
                            • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                              "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                              8⤵
                                PID:1908
                            • C:\Program Files\Common Files\System\de-DE\backup.exe
                              "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:1084
                            • C:\Program Files\Common Files\System\en-US\backup.exe
                              "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:464
                            • C:\Program Files\Common Files\System\es-ES\backup.exe
                              "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                              7⤵
                                PID:676
                              • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                7⤵
                                  PID:1356
                                • C:\Program Files\Common Files\System\it-IT\backup.exe
                                  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • System policy modification
                                  PID:1880
                                • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                  "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  PID:1276
                                • C:\Program Files\Common Files\System\msadc\data.exe
                                  "C:\Program Files\Common Files\System\msadc\data.exe" C:\Program Files\Common Files\System\msadc\
                                  7⤵
                                  • Drops file in Program Files directory
                                  PID:572
                                  • C:\Program Files\Common Files\System\msadc\de-DE\System Restore.exe
                                    "C:\Program Files\Common Files\System\msadc\de-DE\System Restore.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    PID:1452
                                  • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                    8⤵
                                      PID:1672
                                    • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                      "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:1016
                                    • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                      "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:1996
                                    • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                      "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                      8⤵
                                      • System policy modification
                                      PID:1612
                                    • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                      8⤵
                                        PID:852
                                    • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                      "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                      7⤵
                                      • Drops file in Program Files directory
                                      • System policy modification
                                      PID:676
                                      • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        PID:520
                                      • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                        8⤵
                                          PID:1584
                                        • C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe
                                          "C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:1580
                                        • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:1448
                                        • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                          "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:1324
                                        • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                          8⤵
                                            PID:1260
                                    • C:\Program Files\DVD Maker\backup.exe
                                      "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                      5⤵
                                      • Disables RegEdit via registry modification
                                      • Drops file in Program Files directory
                                      • System policy modification
                                      PID:1592
                                      • C:\Program Files\DVD Maker\de-DE\backup.exe
                                        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                        6⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:1476
                                      • C:\Program Files\DVD Maker\en-US\backup.exe
                                        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                        6⤵
                                          PID:1040
                                        • C:\Program Files\DVD Maker\es-ES\backup.exe
                                          "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:1984
                                        • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                          "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                          6⤵
                                            PID:816
                                          • C:\Program Files\DVD Maker\it-IT\backup.exe
                                            "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                            6⤵
                                              PID:1572
                                            • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                              "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                              6⤵
                                                PID:1268
                                              • C:\Program Files\DVD Maker\Shared\backup.exe
                                                "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                6⤵
                                                  PID:1384
                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                    7⤵
                                                      PID:820
                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                        8⤵
                                                          PID:1316
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                          8⤵
                                                            PID:596
                                                    • C:\Program Files\Google\backup.exe
                                                      "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                      5⤵
                                                        PID:1904
                                                        • C:\Program Files\Google\Chrome\backup.exe
                                                          "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                          6⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • System policy modification
                                                          PID:1584
                                                          • C:\Program Files\Google\Chrome\Application\update.exe
                                                            "C:\Program Files\Google\Chrome\Application\update.exe" C:\Program Files\Google\Chrome\Application\
                                                            7⤵
                                                              PID:992
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                8⤵
                                                                  PID:1792
                                                                • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                                                  8⤵
                                                                    PID:940
                                                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                    8⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    PID:112
                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                              5⤵
                                                                PID:1996
                                                                • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                  6⤵
                                                                    PID:1160
                                                                  • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                    6⤵
                                                                      PID:568
                                                                    • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                      "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                      6⤵
                                                                      • Drops file in Program Files directory
                                                                      PID:676
                                                                    • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                      "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                      6⤵
                                                                        PID:1668
                                                                      • C:\Program Files\Internet Explorer\images\backup.exe
                                                                        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                        6⤵
                                                                          PID:812
                                                                        • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                          "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                          6⤵
                                                                            PID:1896
                                                                          • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                            "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                            6⤵
                                                                              PID:1476
                                                                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                              6⤵
                                                                                PID:1716
                                                                            • C:\Program Files\Java\backup.exe
                                                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                              5⤵
                                                                                PID:1960
                                                                              • C:\Program Files\Microsoft Games\backup.exe
                                                                                "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                5⤵
                                                                                  PID:336
                                                                                • C:\Program Files\Microsoft Office\backup.exe
                                                                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                  5⤵
                                                                                    PID:1916
                                                                                  • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                    "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                    5⤵
                                                                                      PID:1292
                                                                                    • C:\Program Files\MSBuild\backup.exe
                                                                                      "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                      5⤵
                                                                                        PID:1192
                                                                                      • C:\Program Files\Reference Assemblies\backup.exe
                                                                                        "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
                                                                                        5⤵
                                                                                          PID:1040
                                                                                        • C:\Program Files\VideoLAN\backup.exe
                                                                                          "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
                                                                                          5⤵
                                                                                            PID:1132
                                                                                        • C:\Program Files (x86)\backup.exe
                                                                                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                          4⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Drops file in Program Files directory
                                                                                          • System policy modification
                                                                                          PID:1048
                                                                                          • C:\Program Files (x86)\Adobe\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                            5⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Drops file in Program Files directory
                                                                                            PID:1660
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\data.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                              6⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Drops file in Program Files directory
                                                                                              PID:1352
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                                7⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:544
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                                7⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • System policy modification
                                                                                                PID:1668
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                  8⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System policy modification
                                                                                                  PID:1752
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                  8⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  PID:1572
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                  8⤵
                                                                                                    PID:1676
                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                    8⤵
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:2044
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                      9⤵
                                                                                                        PID:2008
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                      8⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:1380
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                                      8⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:1384
                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                                        9⤵
                                                                                                          PID:1564
                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                                        8⤵
                                                                                                        • System policy modification
                                                                                                        PID:1916
                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                                        8⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • Drops file in Program Files directory
                                                                                                        • System policy modification
                                                                                                        PID:268
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
                                                                                                          9⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • System policy modification
                                                                                                          PID:1664
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
                                                                                                            10⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:1404
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
                                                                                                          9⤵
                                                                                                            PID:1120
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\update.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
                                                                                                              10⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • System policy modification
                                                                                                              PID:744
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                11⤵
                                                                                                                  PID:1056
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
                                                                                                              9⤵
                                                                                                                PID:1300
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
                                                                                                                  10⤵
                                                                                                                  • System policy modification
                                                                                                                  PID:1732
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
                                                                                                                9⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:2028
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
                                                                                                                  10⤵
                                                                                                                    PID:112
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                                8⤵
                                                                                                                • System policy modification
                                                                                                                PID:1752
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
                                                                                                                  9⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:1640
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                                8⤵
                                                                                                                  PID:944
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                                  8⤵
                                                                                                                    PID:304
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                                  7⤵
                                                                                                                    PID:1536
                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                                                      8⤵
                                                                                                                        PID:2044
                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
                                                                                                                          9⤵
                                                                                                                            PID:1692
                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                                                          8⤵
                                                                                                                            PID:1016
                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
                                                                                                                            8⤵
                                                                                                                              PID:1040
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
                                                                                                                                9⤵
                                                                                                                                  PID:1092
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
                                                                                                                                  9⤵
                                                                                                                                    PID:1556
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
                                                                                                                                      10⤵
                                                                                                                                        PID:1296
                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
                                                                                                                                          11⤵
                                                                                                                                            PID:1604
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
                                                                                                                                      8⤵
                                                                                                                                        PID:664
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
                                                                                                                                        8⤵
                                                                                                                                          PID:1816
                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
                                                                                                                                            9⤵
                                                                                                                                              PID:840
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                10⤵
                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                PID:1120
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                10⤵
                                                                                                                                                  PID:572
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                    11⤵
                                                                                                                                                      PID:1764
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                      11⤵
                                                                                                                                                        PID:696
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                        11⤵
                                                                                                                                                          PID:1512
                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                                                  7⤵
                                                                                                                                                    PID:1740
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
                                                                                                                                                      8⤵
                                                                                                                                                        PID:1072
                                                                                                                                                • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                  5⤵
                                                                                                                                                    PID:1068
                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\System Restore.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                      6⤵
                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                      PID:1056
                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                        7⤵
                                                                                                                                                          PID:976
                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                                                                                          7⤵
                                                                                                                                                            PID:1768
                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
                                                                                                                                                              8⤵
                                                                                                                                                                PID:1060
                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:1556
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:1980
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe AIR\data.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe AIR\data.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:972
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:2028
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:2020
                                                                                                                                                                    • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:1800
                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Services\update.exe
                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Services\update.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:2044
                                                                                                                                                                        • C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:944
                                                                                                                                                                          • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:364
                                                                                                                                                                          • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1468
                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\update.exe
                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\update.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:1200
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:544
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:1912
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:1908
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:1512
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:884
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1660
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft.NET\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:1676
                                                                                                                                                                                          • C:\Users\backup.exe
                                                                                                                                                                                            C:\Users\backup.exe C:\Users\
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:432
                                                                                                                                                                                              • C:\Users\Admin\backup.exe
                                                                                                                                                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:388
                                                                                                                                                                                                  • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:1160
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                                      C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:1960
                                                                                                                                                                                                      • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                        PID:1300
                                                                                                                                                                                                      • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:1356
                                                                                                                                                                                                        • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                          C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                          • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                            C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:1120
                                                                                                                                                                                                            • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                              C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:1676
                                                                                                                                                                                                              • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:1604
                                                                                                                                                                                                                • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:988
                                                                                                                                                                                                                  • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                                                    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:268
                                                                                                                                                                                                                    • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                                                      C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:2012
                                                                                                                                                                                                                    • C:\Users\Public\backup.exe
                                                                                                                                                                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:2000
                                                                                                                                                                                                                        • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                          C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:596
                                                                                                                                                                                                                          • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                            C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:304
                                                                                                                                                                                                                            • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                              C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                              • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                                C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:572
                                                                                                                                                                                                                                • C:\Users\Public\Recorded TV\backup.exe
                                                                                                                                                                                                                                  "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:1976
                                                                                                                                                                                                                                  • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                    C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:972
                                                                                                                                                                                                                                • C:\Windows\System Restore.exe
                                                                                                                                                                                                                                  "C:\Windows\System Restore.exe" C:\Windows\
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                PID:544
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:1884
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                PID:1292
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:1672
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:1316
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:1324

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            • C:\PerfLogs\Admin\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c201a2df4ebeb94a7acf5518a557b3b8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27bb477a92ae449450fc0abfe34b60613262f708

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ab2b3137b6dd5a8cbb0501be441806f19bfb3f5a5c88220524afd90971952686

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6049c72d56e2c45494fe6c5402b5384be092cb847ccabd8b6d1f9e27e3a4b8b33400941a39416491d4c50f2490700cc4f659e1a8b20c7a06e8dc2e2a735ad540

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a8c487592e037129243a28cc9c1a9b50

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e8b10d4b757512ef56a7a5f46eba7108d3aad552

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              2126ebec95f7b4aea0cf3bad4071564e0668091e8216dfafbd69abafd7a4fd56

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              488dff9385017c912c30e2162a54e020cd8b501002652c7afa0791aee451e72a7ab5da5e19c7ac3667e1225c7956f73f8c61b00231a0ba147355e7109afe678f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c201a2df4ebeb94a7acf5518a557b3b8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27bb477a92ae449450fc0abfe34b60613262f708

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ab2b3137b6dd5a8cbb0501be441806f19bfb3f5a5c88220524afd90971952686

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6049c72d56e2c45494fe6c5402b5384be092cb847ccabd8b6d1f9e27e3a4b8b33400941a39416491d4c50f2490700cc4f659e1a8b20c7a06e8dc2e2a735ad540

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c201a2df4ebeb94a7acf5518a557b3b8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27bb477a92ae449450fc0abfe34b60613262f708

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ab2b3137b6dd5a8cbb0501be441806f19bfb3f5a5c88220524afd90971952686

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6049c72d56e2c45494fe6c5402b5384be092cb847ccabd8b6d1f9e27e3a4b8b33400941a39416491d4c50f2490700cc4f659e1a8b20c7a06e8dc2e2a735ad540

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7fb8235922daa3a6bf6631c0f54d7f23

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              502aa63806eb6ce2ede6a3777d38a551990335ca

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7c871314ee6cc5946b5e5343db8e6d42eccd1c99d85eb81478c11d713f933efa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5494ad2c1a0ba09da8c5012d69bc6bda1f55a30cdf8e445bcd1ee8a631bcef3d1ca9464775888f8997a1415c7cc516948b6ffc36e06090918faf4cc79d18fc09

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              9981d0570be2bb1cc1030275cf5e3657

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              96b17dd7616753dff3c126e52c9a59e91f9fc18d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              fec9b600b6ad3545cd10d65b52c087823526b168b7b8d07b0bf398bee397095e

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1084d9bacd2515c354b2ba964559c09b3e858eb42b3e7f0f6522da411978c024f2c862d4fcc935667200fd3818c285bd32587250fb43981f62d4cd4e97e3cc1f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              9981d0570be2bb1cc1030275cf5e3657

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              96b17dd7616753dff3c126e52c9a59e91f9fc18d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              fec9b600b6ad3545cd10d65b52c087823526b168b7b8d07b0bf398bee397095e

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1084d9bacd2515c354b2ba964559c09b3e858eb42b3e7f0f6522da411978c024f2c862d4fcc935667200fd3818c285bd32587250fb43981f62d4cd4e97e3cc1f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              af206556c485aca7b8273a1681326928

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8875addbeff35797f8d4a2c4b7e66d4a6349cb11

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8c24334162fc40601107418d25fd97dd106ed1e0567972602df143674decd6d3

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              cef9bc4f720fa58c6af8f65f98a1aed8c5ff39d3064f6b059b8df745f7f6466fbfe72fe1a5cdb9562a342b15900c053c930b27318cc4685722b9c33f5c6f2035

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7fb8235922daa3a6bf6631c0f54d7f23

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              502aa63806eb6ce2ede6a3777d38a551990335ca

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7c871314ee6cc5946b5e5343db8e6d42eccd1c99d85eb81478c11d713f933efa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5494ad2c1a0ba09da8c5012d69bc6bda1f55a30cdf8e445bcd1ee8a631bcef3d1ca9464775888f8997a1415c7cc516948b6ffc36e06090918faf4cc79d18fc09

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7fb8235922daa3a6bf6631c0f54d7f23

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              502aa63806eb6ce2ede6a3777d38a551990335ca

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7c871314ee6cc5946b5e5343db8e6d42eccd1c99d85eb81478c11d713f933efa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5494ad2c1a0ba09da8c5012d69bc6bda1f55a30cdf8e445bcd1ee8a631bcef3d1ca9464775888f8997a1415c7cc516948b6ffc36e06090918faf4cc79d18fc09

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b95dc155ea35f57053af415d7848411f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              78c4da102705f7c29f576d2bdb43a98feecbfeaa

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              6f63e170334ddf0a641edca55ebc9fd6961163f458ac1eacd741b82292256ff8

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              718e6938141e46112e8a3e96028987423bae690ac2818434f23bb256670c9fbbfc69613e5f38188abae1ed82b81b0475c2b58fd98548c54cd205cad48c4c51f7

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              957350dece241a1b2c6313e2c2305887

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              40c15f55d7c79ccbc7f7addad7a1981cc5b4c433

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a1e78638c07cbbfbb1c426825010988d6b8296a5049c34abbf18afb2754f1524

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b33379fad29549c9edbf8ba31881fd6b0d59c7aa21699670125cecb45852f0e58b199347d23028c0f76c9d96189bdea6aecc31573934ed338ad072a315e8a287

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              957350dece241a1b2c6313e2c2305887

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              40c15f55d7c79ccbc7f7addad7a1981cc5b4c433

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a1e78638c07cbbfbb1c426825010988d6b8296a5049c34abbf18afb2754f1524

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b33379fad29549c9edbf8ba31881fd6b0d59c7aa21699670125cecb45852f0e58b199347d23028c0f76c9d96189bdea6aecc31573934ed338ad072a315e8a287

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Program Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3096201276\System Restore.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3096201276\System Restore.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              6171135c2285b2aa1c53440004fcf2ca

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              a5b327f8b670355860d78cdc37725d085eb02f44

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e1cd24c2dc11ade89b0151186686a703c12d9bc55c896f1ec5f85894b71d03e2

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              836873c377e0aa0c6a478bc81186b9e6193966da488e61314b7b3e3f16a7b9856c259e531926201a99fd90cb6f23ea29a0029fb614834b9c4d41dbaf43c72164

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • C:\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              6171135c2285b2aa1c53440004fcf2ca

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              a5b327f8b670355860d78cdc37725d085eb02f44

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              e1cd24c2dc11ade89b0151186686a703c12d9bc55c896f1ec5f85894b71d03e2

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              836873c377e0aa0c6a478bc81186b9e6193966da488e61314b7b3e3f16a7b9856c259e531926201a99fd90cb6f23ea29a0029fb614834b9c4d41dbaf43c72164

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c201a2df4ebeb94a7acf5518a557b3b8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27bb477a92ae449450fc0abfe34b60613262f708

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ab2b3137b6dd5a8cbb0501be441806f19bfb3f5a5c88220524afd90971952686

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6049c72d56e2c45494fe6c5402b5384be092cb847ccabd8b6d1f9e27e3a4b8b33400941a39416491d4c50f2490700cc4f659e1a8b20c7a06e8dc2e2a735ad540

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c201a2df4ebeb94a7acf5518a557b3b8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27bb477a92ae449450fc0abfe34b60613262f708

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ab2b3137b6dd5a8cbb0501be441806f19bfb3f5a5c88220524afd90971952686

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6049c72d56e2c45494fe6c5402b5384be092cb847ccabd8b6d1f9e27e3a4b8b33400941a39416491d4c50f2490700cc4f659e1a8b20c7a06e8dc2e2a735ad540

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a8c487592e037129243a28cc9c1a9b50

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e8b10d4b757512ef56a7a5f46eba7108d3aad552

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              2126ebec95f7b4aea0cf3bad4071564e0668091e8216dfafbd69abafd7a4fd56

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              488dff9385017c912c30e2162a54e020cd8b501002652c7afa0791aee451e72a7ab5da5e19c7ac3667e1225c7956f73f8c61b00231a0ba147355e7109afe678f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a8c487592e037129243a28cc9c1a9b50

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              e8b10d4b757512ef56a7a5f46eba7108d3aad552

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              2126ebec95f7b4aea0cf3bad4071564e0668091e8216dfafbd69abafd7a4fd56

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              488dff9385017c912c30e2162a54e020cd8b501002652c7afa0791aee451e72a7ab5da5e19c7ac3667e1225c7956f73f8c61b00231a0ba147355e7109afe678f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c201a2df4ebeb94a7acf5518a557b3b8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27bb477a92ae449450fc0abfe34b60613262f708

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ab2b3137b6dd5a8cbb0501be441806f19bfb3f5a5c88220524afd90971952686

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6049c72d56e2c45494fe6c5402b5384be092cb847ccabd8b6d1f9e27e3a4b8b33400941a39416491d4c50f2490700cc4f659e1a8b20c7a06e8dc2e2a735ad540

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              c201a2df4ebeb94a7acf5518a557b3b8

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              27bb477a92ae449450fc0abfe34b60613262f708

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              ab2b3137b6dd5a8cbb0501be441806f19bfb3f5a5c88220524afd90971952686

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              6049c72d56e2c45494fe6c5402b5384be092cb847ccabd8b6d1f9e27e3a4b8b33400941a39416491d4c50f2490700cc4f659e1a8b20c7a06e8dc2e2a735ad540

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7fb8235922daa3a6bf6631c0f54d7f23

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              502aa63806eb6ce2ede6a3777d38a551990335ca

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7c871314ee6cc5946b5e5343db8e6d42eccd1c99d85eb81478c11d713f933efa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5494ad2c1a0ba09da8c5012d69bc6bda1f55a30cdf8e445bcd1ee8a631bcef3d1ca9464775888f8997a1415c7cc516948b6ffc36e06090918faf4cc79d18fc09

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7fb8235922daa3a6bf6631c0f54d7f23

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              502aa63806eb6ce2ede6a3777d38a551990335ca

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7c871314ee6cc5946b5e5343db8e6d42eccd1c99d85eb81478c11d713f933efa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5494ad2c1a0ba09da8c5012d69bc6bda1f55a30cdf8e445bcd1ee8a631bcef3d1ca9464775888f8997a1415c7cc516948b6ffc36e06090918faf4cc79d18fc09

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              9981d0570be2bb1cc1030275cf5e3657

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              96b17dd7616753dff3c126e52c9a59e91f9fc18d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              fec9b600b6ad3545cd10d65b52c087823526b168b7b8d07b0bf398bee397095e

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1084d9bacd2515c354b2ba964559c09b3e858eb42b3e7f0f6522da411978c024f2c862d4fcc935667200fd3818c285bd32587250fb43981f62d4cd4e97e3cc1f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              9981d0570be2bb1cc1030275cf5e3657

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              96b17dd7616753dff3c126e52c9a59e91f9fc18d

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              fec9b600b6ad3545cd10d65b52c087823526b168b7b8d07b0bf398bee397095e

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              1084d9bacd2515c354b2ba964559c09b3e858eb42b3e7f0f6522da411978c024f2c862d4fcc935667200fd3818c285bd32587250fb43981f62d4cd4e97e3cc1f

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              af206556c485aca7b8273a1681326928

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8875addbeff35797f8d4a2c4b7e66d4a6349cb11

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8c24334162fc40601107418d25fd97dd106ed1e0567972602df143674decd6d3

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              cef9bc4f720fa58c6af8f65f98a1aed8c5ff39d3064f6b059b8df745f7f6466fbfe72fe1a5cdb9562a342b15900c053c930b27318cc4685722b9c33f5c6f2035

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              af206556c485aca7b8273a1681326928

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              8875addbeff35797f8d4a2c4b7e66d4a6349cb11

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8c24334162fc40601107418d25fd97dd106ed1e0567972602df143674decd6d3

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              cef9bc4f720fa58c6af8f65f98a1aed8c5ff39d3064f6b059b8df745f7f6466fbfe72fe1a5cdb9562a342b15900c053c930b27318cc4685722b9c33f5c6f2035

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7fb8235922daa3a6bf6631c0f54d7f23

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              502aa63806eb6ce2ede6a3777d38a551990335ca

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7c871314ee6cc5946b5e5343db8e6d42eccd1c99d85eb81478c11d713f933efa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5494ad2c1a0ba09da8c5012d69bc6bda1f55a30cdf8e445bcd1ee8a631bcef3d1ca9464775888f8997a1415c7cc516948b6ffc36e06090918faf4cc79d18fc09

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7fb8235922daa3a6bf6631c0f54d7f23

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              502aa63806eb6ce2ede6a3777d38a551990335ca

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              7c871314ee6cc5946b5e5343db8e6d42eccd1c99d85eb81478c11d713f933efa

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              5494ad2c1a0ba09da8c5012d69bc6bda1f55a30cdf8e445bcd1ee8a631bcef3d1ca9464775888f8997a1415c7cc516948b6ffc36e06090918faf4cc79d18fc09

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b95dc155ea35f57053af415d7848411f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              78c4da102705f7c29f576d2bdb43a98feecbfeaa

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              6f63e170334ddf0a641edca55ebc9fd6961163f458ac1eacd741b82292256ff8

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              718e6938141e46112e8a3e96028987423bae690ac2818434f23bb256670c9fbbfc69613e5f38188abae1ed82b81b0475c2b58fd98548c54cd205cad48c4c51f7

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b95dc155ea35f57053af415d7848411f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              78c4da102705f7c29f576d2bdb43a98feecbfeaa

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              6f63e170334ddf0a641edca55ebc9fd6961163f458ac1eacd741b82292256ff8

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              718e6938141e46112e8a3e96028987423bae690ac2818434f23bb256670c9fbbfc69613e5f38188abae1ed82b81b0475c2b58fd98548c54cd205cad48c4c51f7

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b95dc155ea35f57053af415d7848411f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              78c4da102705f7c29f576d2bdb43a98feecbfeaa

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              6f63e170334ddf0a641edca55ebc9fd6961163f458ac1eacd741b82292256ff8

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              718e6938141e46112e8a3e96028987423bae690ac2818434f23bb256670c9fbbfc69613e5f38188abae1ed82b81b0475c2b58fd98548c54cd205cad48c4c51f7

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              957350dece241a1b2c6313e2c2305887

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              40c15f55d7c79ccbc7f7addad7a1981cc5b4c433

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a1e78638c07cbbfbb1c426825010988d6b8296a5049c34abbf18afb2754f1524

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b33379fad29549c9edbf8ba31881fd6b0d59c7aa21699670125cecb45852f0e58b199347d23028c0f76c9d96189bdea6aecc31573934ed338ad072a315e8a287

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              957350dece241a1b2c6313e2c2305887

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              40c15f55d7c79ccbc7f7addad7a1981cc5b4c433

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              a1e78638c07cbbfbb1c426825010988d6b8296a5049c34abbf18afb2754f1524

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              b33379fad29549c9edbf8ba31881fd6b0d59c7aa21699670125cecb45852f0e58b199347d23028c0f76c9d96189bdea6aecc31573934ed338ad072a315e8a287

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Program Files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              99a0eed287492b492be50d91e8fb4f94

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d4ce0e350115b0dd3c752294f559ce28af1adf1

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              17f22a9d9d91d020f8702595c5625da42cef80968fc0b0d0ce1fa16a8865c3a6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              364c3de0b1e4bc902e8f093363e4017ae85e9db6b2065c2d079936dfd905946d0ec829742babd246f944b7da7f796d65de9ad79a47aff2ac80569d8c92da8a86

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\3096201276\System Restore.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\3096201276\System Restore.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              b00de7d0c3d4a00c2dcefadc03f57908

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              3237efb5d89c671629f7e91862325eadce99f237

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              0b7978647a1dac23503a94e73f1c531ce1e7a831b1b40d2c79702e7a9ca42b61

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              77c9e597a767731f2f02876f2ccd2a4adca3cee0814c5c9a045d712c1363d58387a583be5e7246f7498501dd3d77dad7443f8f0544c6cf9633e32a7a0c2a0879

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              4db35c6b9ef375364dadfda4e92ff25f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7d5f16f14c25a0dba1a6f52684adb6f89ecf6f0c

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              1307c67069b8eb59759f118dd8c6f622a60c6b35d6b5e9b6e42ead350cc63ecf

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              e9671e0256a35334ca2214d8b86c805561da6065f3595b54c5fde52633de2ea85bd940de12811cadd61d81ce48d8fb41c6ecba45a97f7f83da5c1027bad93e2b

                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                            • memory/336-197-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/464-321-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/544-64-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/568-267-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/624-282-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/664-306-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/696-194-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/744-315-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/764-264-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/820-185-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/840-249-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/884-312-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/964-300-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/964-210-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/972-135-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/976-174-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/992-294-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/992-203-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1016-297-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1056-234-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1060-141-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1080-182-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1124-258-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1148-100-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1152-206-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1196-291-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1196-200-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1292-270-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1292-76-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1300-155-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1300-252-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1316-88-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1324-94-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1384-148-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1408-303-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1428-107-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1452-285-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1460-230-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1460-318-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1556-309-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1572-188-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1576-191-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1604-226-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1620-218-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1672-82-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1672-279-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1676-276-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1680-255-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1688-58-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1712-246-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1764-273-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1816-238-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1816-128-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1880-179-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1884-70-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1908-242-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1956-222-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1964-120-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1992-261-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1992-168-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/1996-114-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2004-214-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2008-288-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2012-161-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2016-124-0x0000000074C71000-0x0000000074C73000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                            • memory/2016-98-0x00000000766D1000-0x00000000766D3000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                              Download